Tag: security

Stop opening port 22 to the world. SSH bastion hosts, ProxyJump chains, session recording, and self-hosted Teleport alternatives that actually work.

systemd-homed turns your home dir into a portable LUKS-encrypted blob. Move it between machines, unlock with FIDO2, and own your own data.

Route only the traffic you want through a SOCKS5 proxy via ssh -D. Browser extensions, curl, git, ProxyChains, autossh, and DNS leak gotchas, no VPN needed.

Coding agents get unrestricted shell access by default because it's easy, not because they need it. Here's the short list of what actually breaks without one.

Sandstorm gives every app instance its own capability-gated sandbox. Different threat model than a Compose stack, here's what that actually means.

Claude Code and other AI coding agents need somewhere to run. Compare laptop, Docker, throwaway VMs, and Cloudflare Workers on blast radius, cost, and setup.

A Go binary on FROM scratch gives you a 10 MB image with no shell, no libc, no /tmp. Everything that breaks on an empty filesystem, and how to fix each one.

OPA and Rego aren't just Kubernetes gatekeepers. Block :latest tags in CI, enforce Terraform resource tags, and filter HTTP APIs.

Put Authelia forward auth in front of Vaultwarden without breaking the Bitwarden apps. The correct bypass list, and an honest account of what it protects.

Stop typing LUKS passphrases on every headless reboot. Tang + Clevis = NBDE: disks unlock automatically on your trusted network, stay sealed everywhere else.

Protocol mimicry only wins the hiding fight. Learn why relay cascades, domestic hosting, and disposable infrastructure make blocking your traffic expensive.

REALITY does not disguise your traffic as a real TLS handshake, it serves an actual one. How that works, a working config, and the honest limits of the trick.