17posts
WhatsApp, Telegram, Signal and SimpleX compared in plain language for beginners: what each encrypts, what metadata leaks, the pros and cons of each, and which messenger to pick for everyday chats versus the conversations that matter.
A developer security comparison of npm vs JSR vs npmx (which is a package browser, not a registry), the real alternative registries beyond both, what each registry model changes for supply chain attacks and attack surface, the attacks actually used in 2025 and 2026, and the layered defenses that hold up against them.
mTLS authenticates both sides of an internal connection, which closes a real hole on a LAN full of devices, and it does not fix application bugs, stop a compromised service, or survive root on the host. A hands-on look at the threat model, client certificates with Caddy and Nginx, service mesh identity, and the mobile apps that cannot present a certificate.
A sysadmin-grade walkthrough of what actually happens on the wire with passkeys and WebAuthn: the registration and authentication ceremonies, discoverable credentials, what sync really costs you, hardware keys, phishing resistance and its limits, recovery planning, FIDO2 SSH keys, and the honest list of where passkeys do not apply.
When Cloudflare fronts your origin, CrowdSec only sees what your reverse proxy writes into the log: edge IPs unless trusted proxies are configured. A hands-on guide to CF-Connecting-IP, X-Forwarded-For spoofing, firewall-level versus app-level blocking, and the CrowdSec Cloudflare bouncer that moves the block to the edge.
SOPS plus age is the git-native way to keep secrets out of plaintext commits: age key setup, .sops.yaml creation rules, the daily encrypt and decrypt workflow, GitOps integration with Flux and Argo CD, key rotation, a recovery strategy that survives a lost laptop, and the honest limits of the pattern.
Docker secrets are a delivery mechanism, not a vault. On a single server they do not encrypt anything. A hands-on comparison of .env, Docker secrets, systemd credentials, SOPS + age, Vault, and Kubernetes Secrets, with the commands and the honest decision rule for each.
A hands-on sysadmin guide to Naxsi, the Nginx Anti XSS and SQL Injection WAF module: how the scoring, deny-by-default model works, building and installing the maintained wargio fork on Debian, Ubuntu, and Fedora, learning mode and nxtool whitelists, what WordPress, Joomla, and Magento need to avoid false positives, the honest limits, and when ModSecurity is the better call.
A sysadmin's field guide to VPNs: what a VPN actually does to your traffic, the threat models it does and does not answer, how no-logs claims and audits really work, which providers pass the test, and a deep technical comparison of OpenVPN, WireGuard, and the proprietary protocols (NordLynx, Lightway, Catapult Hydra, Chameleon), plus a hands-on self-hosted WireGuard setup.
A hands-on sysadmin guide to AIDE for file integrity baselines and inotify-tools for real-time filesystem event monitoring: what each tool actually does, install and configuration on Debian, Ubuntu, and RHEL, scheduling the daily check, inotifywait and inotifywatch recipes, the limits that bite, and how the two complement each other.
SMS two-factor authentication was a real upgrade, but SIM swapping, SS7 interception, and real-time phishing have turned the code into a second password an attacker can read. Why it now gives a false sense of security, and what to use instead: TOTP apps, passkeys, hardware keys, and printed recovery codes.
A sysadmin's hands-on walkthrough of a scratch-based, rootless Docker image for the SimpleX Chat CLI. Since the chat server binds 127.0.0.1 only (issue #6449 is still open), a small socat bridge exposes it on 0.0.0.0. Full multi-stage Dockerfile, build and run commands, and the honest trade-offs.
SimpleX Chat is the first messenger with no user identifiers at all: no phone number, no username, no account. Here is what that changes for day-to-day users, how you actually connect with people, and how it compares to WhatsApp and Telegram on privacy and metadata.
npm vs pnpm in 2026: official benchmark data including the Rust-based pnpm 12, workspace workflows, and the supply chain case for switching, from blocked build scripts and minimum release age to git hooks and editor tooling.
A sysadmin-grade guide to Docker Sandboxes for AI agents: microVM isolation layers, credential injection that keeps API keys out of the sandbox, sbx secret management, the MCP gateway, and what is not isolated by default.
A sysadmin-grade comparison of Docker Compose and Kubernetes for running many self-hosted apps: where Compose starts to hurt, how k3s changes the calculus, and how rootful Kubernetes is actually secured with RBAC, admission control, securityContext, seccomp, and network policies, and how that differs from rootful Docker.
A practical, sysadmin-grade comparison of Docker and Podman for running many self-hosted apps: Compose vs Quadlet, rootful vs rootless security and host-tool debugging, Watchtower vs podman auto-update, Docker API compatibility, and when Kubernetes is the real answer.