Recent content on gsilvapt dot me
For the past couple of months, I have changed jobs and in this current gig we use LLMs - like, a lot. 
 We’ve seen great things come out of these tools, but also a lot of slop. We’ve learned where LLMs can help us become more productive and deliver more, while also seeing their limits and where we need to tread carefully. We also run our own MCP server to help integrate our…
For the past ~4 months, I have been using large language models (LLMs) for different types of tasks. The industry kept marching at its pace, with people being made redundant with LLMs cited as the reason. My personal experience tells me that is not the real reason. 
 In this post, I want to share loose thoughts on many points the current state of AI touches. This isn’t a structured…
In the past 4 weeks, I have been iterating on optimising a Django app, in particular the Django admin, which is heavily used by one of the apps I help maintain at work. 
 When I initially started investigating the topic, many places pointed out to caching. Caching is a great option indeed, but it can lead to a lot of problems. However, for the Django Admin view, caching is even more…
Ever since I started the journey with static websites
, I have always loved using the Jekyll or Hugo + GitLab Pages combo. A few examples include: 
 
 this site 
 Ubucon Europe Portugal - a static website for Ubucon Europe back in 2019; 
 adistancia.ansol.org - a static website listing open source software for schools and
teachers to use during COVID-19 and lockdown times.…
Over the past month, I have been working on surface-security which is an open source security intelligence and automation platform. 
 One of the things I wanted to review was the project’s CI/CD Pipelines, to ensure we could confidently merge changes from outsiders (when we eventually get there), but also to ensure we stay dynamic, nimble and running smooth. In addition, the workflows…

 Monthly reviews are a collection of posts where I try to review the previous month and set the expectations for the
upcoming month. Not only does it help me keep track of what I have on my plate, but also works as a public record of things I
have done and achieved, both on a personal level and in my profession. 
 
 This month was a month of changes for me. Changed back into…

 HackTheBox is a hacking playground. Often I spent time working
on their challenges and boxes but I rarely do any public write-ups about it.
The goal of these posts is to highlight something I learnt when working on them and what could have been done from a
blue teamer’s perspective. 
 
 In September 2021, a medium HackTheBox machine came out called Unicode 1 and it…

 Monthly reviews are a collection of posts where I try to review the previous month and set the expectations for the
upcoming month. Not only does it help me keep track of what I have on my plate, but also works as a public record of things I
have done and achieved, both on a personal level and in my profession. 
 
 During this month, I started some research projects which…

 HackTheBox is a hacking playground. For a few months now, I have spent some time working
on their challenges but I rarely posted any write-up about the challenges I work there.
Offers span from simple quick challenges, to full-blown boxes.
The goal of these posts is to highlight something I learnt when working on them. 
 
 Phonebook is a web challenge that starts with a…

 Monthly reviews are a collection of posts where I try to review the previous month and set the expectations for the
upcoming month. Not only does it help me keep track of what I have on my plate, but also works as a public record of things I
have done and achieved, both on a personal level and in my profession. 
 
 It has been some time since I last did one of these reviews.…

 Monthly reviews are a collection of posts where I try to review the previous month and set the expectations for the
upcoming month. Not only does it help me keep track of what I have on my plate, but also works as a public record of things I
have done and achieved, both on a personal level and in my profession. 
 
 The year started off with me getting sick. The first week was…
Recently, someone close to me asked for some recommendations on how to build a system to prevent potential account
takeovers. This person was looking for some good readings on the subject and, to my surprise, the topic is full of
security vendors trying to sell their software and “AI-powered” solutions to this problem. 
 I disagree companies need such expensive software,…

 Monthly reviews are a collection of posts where I try to review the previous month and set the expectations for the
upcoming month. Not only does it help me keep track of what I have on my plate, but also works as a public record of things I
have done and achieved, both on a personal level and in my profession. 
 
 December was heavily influenced by Log4J vulnerabilities…

 Monthly reviews are a collection of posts where I try to review the previous month and set the expectations for the
upcoming month. Not only does it help me keep track of what I have on my plate, but also works as a public record of things I
have done and achieved, both on a personal level and in my profession. 
 
 November was not as productive as October, even though some…

 Monthly reviews are a collection of posts where I try to review the previous month and set the expectations for the
upcoming month. Not only does it help me keep track of what I have on my plate, but also works as a public record of things I
have done and achieved, both on a personal level and in my profession. 
 
 October was a good month. Had a few setbacks occasionally,…
On the 18th of October, I released to the public a small private project called pmz . 
 In a previous post, I wrote about my approach to Zettelkasten method 
and discussed why I had my own flow instead of using other software full of features I do not need nor am interested
in using. 
 Also recently I decided I wanted to learn how to code in Go and to get out of the tutorial-zone.…
Zettelkasten is a note-taking method that has recently been rising into
popularity with tools like Obsidian , RoamResearch , and even
 Notion . 
 This approach simply consists of digesting chunks of information into small pieces and contain them in a single place,
linking notes back and forth according to the topics. Ideally, one will link all notes of a given keyword so that…

 How to Avoid a Climate Disaster by Bill Gates 
 
 

 Early in 2021, I heard of Bill Gates’ new book on the environment called “How to Avoid a Climate Disaster: The Solutions We Have and the Breakthroughs” .
I wanted to read it because, for one, I am interested in sustainability, efficiency and progression, and two, it felt like a good start to get a…
Who am I? 
 Hi and welcome to my blog! I am Gustavo Silva, a software developer focusing on Cyber Security. 
 My interests range from how to better design software and systems to maximize developers productivity while making it
easier to test, deploy and monitor changes in software, how to break and defend said systems from external attacks
(classic red/blue exercises - which makes…
In the last 10 years, perhaps more, infrastructure as code has been rising in popularity, allowing development
teams to create solid, repeatable and scalable infrastructures with a few configuration files. Most companies
will inevitably adopt these technologies into their life cycles because, otherwise, they will lose a lot on efficiency. 
 From Chef , to Ansible , and more recently,…
Amidst the 2020 chaos, shhbt, my first open source project, was released! 
 
 I was fortunate enough to be working on this project in my application security team, and the tool empowers developers to configure a proactive secret scanner at repository level. 
 This is a key factor, considering other similar solutions. Another key factor is the fact keys and secrets can be added or…
There is one thing common to all sorts of software applications: they need data. As features and the application
evolves, the data modelling and the data structures change too. 
 I have been developing software using the amazing Python web framework Django. Their documentation is pretty
good and there’s a considerable community behind it to support most issues and problems you…
Introduction 
 Docker is a wonderful tool. There are lots of resources out there to help you get started but I feel they easily overlook how you can secure your host machine in a production environment. 
 This post attempts to address one possible configuration setup that is more restrictive about external access and good for projects that have all their services configured under a docker…
When I first started to learn how to code, I started writing hello worlds in Python. As many others did too. However, eventually you will want to build something greater and you come across an increase in complexity, system requirements, software dependencies… The list goes on. Or you have that Java project that uses Java 7 but you have others that use Java 8 and you want to keep your…