Senior Information Security Engineer sharing insights on cybersecurity, AI security, and homelab automation.
npm's own replication database says 4,288,093 packages. The aggregator most supply-chain research runs on says 5,732,659. The gap is retained unpublish tombstones, and sampling from the wrong side moves a headline number by sixteen points.
Formal verification for AI-agent security. You can't prove a probabilistic model does the right thing — but the deterministic gate in front of it is small enough to prove outright. Dafny proofs, a Rego twin, and differential testing, following the method AWS used for Cedar.
Rewriting security controls for probabilistic agents. Static control catalogs assume systems that do what they're told; AI agents don't — so here's how to express agent guardrails (tool allowlists, secret-egress denial, audit) as machine-checkable OSCAL component definitions.
A dataset of 545 terminal color schemes, converted to OKLCH and republished as an npm package — and the theme picker in this site's own header that quietly runs on it.
MicroVMs and namespace sandboxes give AI coding agents mature filesystem and process isolation. Most open-source ones still hand credentials to the agent directly. Here's the proxy-injection pattern that fixes that, and what it doesn't fix.
An MCP server that lets Claude live-code music in Strudel through a real, visible Chromium browser — no mocked audio API. What it does, what broke while I built it, and the engineering that came out of my first real browser-automation project.
svg-terminal is an experiment in how much you can make one self-contained SVG do: type, blink, phone an API for live stats, and survive a renderer that assumes every SVG is hostile. 48 blocks, zero JavaScript, one wry aside about trusting my own config file.
AI is finding bugs faster, researchers pile on the moment one drops, and registries ship malware by the hundred-thousand. Defenders are caught between two contradictory imperatives. The fix is architectural, not temporal.
Extracting benchmarks into a standalone package was the punchline. The setup was a month of governance, skills, security, and pipeline discipline that made the extraction possible in an afternoon.
A static-analysis tool that grades any GitHub repo across security, testing, docs, architecture, devops, and maintenance. The methodology is still WIP, but the findings are consistent: most repos are skipping the basics.
A UEFI-Secure-Boot-preserving rescue USB for any ISO, and the companion QEMU harness that validates it against ~100 hardware personas without physical Frameworks, ThinkPads, or Dells on a lab bench.
I left Windows behind for good. Norrath-Native is an IaC-style toolkit that deploys EverQuest on Ubuntu 24.04 with Wine and DXVK, and a growing exploration into what you can actually do with programmatic window management on Linux.
Most developer sites look like SaaS dashboards. Remarque is the antidote — a design system rooted in book typography, 17px body text, 46rem reading columns, and the OKLCH color space. Self-hosted fonts, AI-native tokens, zero CDN dependencies.
How I built an end-to-end pipeline that converts the United States Code from XML into a Git-versioned, searchable static site with 53,000+ sections and inline case law annotations.
How I used AI-assisted investigation to triage the trivy-action supply chain attack across my homelab repos — and some thoughts on weekend incident response and community notification gaps.
How Handwright turns a scanned worksheet into a custom .ttf font — OpenCV glyph extraction, potrace vectorization, and fonttools assembly. Local-first, no cloud required.
Tsundoku is a static bookshelf for the 3,584 books I own and haven't read — Astro 7, Svelte islands, six primary sources plus a Wikidata backstop, no database. Plus a documentation bug I found while checking my own numbers.
The engineering story behind nexus-agents, a research-backed multi-model orchestration system that coordinates Claude, Gemini, and Codex through consensus voting, adaptive routing, and graph workflows.
How multi-model consensus voting catches blind spots that single models miss. The research behind adversarial roles, Bayesian aggregation, and structured deliberation across Claude, Gemini, and Codex.
How I went from naive round-robin model selection to a five-stage routing pipeline backed by RouteLLM, TOPSIS, and LinUCB research. The failures that led to each improvement.
Learn to build and secure a production-grade private cloud using Proxmox VE. Covers network segmentation, backup strategies, security hardening, and resource management with real homelab implementation lessons.
Eight security layers that stopped real attacks in homelab testing: minimal base images, user namespaces, seccomp profiles, network segmentation, and more. Defense-in-depth without Kubernetes overhead.
Real-world guide to monitoring security events in your homelab. Covers Prometheus configuration, Grafana dashboards, and alerting rules for threat detection.
NodeShield enforces SBOMs at runtime using CBOM policies to prevent supply chain attacks. Homelab Docker deployment guide with attack simulations, 98.3% prevention rate, and <1ms overhead.
Automate security alert analysis using local LLMs (Ollama) for privacy-preserving incident response. Reduce alert fatigue with AI-powered triage without cloud dependencies.
Deploy PromSketch to optimize slow PromQL queries using sketch-based approximation. Homelab benchmarks show 2-100x speedup on percentile queries.
Google's Willow chip achieved the first quantum error correction breakthrough below the critical threshold, proving that adding more qubits can actually reduce errors. This changes the future of computing, cryptography, and AI forever.
Deploy and benchmark Wazuh and Graylog SIEM solutions in your homelab. Performance analysis, resource usage, and integration patterns for security monitoring.
Implement post-quantum cryptography with CRYSTALS-Kyber and Dilithium—prepare homelab for quantum threats using NIST-approved algorithms.
Build privacy-first AI lab with local LLMs—run models up to 34B on RTX 3090 (24GB VRAM) with network isolation, traffic monitoring, and real privacy controls.
Optimize LLM workflows with progressive context loading—achieve 98% token reduction using modular architecture for efficient production deployments.
Deploy Vision-Language-Action models for embodied AI robots—integrate physical world interaction with security considerations for homelab automation.
Build automated security scanning pipelines with Grype, OSV, and Trivy—integrate vulnerability detection into CI/CD workflows with actionable reporting.
Build Proxmox high-availability clusters with shared storage and automated failover—implement live migration for zero-downtime homelab maintenance.
Test IoT security with OWASP IoTGoat—practice firmware extraction, API exploitation, and hardware hacking in secure lab environments.
Prioritize vulnerabilities with EPSS and CISA KEV catalog—move beyond CVSS scores to risk-based patch management using exploitation probability metrics.
Build MITRE ATT&CK threat intelligence dashboard with Python—track adversary tactics and techniques using open-source threat feeds.
Implement zero trust with VLAN segmentation—secure homelab networks using micro-segmentation and layer 3 firewalls for defense in depth.
Migrate to self-hosted Bitwarden—deploy secure vault with backup strategies, SSL certificates, and database encryption for full control.
Deploy Suricata IDS/IPS for real-time network threat detection—configure rule management, performance tuning, and SIEM integration for homelab monitoring.
Harden Docker containers using AppArmor and SELinux for isolation without orchestration overhead. LSM profiles, seccomp filters, and capability dropping at homelab scale.
Understand AI cognitive infrastructure shaping how billions think—explore societal effects of language models transforming from tools to thought systems.
Deploy Claude-Flow AI agent swarms for development—achieve 84.8% SWE-Bench solve rate with neural learning and multi-agent orchestration for complex tasks.
Build MCP standards server for Claude AI—implement Model Context Protocol for intelligent code standards and context-aware workflows.
Transform Claude CLI with standards integration—achieve 90% token reduction and automate workflows using context-aware MCP server architecture.
Build enterprise vulnerability management with open source—deploy scanning, remediation tracking, and compliance using Nessus and OpenVAS.
Deploy DNS-over-HTTPS with Pi-hole and dnscrypt-proxy—encrypt DNS queries for home network privacy and prevent ISP monitoring with DoH implementation.
Implement eBPF security monitoring for real-time kernel visibility—track syscalls and network activity with production-ready patterns for threat detection.
Deploy local LLMs for privacy-first AI—run language models on homelab hardware with model selection, optimization, and deployment strategies.
Fine-tune LLMs on homelab hardware with QLoRA and 4-bit quantization. Train Llama 3 8B models on RTX 3090 with dataset prep and optimization strategies.