#security
27 posts
2026 - August
7 posts- Survival Guide for a Censored Internet
- Understanding Anthropic's AI Watermark: How to Beat It
- What the Google Quantum Vulnerability Paper Means
- Understanding the Brazilian Censorship of Discord and the Digital ECA Law
- Digital David and Goliath: Understanding MegaLag vs Honey/PayPal
- Why a Perfect Digital Election Still Wouldn't Be Viable?
- Exploiting Coinkite's RNG Egregious Problem
2026 - July
4 posts2026 - June
1 post2026 - April
2 posts2026 - March
4 posts2026 - February
2 posts2026 - January
1 post2025 - September
3 posts2016 - December
1 post2016 - October
1 post2014 - March
1 post2026 - August
7 postsSurvival Guide for a Censored Internet
From the X block to a sentence enhancement for using a VPN: Brazil is rehearsing real censorship. A three-phase guide (commercial VPN, step-by-step self-hosted VPN, and obfuscated protocols) to keep your communications alive while it is still possible.
Understanding Anthropic's AI Watermark: How to Beat It
Claude now stamps everything it writes with an invisible statistical watermark, a requirement of European AI law. How it works, what the AI Act demands, and the rewrite in another LLM that wipes the signal.
What the Google Quantum Vulnerability Paper Means
Google, the Ethereum Foundation, and Stanford estimate breaking secp256k1 with under 500,000 qubits. I compare GLM, Kimi, and ChatGPT, calibrate the real odds of theft in the coming years, and what you can do today.
Understanding the Brazilian Censorship of Discord and the Digital ECA Law
Brazil's data protection authority ordered Discord to kill Go Live in the country because encryption prevents moderation. I break down the Naviraí case, the Felca Law, the clash with the LGPD, the new VPN sentence enhancer, and the dangerous precedent it all sets.
Digital David and Goliath: Understanding MegaLag vs Honey/PayPal
Honey spent years skimming creators' commissions with a defeat device written in plain JSON. I walk through the ssd.json line by line, the PayPal-era rewrite, and the class action PayPal failed to kill.
Why a Perfect Digital Election Still Wouldn't Be Viable?
A computer science exercise: how to build a digital election with end-to-end verifiability using commitments, Merkle trees, and zero-knowledge proofs, and why even that 'perfect' system still would not be viable in practice.
Exploiting Coinkite's RNG Egregious Problem
How an attacker enumerates the ColdCard's reduced key space, finds vulnerable wallets on the public blockchain, and moves the funds. Real data from the ongoing theft and step-by-step didactic code.
2026 - July
4 postsURGENT - If You Keep Bitcoin on a ColdCard: MOVE EVERYTHING
An entropy flaw left seeds generated by ColdCard firmware far below the promised security level, with estimated losses above 1,000 BTC. Understand the bug and migrate without repeating the mistake.
AI-Jail: Security Update, Docker Goes Opt-In
Issue #88 proved the Docker socket inside ai-jail gave any agent root on the host. In v1.16.0 the passthrough went opt-in. The flaw, a hands-on demo, best practices, and why Podman was born from this criticism.
How Do I Protect Myself From My Agents Deleting My Stuff?
LLMs deleting files from famous people made headlines this week. In five months of heavy use, in YOLO mode, it never happened to me. But I don't trust them either: BTRFS snapshots, restic backups, sandboxing and discipline.
I Had Fable 5 Analyze the Code of TikTok, Clash of Kings and Gov.br - Understanding Fingerprinting
A static analysis with Fable 5 compares TikTok’s opaque fingerprint, Clash of Kings’ persistent UUID, and gov.br’s privacy precautions, with caveats about the method.
2026 - June
1 postBypassing the GitHub API Block in Brazil
I tested GitHub’s API block in Brazil: changing DNS didn’t fix it on my connection, but a SOCKS5h wrapper with Tor made gh and ghpending work. It’s a workaround for an opaque block.
2026 - April
2 postsSeedance 2.0 Is Finally Out: First Impressions
ByteDance opened Seedance 2.0 to the public today after months of restricted access. I tested audio-driven lip sync with my anime avatar, and a Blender render fed in as a video reference. There's real work you can do here, but it's nowhere near professional production yet. Also: deepfakes just stopped being hypothetical.
Bitcoin on the Home Server: Sovereignty and Privacy with Coldcard, Sparrow and Fulcrum
I built a home Bitcoin stack with Coldcard, Sparrow, Fulcrum, and bitcoind: offline keys, private queries, and my own broadcast. It takes work, but gives me more control over custody and operations.
2026 - March
4 postsClaude Code's Source Code Leaked. Here's What We Found Inside.
I analyzed Claude Code’s leaked source map and found hidden features, layered memory, multi-agents, and DRM based on xxHash64. The code also exposed a product that’s difficult to maintain.
Migrating my Home Server with Claude Code | openSUSE MicroOS
I migrated 49 containers from Ubuntu to openSUSE MicroOS with Claude Code’s help, reorganizing Docker, NFS, ROCm, backups, and SELinux. Automation sped things up, but architecture and validation stayed human.
Going After Email Fraud | Frank FBI
I built Frank FBI to analyze forwarded emails in six layers, combining authentication, reputation, OSINT, and three LLMs. The result is a self-hosted risk report, with the data under your control.
ai-jail: Sandbox for AI Agents — From Shell Script to Real Tool
ai-jail is a Rust tool that wraps bubblewrap (Linux) and sandbox-exec (macOS) to safely run AI coding agents like Claude Code, Codex, OpenCode and Crush in a sandbox.
2026 - February
2 postsVibe Code: I Built a Mega Clone in Rails in 1 Day for My Home Server
Building FrankMega, a self-hosted Mega.nz clone in Rails 8, in a single day with Claude Code, and why experience still matters in vibe coding.
Sending Emails Without Getting Flagged as Spam | Behind The M.Akita Chronicles
How to build a reliable newsletter sending pipeline on Amazon SES, covering atomic claiming, terminal states, DKIM/SPF/DMARC, List-Unsubscribe and the silent SES suppression list.
2026 - January
1 postAI Agents: Locking Down Your System
I show how to isolate coding agents with Bubblewrap: the jail leaves only the project writable, hides the rest of the system, and mounts only what is needed, reducing the risk of destructive commands.
2025 - September
3 postsOmarchy 2.0 - Bitwarden Self-Hosted / VaultWarden
Self-hosting a Bitwarden-compatible password manager with VaultWarden on a home server, routed through a Cloudflare tunnel, with 2FA via Aegis.
Protecting Your Home Server with Cloudflare Zero Trust
How I added a Cloudflare Zero Trust login layer on top of my home server services, using Google OAuth as the identity provider.
Omarchy 2.0 - Understanding SSH and Yubikeys
A practical guide to SSH keys, Yubikey 5 hardware-backed keys, and ssh-agent on Arch Linux and Omarchy.
2016 - December
1 postCoherence and ExAdmin - Devise and ActiveAdmin for Phoenix
Coherence and ExAdmin bring Phoenix closer to Devise and ActiveAdmin, while a simple Plug adds authorization for the admin area. They ease the start, but do not remove OTP and distributed-systems’ learning curve.
2016 - October
1 post[Discussion] Can we protect our work from DNS providers suffering DDoS attacks?
To test a defense against future DNS outages, the author configures Unbound as a local recursive resolver and extends the cache to 172,800 seconds, while admitting the experimental solution violates TTLs.
2014 - March
1 post[Off-Topic] Commenting on the Approved Marco Civil
Commenting on the approved Marco Civil text, the author considers network neutrality valid but criticizes costs, regulatory agencies, and mechanisms that would expand state access to private data.