Security
Security fundamentals, hardening guides, account protection, safe remote access, endpoint recovery, and practical defensive operations.
DNS Privacy vs DNS Filtering: Stop Mixing Up the Jobs
A DNS guide explaining the difference between encrypted DNS, DNSSEC, Protective DNS, malware filtering, parental controls, and resolver bypass.
Moving Beyond SMS MFA: A Household Migration Plan
A household MFA migration plan for moving from SMS codes to authenticator apps, passkeys, security keys, recovery codes, and carrier protections.
Email Is the Root Account: Lock It Down Before Anything Else
Protect the mailbox that receives high-impact account resets and map its actual recovery dependencies. Review hidden access and independent fallback methods without assuming every linked service uses the same recovery model.
What to Do When a Device Hits CISA KEV
When a KEV-listed vulnerability may affect your device, confirm model, build, feature and exposure. Preserve useful evidence, contain applicable risk and follow supported remediation without assuming the device is already compromised.
Edge Device Patch Priority Playbook
A patch-priority playbook for routers, firewalls, VPN gateways, NAS appliances, and other internet-facing edge devices.
Homelab SSO: Authentik vs Authelia vs Pocket ID
A practical homelab SSO comparison covering Authentik, Authelia, Pocket ID, OIDC, SAML, proxy auth, passkeys, MFA, and recovery planning.
Container Security for Normal Homelabs
A normal-person Docker security guide for exposed ports, privileged containers, Docker socket risk, secrets, rootless mode, user namespaces, and backups.
Securing a Self-Hosted AI Server
Keep Ollama's API private, control Open WebUI accounts and tools, protect documents and logs, and test denied access before sharing a self-hosted AI service.
WordPress Core Under Active Exploitation: Verify the Fix and Investigate Possible Compromise
Updating WordPress core is only the first step. Use this checklist to verify versions, checksums, users, cron, uploads, logs, WAF data, and rebuild criteria.
Immich as the De-Google Gateway: Great App, Serious Backup Responsibility
Plan an Immich photo service with protected originals, database backups, controlled access, and isolated restore tests before migrating the family archive; mobile synchronization alone is not a backup.