The Anonymity Playbook
Journalists, sources, activists and anyone whose privacy has stakes
Cyber Security, Without the Jargon
Cybersecurity doesn't have to be complicated. I am here to break down concepts, threats, tips, and tools in simple language. For mere mortals and developers alike.
Since I have been asked this a lot: The best way to support this site, is to buy my books.
Books by the author
Compare all 5-
-
The Digital Fortress
Anyone protecting their own money, accounts and family online
-
Secure Software Development
Developers shipping production code under delivery pressure
-
The Secure Harness
Teams running AI coding agents in repositories others depend on
-
The AI Native Engineer
Engineers taking AI features from a working demo to production
As an Amazon Associate I earn from qualifying purchases. Buying through these links costs you nothing extra and helps pay for the blog.
Latest Posts
The Browser Fix Does Not Fix Every Trust Store
| 19 min read
For Developers Eight weak certificate-authority keys were blocked quickly in major browsers, but many applications carry a separate copy of trust. Here is how to find the verifier your software actually uses, update it, and prove the fix reached production.
The DeepSeek Removal Order Is an AI Dependency Inventory Test
| 20 min read
For Developers A new US federal order reaches past a named AI product into third-party services built on it. The practical lesson for engineering teams is to inventory the model, provider, route, data, and fallback behind every AI feature.
A Clean Update Page Cannot Prove Your PC Stayed Clean
| 21 min read
For Mortals Researchers found that attackers briefly changed AOMEI Backupper update instructions, then put the genuine files back. Here is how to check the Windows PC rather than trusting what the download page shows today.
The OpenCode Console Breach Is a Credential Boundary Failure
| 21 min read
For Developers OpenCode says a breach affected a subset of Console users who connected outside AI providers. Here is how to rotate those credentials, check the bill, and give the next key a smaller blast radius.
The GitLab Regex Patch Is an Inventory Problem
| 21 min read
For Developers GitLab fixed a critical CI parser flaw that researchers have reproduced on a self-managed server. The useful response is to find every instance, patch the correct release line, prove the running version, and review a narrow set of evidence.
When a Backup Provider's Key Opens Your Microsoft 365 Tenant
| 21 min read
For Developers ConnectWise suspended Cloud Backup after application identities were used for unauthorised Microsoft 365 access. Here is how a vendor credential crosses tenants, what revocation cannot undo, and how to investigate without guessing.
The Bankruptcy Notice System Is Down, but Your Case May Still Be Moving
| 22 min read
For Mortals A cyber incident has stopped a federal system that sends bankruptcy notices. Here is what is affected, what remains uncertain, and how debtors and creditors can check a case without trusting an unexpected message.
A Firewall Patch Still Needs a Management-Path Check
| 20 min read
For Developers Palo Alto Networks patched an exploited PAN-OS flaw that can turn an authenticated management session into root access. Here is how to patch, trace the administrative path, and decide how much investigation the evidence warrants.