Mac's Tech Blog

I'd like to thank ngrok for supporting my "art" (weird ranty tech blog posts).

If I'm being honest, I feel like a lot of the technology we use day-to-day isn't super necessary if not actively harmful.

Recently, a ticket came across my desk asking for help with stopping people from using a free GPU service to mine cryptocurrencies.

Recently, I completed a full rewrite of my first personal project, which was a Django project running on Heroku.

As we leave 2024, we're reckoning with both the fever pitch of AI hype and annual average air temperatures blowing past the critical threshold of +1.5 degrees Celsius which was set by the Paris Agreement1.

As someone who has built a career on Kubernetes, I'm always thinking about what "the next platform" is (for job security purposes).

This post will make more sense if you first read Dear Sir, You Have Built a Compiler.

Recently at work I've learned about Cloudflare Tunnels, which has increased my interest in tunneling technologies in general.

If you're reading this blog, there's a high chance that you are one of the 1-in-5 workers who has a non-compete clause hiding in your employment contract.

Lately I've been obsessing over this ProPublica article which talks about Microsoft's involvement in the SolarWinds hacks, specifically due to a design weakness in Microsoft's Active Directory Federation Services (ADFS).

Back in January SourceHut and Codeberg both experienced a distributed denial of service (DDoS) attack.

Last year I left a comment on HN about Docker Compose that seemed to get some traction.

I wanted to write this because I don't hear enough real people discouraging the use of Web Application Firewalls (WAFs).

I recently picked up a few books to read, and Security Chaos Engineering engrossed me so significantly that it 1) made me read the whole thing and 2) made me want to write about it too!

This is a story about how in 2021, I discovered a vulnerability affecting an unnamed billion-dollar company and disclosed it to them, earning my largest bug bounty ever!

Back in 2020, A Russian state-sponsored group got into SolarWinds' build system and inserted command and control (c2) code into a routine software update for a network monitoring tool called Orion (wiki link).

Unlike many other industries like doctors, real estate agents, lawyers, social workers, etc. the tech world doesn't have to abide by any particular code of ethics.

If you didn't hear, CircleCI recently released their report on a December 2022 security incident.

Take a second to think through all the "stuff" you have to personally maintain at your job.

Securing Kubernetes is complex, so there are quite a few guides out there: CIS Benchmarks for Kubernetes (free account login required) NSA/CISA Kubernetes Hardening Guidance Kubernetes Pod Security Standards Various, other, sources Unfortunately, following

In 2016, Kubernetes v1.3 was released which included a new API type: PodSecurityPolicies (PSPs).

It's no secret that Kubernetes Secrets are just base64-encoded strings stored in etcd alongside the rest of the cluster's state.

Since cyber attacks, a building collapse, and an infrastructure bill have been in the headlines recently, I think the time has come for us to re-assess our relationship with maintenance.

To those of you who give advice on which languages, methodologies, architectures, or whatever else to use, I want to start by saying thank you.