All of my blogs as they are published.
Security is ultimately a political problem that may have technical solutions. It's because we can always risk it and hope for the best. Observe a climber, solving the technical problem of ascending after a political decision of taking this route.
Let’s deploy JA4. A tutorial for a HAProxy deployment and a proof-of-concept of PCAP collection and then parsing in Python.
The internet is full of bots and some aren't nice (DDoS, scraping, exploits, AI..). To block bots, we must identify them in the traffic. That's hard as some pretend to be human/browsers! Let's explore JA3/JA4 hashes, fingerprinting the TLS handshake.
Internet traffic is mostly encrypted - one SNI extension still causes trouble. Encrypted Client Hello aims to fix this for a price of dependency on big tech. Is this the way?
I've created a newsletter app as a competition entry (didn't win). Here's the writeup. Uses AI to report on AI!
I'd like to have a complete Advent of Code collection. This time I tackled 2015, 2020 and 2025.
Let's run some local models on a spare old GPU. Using Ollama and OpenWebUI we can enjoy plenty of pleasant features without breaking a sweat.
This is how I finished Factorio: Space Age, built a 1000 SPM megabase, reached shattered planet and kept my relationships intact.
I've moved to a self-hosted solution for this blog. Here's the story.
There is Nazi content on substack, without a doubt. And I don’t like it, so I am moving away from the platform.
There was a recent incident where Microsoft somehow allegedly blocked a mailbox of a sanctioned individual. Any organization highly depending on MS products that might come into the crosshair should ask - can this happen to me?
A brand new feature in LLMs is “understanding” text. Pretty much all of the knowledge work can be abstracted to a simple instruction: Answer my question using the relevant context. LLM hype claims it's solved. I’ll show you that it’s very much not.
In this part, we’ll be looking at Model Context Protocol (MCP). We’ll cover the features (tools, resources, prompts, roots, sampling), how it works, how to communicate with it (both locally and remotely).
Vibe coding has taken the world by storm, and I’ve realized that I am behind. Now I'm correcting that mistake.
In this tutorial we’ll take a look on how to add LLM (Mistral AI) capabilities into neovim (since I don’t want to use Cursor).
Shannon Entropy Shenanigans
I wanted to learn more about secret detection. Maybe my notes will help somebody else.
And a few frustrated opinions.
Oh, the weather outside is frightful. But 2D grids are delightful. Since CPU temp is high, let it fry, let it fry, let it fry.
Space, rockets, asteroids, custom computers, retro games and bugs!
Coding there and back again.
Maximizing the fun of Advent of Code by removing the tedious parts.
Thanks for all the fish, Pelican!
Ah, to be a phisher on a sunny day. Throw your bait, crack a beer - but where would I go to set up my tools?
You can actually calculate an upper-bound cost for cracking your passwords via offline attacks. This is how.
You can actually calculate an upper-bound cost for cracking your passwords via offline attacks. This is how.
Talk about security best practices for Copilot solutions, taking inspiration from MS GitHub Copilot and OWASP Top10 for LLMs.
Tool to find the AS numbers, names and country codes for a large set of IPs quickly.
I need to write a python script to perform/automate some task from time to time. But I don't like writing the same thing over and over again and I sure don't need a package. So I wrote a cookiecutter template for my scripts.
Observing a highly-scalable phishing as a service campaign.
Are there any options on how to prevent GitHub Copilot to process our secrets?
I got a message from my friend in the lines of: “Hi! I remember you did penetration tests, we want some. Where can we order some penetration tests?” Dear friend, here's your answer.
Detect versions and vulnerabilities for many Swagger UI instances.
Do you want to know about pentesting but don’t know where to start? Not sure what the difference is between hacking and pentesting?
In this post we'll look at a playbook for provisioning Kali Linux via Vagrant and VirtualBox.