One for the Road: Trust, but Verify
Before stepping away, one last day of checking my lab and my plans turned into a lesson I keep relearning: “done” isn’t the same as “verified.
Category Lessons Learned
PHP2Shell: How I Found Out and What I Did About It
A late-night BBC headline about a critical PHP flaw sent me checking my own WordPress site. Here's how I found my PHP version, protected and verified my backups, checked for intruders, and pushed my host for a straight answer, plus what's still open.
My First Mercury 3 API Call: A Key, a Clipboard, and a 401
I finally sent my first request to Inception's Mercury 3 API. Along the way I lost a key, saved a shell command instead of a secret, hit a 401, and learned how to store API keys safely on Linux.
God Is Real Unless Declared INTEGER: From a Fortran Joke to Catching Silent Bugs in Python
"In Fortran, God is real unless declared INTEGER." A late-night programmer joke led me into Fortran's implicit typing, the legendary DO10I bug, and a hands-on Debian lab where Python silently returned 0 instead of 60, and flake8 caught my typo twice.
Two Machines, Two Hidden Gaps: Desktop and Travel Laptop Hardening
Purpose On October 9, 2026, cleaning up an accidental SELinux install turned into a full security check of two machines. The goal was to leave both safer than they started, and to get the travel laptop ready for my Spain…
From SELinux Back to AppArmor: What I Had, What I Have, and Why
I turned on SELinux on my main Debian desktop, sat through a full-disk relabel I thought was formatting my drive, then rolled it back. Here's what SELinux is, what AppArmor is, how they differ, and the disabled AppArmor service I found on the way out.
I Updated One AI Tool and Ended Up Auditing My Whole Lab
A routine Unsloth Studio update printed a launch command ending in -H 0.0.0.0. One port check later, I found Docker containers, an unauthenticated Ollama API and a year-old SQL Server all open to my network. Here's the audit, every command, and why each fix maps to AWS and Black Hat Python.
Lessons Learned: A Browser Test That Found a Live Outage
A one-line test of my new default browser opened my own blog to an Internal Server Error. What followed was a same-day investigation from the terminal: isolating a PHP failure, verifying a changed SSH host key after a silent cloud migration, working with support, and auditing what was left behind after the fix.
Does My Rust Nightly Have the New Trait Solver?
Rust switched on its biggest compiler change in a decade, but only on nightly. Here's how I proved my Debian desktop has the new trait solver, using one tiny program, three builds and zero guesswork.
Planning Post: Is a Vendor Security Conference Worth the Trip from Honolulu?
A sponsored ad led me to vet Zero Trust World 2027: decoding the link, checking legitimacy, pricing the trip from Honolulu, and why I asked questions before committing.