Tag: security

Zero-trust access for SSH, k8s, and databases, HashiCorp Boundary vs Teleport compared on identity, session recording, and self-host fit.

TLS tunneling for legacy plaintext services, stunnel's X.509 cert model vs spiped's pre-shared key simplicity, and when each one actually wins.

Containers are not VMs. Here are the real escape vectors, privileged mode, mounted sockets, kernel CVEs, and the runtime hardening that actually helps.

Cosign keyless signing uses GitHub OIDC + Fulcio + Rekor to sign container images without managing private keys. Here's how it actually works and why you want it.

age replaces GPG for file encryption with a sane CLI, SSH key reuse, and zero key management drama. Here's how they compare and exactly when each one wins.

Containers aren't security boundaries, Sysbox, gVisor, and Kata fix that. Here's which isolation runtime fits your actual threat model.

Trivy, Grype, and Docker Scout go head-to-head on speed, CVE coverage, CI integration, and cost. Pick the right scanner for your home lab or pipeline.

Akismet's licensing terms are increasingly hostile to small sites. Here are 11 spam-protection options, hosted APIs, CAPTCHA widgets, and DIY honeypots, that actually work in 2026.

Ran 9 real headless tools against an echo server. Sec-Fetch alone catches almost none of them. Here's what actually leaks, WAF rules that work, and where Anubis fits in.

CrowdSec is fail2ban with community threat intel: scenario collections plus pluggable bouncers for Caddy or Traefik. Block millions of bad IPs from day one.

Distroless containers are tiny, secure, and loved by security teams, until you need to debug one at 2 AM. Here's when Google distroless actually pays off vs when it's just container hipster points.

You've been compromised. Now what? A practical incident response playbook for self-hosters who didn't think they'd need one until right now.