Publications
Research
What we measure while building and running our own platform. Two formats: research carrying its own evidence, and field notes from day-to-day operations. Every post states which one it is.
Our failover had never worked, and every dashboard was green
A VRRP pair that never moved its floating IP for two months, and the two other controls we found lying the same day.
CIS and Docker contradict each other, so decide in writing
CIS says disable IP forwarding. Docker depends on it. Applying the control breaks the platform; skipping it quietly makes the compliance report lie.
fail2ban locked us out of the whole estate, and it was right
An SSH agent holding several keys exhausts MaxAuthTries before offering the right one. Run in parallel, every node bans you at the same moment.
Our NAT gateway triggered a port scan alert in our own SOC
Docker quietly takes ownership of the FORWARD chain. After a reboot, our private nodes produced a slow port scan alert that was entirely correct.
Escaping is not enough: the second decode inside an onclick
A correctly escaped value becomes executable again inside an onclick attribute. Three defects found in our back office, and why the CSP hid one of them.
We audited our own website the way we audit a client's
Four findings on cyberaar.io, including TLS 1.0 still accepted at the edge and a playbook that reported success while doing nothing. Commands included.
No post matches. Try another term, or show everything.