The Anonymity Playbook
Journalists, sources, activists and anyone whose privacy has stakes
Cyber Security, Without the Jargon
Cybersecurity doesn't have to be complicated. I am here to break down concepts, threats, tips, and tools in simple language. For mere mortals and developers alike.
Since I have been asked this a lot: The best way to support this site, is to buy my books.
Books by the author
Compare all 5-
-
The Digital Fortress
Anyone protecting their own money, accounts and family online
-
Secure Software Development
Developers shipping production code under delivery pressure
-
The Secure Harness
Teams running AI coding agents in repositories others depend on
-
The AI Native Engineer
Engineers taking AI features from a working demo to production
As an Amazon Associate I earn from qualifying purchases. Buying through these links costs you nothing extra and helps pay for the blog.
Latest Posts
Verify the Apache HTTP/2 Fix Against the Running Configuration
| 15 min read
For Developers Apache HTTP Server 2.4.71 fixes a critical HTTP/2 memory-corruption flaw. Here is how to find the exposed route, apply the right vendor fix, and prove the repaired process is serving traffic.
Chrome’s November Fix Needs One Relaunch
| 16 min read
For Mortals Chrome fixed a security flaw that attackers were already using. Here is how to finish the update, verify the version, and ignore fake update prompts.
An Agent Sandbox Needs a Network Exit Test
| 16 min read
For Developers A security agent left its test environment and reached a WorkOS sales tool. The incident shows why agent containment must cover network exits, reachable services, credentials, rate limits, and early detection.
The Alpine OpenSSH Fix Needs a Restart Receipt
| 15 min read
For Developers A long password could open some Alpine Linux SSH accounts. Here is how the authentication check failed, which servers are exposed, and how to prove the fix is running.
A Tower Dump Started With Every Phone Nearby
| 16 min read
For Experts A pending Ninth Circuit appeal shows how a place and a time can turn nearby phones into investigative leads, and why the important privacy decision happens before arrival.
Node-RED Command Editor Needs an Identity Gate
| 15 min read
For Developers A missing authentication check let remote callers deploy Node-RED flows that could run operating-system commands. Here is how to repair the affected Siemens devices and review the command path behind the editor.
LXD Trusted a Certificate Without Proof of Its Key
| 14 min read
For Developers A certificate-chain mistake let reachable LXD, MicroCloud, and Incus APIs accept a copied public certificate as identity. Here is how the failure worked, where exposure was limited, and what engineering teams should verify now.
Repository Code Belongs Behind a Loader Boundary
| 15 min read
For Developers A malicious Hugging Face model copy carried a cryptominer and a reverse shell. Here is how to find the code-loading path, contain model evaluation, and respond if it already ran.