Background on the tools I build, the ones I discover elsewhere, and other things I'm learning.
I replaced a notification-only dependency scan with a Forgejo Actions pipeline that builds a Syft SBOM, scans it with Grype, asks Poetry to update only vulnerable packages with known fixes, proves the fix with a second scan, and opens or updates a pull request for review.
Read moreUse Qubes OS device assignments to automatically attach a YubiKey to your vault qube for GPG use, avoiding the need to manually reattach it every time you plug it in.
Read moreBouquin is a Python/Qt notebook that treats each day as a page, encrypts everything with SQLCipher, versions every change, and - unusually for a notepad - can track time and invoice for it. Features are modular and toggleable.
Read moreA technical walkthrough of publishing a directory of files to IPFS via its HTTP API from Python: content-derived CIDs, the multipart form-data trick that makes go-ipfs treat separate uploads as one folder, and using IPNS to keep a stable pointer at the latest version.
Read moreAn archived 2016 field note on sysadmin communication: proactive status updates, incident reports, plans, rollback plans, and why silence damages trust.
Read moreAn archived 2016 field note on high availability: failure domains, quorum, STONITH/fencing, service tiers, disaster recovery, and when HA creates more risk than it removes.
Read moreAn archived 2016 field note on troubleshooting Linux systems: pattern recognition, avoiding premature fixes, gathering evidence, and keeping a reusable trouble log.
Read moreAn archived 2016 field note on production monitoring: service health, infrastructure metrics, security signals, logs, and the difference between seeing symptoms and understanding a failure.
Read moreAn archived 2016 field note on infrastructure security: risk management, patching, intrusion detection, ISO 27001, PCI-DSS, and common operational security pitfalls.
Read moreAn archived 2016 field note on Linux configuration management: known state, version-controlled infrastructure, repeatability, recovery, and why snowflake servers become expensive.
Read moreAn archived 2016 field note on continuous deployment: how automating production changes can reduce risk, improve feedback, and make releases routine rather than frightening.
Read moreA howto for qvm-start-deps: a dom0 script that recursively starts a qube's declared dependencies (Split SSH vaults, service qubes, custom cross-qube relationships) before the target, using qvm-features as dependency tags.
Read more