I told you so.

Observations, predictions, and experiments that probably should have stayed in the lab. Dated and fingerprinted on filing. I keep the receipts so nobody can say they didn't see it coming.

On the record

  1. simple.remind.rsvp, or the name on the back of the card 8e67a2d6

    A guest shows up who never confirmed their email. The host can now photograph the barcode on their driver's license, and the phone puts the name on it next to the name on the RSVP. Nothing is saved, and the page isn't allowed to send anything.

  2. simple.remind.rsvp, or the code you stick on the fridge 33ba2b8f

    Same day, same block party. An admin view nobody on the internet can reach, a sign-in loop that was the browser being right, and an eight-character code that gets a host back in.

  3. simple.remind.rsvp, or the casserole without the machinery af374fb0

    Six questions, one link, no account. A two-thousand-line Go program that tries very hard not to break.

  4. remind.rsvp, or a lot of machinery for a casserole bd37abf1

    Saying yes to a seed swap takes no account. Behind it are four cities, one mesh, and a chat network.

  5. muster, from the shell to the browser 7fbaf6b7

    A week after the first rollout: DNS from the directory, single sign-on with passkeys, a page for first passwords, device enrollment, and the seams that only real clients find.

  6. muster, built: the parts, the build, and what it can do 49bedd52

    The thirteen crates and three toolchains behind a small Linux fleet's directory, how to build and freeze a release from a clean checkout, and what the fleet can do with it now that host policy covers the Ubuntu STIG and CIS Level 1.

  7. muster in practice: Active Directory lite, from the directory up 49712f02

    How a small Linux fleet gets one directory, Kerberos logins, trustworthy security logs, a rendered WireGuard mesh, typed host policy and SSH host certificates, and what a real rollout taught.

  8. muster: Active Directory lite for a small Linux fleet e40be44a

    One directory, Kerberos, and a small agent per host: identity, access, security logging and host policy for a handful of Linux servers.

  9. Restore drills 1e99022f

    Backing up two servers so they can be rebuilt, and what rebuilding them found.

  10. Changing the record 1bb26863

    Why start this blog over.

Archive

Two earlier volumes, frozen as they were published with their own designs, and a companion site that runs on its own.

  1. 2010 to 2018 Volume 1 15 entries

    Conference talks on security, risk, and threat intelligence, each with the deck as delivered.

  2. 2022 to 2025 Volume 2 11 entries

    Essays, systems tooling, and fiction. Includes the notes on the unikernel that served this site.

  3. 2026 onward Adversarial Agents separate site

    Autonomous offense and autonomous defense: what changes in an engagement when both sides are agents.