One for the Road: Trust, but Verify
Before stepping away, one last day of checking my lab and my plans turned into a lesson I keep relearning: “done” isn’t the same as “verified.
Category Cybersecurity
PHP2Shell: How I Found Out and What I Did About It
A late-night BBC headline about a critical PHP flaw sent me checking my own WordPress site. Here's how I found my PHP version, protected and verified my backups, checked for intruders, and pushed my host for a straight answer, plus what's still open.
Virtual Polymaths: What 50 Physics Problems Reveal About AI Agents
An AI agent solved 49 of 50 unpublished research physics problems for under $3 each. Are these "virtual polymaths"? Half right. Here's what the new TheoPhysEval paper shows they still can't do, and why it matters for security.
Python Basics for Automation — Study Notes
Study notes from Cisco’s CCNA Automation Python livestream — variables, dicts, virtual environments, JSON parsing, the requests library, and API auth, mapped to real security and AWS skills.
AI Is Writing More Code. Who’s Checking It for Security?
AI is writing more code than ever, but Forrester's 2026 survey shows security scanning hasn't kept up. Here's the gap, why attackers love it, and how to close it in your pipeline.
Chasing an MCP Timeout: SQLcl, Swap, and a Server Open to My Network
A yellow "Couldn't start for Cowork and Code sessions" pop-up sent me through a night of log reading. The real culprit was memory pressure, not SQLcl. Along the way I found Unsloth Studio listening on my whole network, and locked it down.
Building a Public Notes Site with Quartz 5 — Phase 3: Deploy, Domain, and Proof on the Live Site
Phase 3 of my Quartz notes site: I deleted six workflows that never ran, wrote a hardened GitHub Pages deploy with pinned actions, verified my domain against subdomain takeover, found a wildcard DNS record, and proved the privacy filter works on the live site.
Setup Changelog: Why My Machine Does What It Does
A running, dated log of changes to my Debian setup: what I changed, why I changed it, and how to undo it. It started after two “mysteries” turned out to be my own forgotten settings.
Building a Public Notes Site with Quartz 5 — Phase 2: Privacy, Proof, and a Clean Commit
Phase 2 of my Quartz notes site: I reviewed every setting, turned on opt-in publishing, proved private notes stay private with a test note and grep, found my email already exposed in old GitHub commits, and pushed a clean first commit — mistakes included.
Building a Public Notes Site with Quartz 5 — Phase 1: Local Build
I'm building a public notes site at notes.ny2honolulu.com with Quartz 5 and Obsidian. Phase 1 covers the local build: a public repo, an opt-in privacy plan, triaging six "high" npm vulnerabilities, and a port conflict — including the mistakes.