Writing
Practical writing on software engineering, security, AI, and the industry around them.
PHP2Shell: what to patch and what to contain
How to patch, verify and contain PHP2Shell on servers and Kubernetes.
All posts
From CakePHP to Laravel
How I moved a legacy CakePHP supply chain app to Laravel and React.
Resource requests are load-bearing
What pods without resource requests do to Kubernetes scheduling and eviction.
Never set a Redis memory limit equal to its maxmemory
Why Redis gets OOMKilled when maxmemory matches its container limit.
One public IPv4 for the whole cluster
Setting up NAT egress for a cluster with a single public IPv4 address.
Capability scoping for agent tools
Designing narrow, allow-listed tools so an agent can only do what it should.
Who is the agent acting for?
Keeping agents scoped to the right customer by enforcing identity in the tools.
LLMs are good at code you can verify, and bad at code you cannot
When to hand code to an LLM: only where you can cheaply check the result.
When Letters Lie: Analyzing a Typical IDN Homograph Attack
Breaking down a phishing domain built from lookalike Unicode characters.
Owning your dependency supply chain
What a private package registry does and does not protect against.