Creating and Managing SSH Keys with 1Password

A walkthrough of creating and managing SSH keys with 1Password 8, all the way through git clone.

15 Checks Non-Developers Should Keep in Mind Before Shipping AI-Written Code to Production

AI coding tools produce working code at astonishing speed. Working, however, is not the same as production-grade. Here are fifteen concrete things to look at before you ship what your AI wrote.

Three benefits of implementing Always SSL (HTTPS) ~ Security, SEO, and reducing user distrust

Why sites should go HTTPS everywhere, summarized as three benefits: security, SEO, and reducing user distrust.

How to Configure Amazon S3 to Allow Uploads of Only Specific File Types (Extensions)

Restricting S3 uploads by file extension — and the extension-spoofing limitation of the approach.

Amazon WorkSpaces Personal on Simple AD at small scale — setup, cost, and scaling paths

I set up a single-purpose Windows desktop on Amazon WorkSpaces Personal with Simple AD, for a small team that needs a browser and client certificates for a specific line of business. As of July 30, 2026, Simple AD is closed to new customers, and existing customers keep full functionality. This post covers the minimum setup, Tokyo-region monthly costs, what Simple AD gets you and where it falls short, the trade-offs of AWS Managed Microsoft AD and AD Connector, and the limits of WorkSpaces backup and restore, with citations to AWS official documentation.

[Apache] Basic Authentication Settings for Passenger

Adding Basic auth to an Apache + Passenger VirtualHost with htpasswd.

[Apache] How to Set Up an SSL Environment

Minimal steps for setting up an Apache SSL VirtualHost with a certificate and key.

[Apple] Enable Two-factor Authentication

Enabling two-factor authentication on a corporate master Apple ID, and how the Recovery Key is handled.

Summary of Articles Referenced When Considering Auth0 Adoption

A curated link list of articles I referenced when evaluating Auth0 for adoption, grouped by topic.

About Auth0 Change Password API Specifications

Notes on Auth0's Change Password API — Gmail alias handling and identical responses for success and failure.

How to Change Auth0 Login Session Expiration Time

How to change Auth0 login session expiration — the defaults for Inactivity timeout and Require log in after, and where to change them.

Reference Information for Implementing Authentication and Authorization with Auth0 + NestJS

Reference links I read when implementing authentication and authorization with Auth0 and NestJS.

The Difference Between Authentication and Authorization

A quick memo on an ITmedia article and diagram that clearly explain authentication vs. authorization.

For 2FA apps, 'Authy' is more recommended than 'Google Authenticator'

Why I switched my 2FA app from Google Authenticator to Authy for PC support and backup-based recovery.

Password Auto-Generation Tool 'Automated Password Generator' is Convenient!

'Automated Password Generator', a web tool that generates passwords by character type, length, and strength.

Restricting AWS ALB Access to CloudFront Only

Reference articles for restricting AWS ALB access to CloudFront-only traffic, with HTTPS pattern notes.

Letting AI Agents Use the AWS CLI Safely — A 2026 Defense-in-Depth Design That Disarms Any Single Credential

Hand an AI agent a shell and AWS credentials at the same time, and a single prompt injection can translate straight into deleted cloud resources or exfiltrated secrets. IAM Identity Center plus ReadOnlyAccess is the right starting direction. But ReadOnlyAccess is not 'read-only equals safe,' and tool-side deny rules do not survive adversarial evasion. Working from the premise that the only trustworthy enforcement boundaries are IAM and OS sandboxes, we layer defenses across authentication, authorization, execution, approval, and audit so that seizing a repository or a shell alone never reaches production.

How to Configure AWS Default Security Group to Not Allow All Traffic (CIS 4.3 Compliance)

Stripping all rules from AWS default security groups across every Region to comply with CIS 4.3.

How to Create Access Keys for AWS IAM PowerUser

Two approaches to letting an AWS IAM PowerUser create AWS CLI access keys.

AWS Lambda Sample Code to Delete Specific Files Uploaded to S3

A sample AWS Lambda function that deletes S3 objects whose ContentType is text/html.

Password Reset Required for First Root Account Login After Creating New Account in AWS Organizations

How to perform the initial root login on a new AWS Organizations member account by resetting the initial password.

Letting AI Agents Use the Azure CLI Safely — A Defense-in-Depth Design with Managed Identity, a Command Broker, and Resource Locks

Hand an AI agent a shell and Azure credentials at the same time, and a single prompt injection can turn into a stray az command that deletes resources or exfiltrates secrets. Short-lived credentials and least privilege, as Microsoft recommends, is the right direction. But a service principal's client secret is highly persistent once leaked, and tool-side deny rules do not survive adversarial evasion. Working from the premise that the only trustworthy enforcement boundaries are RBAC, organization policy, and OS sandboxes, we layer defenses across authentication, authorization, execution, approval, and audit so that seizing a single input never reaches production.

Project Management Tool Backlog Plan Comparison

Comparing Backlog plans around required 2FA and access logs, and why I picked Premium.

[Beego] How to Configure XSRF filtering

Enabling XSRF filtering in Beego globally, and turning it off per controller when needed.

Detecting Unknown Subdomains with Certificate Transparency — A Practical Introduction Using Cert Spotter

A practical guide to detecting new subdomains and SSL/TLS certificates issued under a root domain you own, from the outside. It walks through Certificate Transparency (CT) log fundamentals, subdomain discovery and continuous monitoring with the Cert Spotter API and crt.sh, the blind spots created by wildcard certificates and wildcard DNS, and a recommended layered setup that combines CT with Passive DNS.

Replacing Checkmarx with Open Source — Designing an AppSec Stack from SAST, SCA, IaC, and Secrets

No single open-source tool replaces Checkmarx one to one. The realistic answer is a loosely coupled multi-engine setup: place a dedicated OSS scanner in each functional category and bind them with a management layer like DefectDojo. This article walks through the Semgrep CE versus Opengrep split in SAST, Trivy-centered SCA, Checkov and KICS for IaC, Gitleaks and TruffleHog for secrets, and DefectDojo's deduplication and Jira sync, as of 2026, along with the limits such as legacy languages and supply-chain risk.

Detecting Terraform Vulnerabilities with Checkov: An Insecure vs Secure Comparison Demo

IaC security should be verified before you apply. Checkov lets you detect Terraform vulnerabilities through static analysis. Using five AWS resources (S3, Security Group, RDS, IAM, CloudTrail), this demo reproduces the journey from 37 FAILEDs to 111 PASSEDs in a public repository.

Solution for Google's 'Malicious apps may be installed on your device and used to access your account'

Recovering Chrome login after Google's 'malicious apps' warning by removing bad extensions and resetting browser settings.

[ClamAV] WARNING: Clamd was NOT notified: Can't connect to clamd through /var/run/clamav/clamd.sock

Silence freshclam's clamd.sock warning by commenting out NotifyClamd in freshclam.conf when clamd is not running.

How to Get Audit Logs on Claude Team Plan Without Upgrading to Enterprise

Claude Team plan lacks audit log functionality. Rather than upgrading to Enterprise, you can build equivalent visibility by combining API gateways, browser monitoring, and CASB/DLP controls. This post covers specific tool choices and configuration examples for each layer.

Enabled DNSSEC on Cloudflare

Enabling DNSSEC for codenote.net on Cloudflare, plus a DNSSEC reading list and how to verify with dnsviz.net.

Set Up reCAPTCHA v3 in Contact Form 7 to Prevent Spam Inquiries

Wire up reCAPTCHA v3 to WordPress Contact Form 7 to block spam submissions.

[SSH] How to Create a Private Key for Poderosa from a Putty Private Key

A note on using PuTTYgen's Export ssh.com key to convert a Putty .ppk private key into a Poderosa .sshcom private key.

Recommended Articles for Understanding Cookies and Sessions

Recommended reading list for beginner web engineers to understand Cookies, Sessions, and IPA's session countermeasures series.

[JavaScript] "cryptico.js" Library for RSA Public Key Encryption/Decryption

A note on cryptico.js, a JavaScript library for RSA public-key encryption and decryption.

How to specify TLS version with cURL

How to probe TLS 1.0 / 1.1 / 1.2 support individually using cURL's --tlsv1.x options.

How to Get Audit Logs on Cursor Teams Without Upgrading to Enterprise

Cursor Teams plan lacks audit log functionality, and even Enterprise audit logs only record management events, not prompt content or generated code. This post covers how to build audit trails using Cursor Hooks as the primary mechanism, supplemented by API gateways and SSO logs.

Comparing Open-Source DAST Tools — Binding ZAP, Nuclei, Wapiti, and Nikto into a DevSecOps Pipeline

DAST (dynamic application security testing) hits a running app from the outside with simulated attacks to surface runtime-specific vulnerabilities that SAST and SCA miss. Open-source DAST has moved from 'one tool does everything' to 'divide the work among lightweight tools.' Centered on the all-around ZAP, template-driven Nuclei, lightweight-CLI Wapiti, and server-exposure-focused Nikto, this article adds the SQLi specialist sqlmap and the XSS specialist Dalfox, plus the free-but-not-OSS Dastardly and StackHawk, and lays out 2026 selection criteria alongside SPA/API coverage, phased CI/CD integration, and false-positive tuning.

Digital Content (PDF, Images, ZIP) Redistribution Prevention Strategies

Notes on preventing redistribution of PDF, image, and zip content sold on an EC site.

How to Disable Password Manager Auto-save and Auto-fill for input type="password"

Password managers like 1Password and LastPass are very convenient, but there are situations where developers want to control auto-fill and save suggestions. This article explains HTML attributes to disable those features for specific input fields.

SSL/TLS 1.0 Must Be Disabled by June 30, 2018

A short reminder that SSL/TLS 1.0 must be disabled by June 30, 2018.

List of disposable email address domains

References for building a disposable email domain blacklist to block throwaway sign-ups.

Comparing Encrypted SQLite Libraries for Electron — Why better-sqlite3-multiple-ciphers Is the Default Pick

A practical comparison of encrypted SQLite libraries for Electron desktop apps that need Data at Rest protection. It walks through better-sqlite3-multiple-ciphers, @journeyapps/sqlcipher, @signalapp/sqlcipher, SQLite SEE, and Realm across cipher choice, N-API prebuilds, licensing, and macOS signing / notarization, and explains why better-sqlite3-multiple-ciphers is the default recommendation.

Prototyping Electron encrypted SQLite libraries — running better-sqlite3-multiple-ciphers and @journeyapps/sqlcipher on macOS and Windows

I turned the desk-based comparison from the previous post into working Electron Todo recipes and ran them on both macOS and Windows. better-sqlite3-multiple-ciphers dropped in on both operating systems with only its N-API prebuilds, while @journeyapps/sqlcipher 6.0.0 built on macOS but officially dropped Windows and only comes back with a vcpkg-based OpenSSL workaround. This post walks through the three recipes and four pull requests in app-distribution-recipes and summarizes what the measurements confirmed.

Email Delivery Systems: Set up SPF and DKIM Without Fail

Why SPF and DKIM are must-configure for email delivery systems, with setup docs for Amazon SES, SendGrid, G Suite, and Zendesk.

Email Configuration Check Services ~ SPF, IP Reputation

Post-setup email checks: MxToolBox for SPF and Cisco Talos for IP reputation after configuring AWS SES.

Real Engineer Horror Stories ~ HTTP Status Code 0 and curl: (35) SSL connect error

Two engineer horror stories: HTTP Status Code 0 and curl: (35) SSL connect error.

[Facebook] Upgrade Your App to OAuth 2.0 and HTTPS by October 1st

The Facebook email announcing that OAuth 2.0 and HTTPS became mandatory for all apps from October 1, 2011.

Facebook App SSL Authentication Becomes Mandatory from October 1, 2011

SSL becomes mandatory for Facebook apps and iframe Page tabs from October 1, 2011 — a summary with links.

[Facebook App] JavaScript SDK Must Always Be Used with https

Why you should always load the Facebook JavaScript SDK over https to avoid mixed-content issues, especially in IE.

[Facebook] Offline Access Permission to be Completely Discontinued on May 1, 2012

A note on Facebook's plan to fully retire the offline_access permission on May 1, 2012, and what it means for users and developers.

How to Set Up Basic Authentication with Firebase Hosting

Set up Basic Authentication for Firebase Hosting by pairing it with Cloud Functions.

Summary of Sites Where SSL Certificates Are Available for Free or at Low Cost

A 2012-era note on cheap and free SSL certificate options — RapidSSL for 1,080 yen and StartSSL free for one year.

G Suite Administrator Post-Implementation Configuration Checklist

A post-deployment G Suite admin checklist — security, end-user access, Drive sharing, and email hardening.

[G Suite] Settings and Rules for Sharing Google Drive with External Organizations and Personal Gmail Accounts

Operating rules and steps for sharing G Suite Google Drive with external orgs and personal Gmail accounts.

[G Suite] Internal Operating Rules for Google Calendar

Internal Google Calendar rules in G Suite: personal-to-company import OK, company-to-personal export NG.

[G Suite] How to Configure Mandatory Two-Factor Authentication

Reference links, my configuration, and an announcement email template for enforcing 2FA in G Suite.

[G Suite] Super admins cannot check the owner of Google documents that aren't shared

G Suite super admins cannot see the owner of Private-scoped Google Docs — support's answer explained.

[G Suite] Whitelisted Domains and Google Drive Sharing Settings

How to whitelist an external domain in G Suite so it can be added to a shared drive.

Letting AI Agents Use the Google Cloud CLI Safely — Drop the Keys, Lock It Down with Impersonation and a Command Broker

Hand an AI agent a shell and Google Cloud credentials at the same time, and a single prompt injection can turn into a misfired gcloud command that escalates privileges or exfiltrates data. Short-lived credentials and least privilege, which is Google's official guidance, are the right direction. But service account keys persist dangerously when leaked, and tool-side deny rules do not survive adversarial evasion. Working from the premise that the only trustworthy enforcement boundaries are IAM, organization policy, and OS sandboxes, we layer defenses across authentication, authorization, execution, approval, and audit so that seizing a single input never reaches production.

Why the Gemini CLI Security Extension Impressed Me

I tried the Gemini CLI Security extension and it turned out to be impressively capable. While I've been using Claude Code and Codex with their defaults, I now want to actively leverage Gemini CLI extensions as well.

gh-security-scan: An AI Coding Assistant Skill for Cross-Organization Supply Chain Attack Investigation

Supply chain attacks like the axios npm account takeover are becoming more frequent. Investigating their impact across an entire organization is time-consuming manual work. We built gh-security-scan, an AI coding assistant skill that automates cross-organization security investigation. It supports Claude Code, Codex, and Gemini CLI.

[Git] Solution for fatal: unable to access: SSL certificate problem: Invalid certificate chain

A quick workaround for the Invalid certificate chain error by toggling `http.sslVerify`.

Using IAM Roles in GitHub Actions Without Passing AWS Credentials Directly

A reference article on assuming AWS IAM Roles from GitHub Actions without long-lived credentials.

[Google] How to Set Up 2-Step Verification Google Authenticator on Multiple Devices

How to set up Google Authenticator across multiple devices, with links to 2SV settings for related services.

Granting Google Cloud Access by Team — Access Groups and Folders as Two Axes

"Folders or group addresses?" is a false choice. Folders scope permissions, groups identify principals, and the right design uses both axes together.

Google Data Studio Cannot Share Groups Containing @gmail.com When 'Restrict Sharing Outside Trusted Domains' is Enabled, Even with 'Share with Specific Users or Groups'

Verifying that trusted-domain restrictions block @gmail.com members even when shared via a Google Group.

[Google Workspace] Restricting document sharing settings to within the organization

Notes on restricting Google Drive sharing to the organization, and how it affects existing external shares.

Investigation Summary for Utilizing G Suite Audit Logs

Notes on G Suite audit log capabilities, retention, and downloading logs via the Reports API.

[G Suite] Administrator setting to disable Gmail automatic email forwarding

Notes on using G Suite admin settings to disable Gmail auto-forwarding as a data-leak prevention measure.

[G Suite] About Default Settings for Group Permissions

Q&A from Google support on G Suite group default permissions, admin forum access, and archive settings.

How to Completely Erase macOS Disk

Standard macOS clean install plus a full-wipe path using diskutil secureErase from a bootable installer.

Email and Slack message templates for announcing 2FA activation to your company

Email and Slack message templates for asking coworkers to turn on 2FA, with Google and Slack help links.

Joined the Japan Hacker Association

Prompted by the mozaic.fm Engineering Risk episode, I joined the Japan Hacker Association for free.

[Javascript] HTML Escaping htmlspecialchars

Sample JavaScript code that mirrors PHP's htmlspecialchars for escaping HTML-special characters.

.jp .co.jp Domain Registration and Management Service Comparison Survey Report

Comparing .jp and .co.jp registrars for corporate use, filtering on two-factor authentication and Whois privacy.

About JSONP Security

A memo on JSONP cross-domain security concerns with reference links.

How to Auto-Renew Let's Encrypt SSL Certificates with certbot and crontab

Setting up monthly auto-renewal of Let's Encrypt certificates with certbot and crontab.

Manually Renewing Let's Encrypt SSL [CentOS + Nginx Edition]

Manually renewing a Let's Encrypt SSL certificate on CentOS + Nginx with certbot-auto.

Setting up SSL with Let's Encrypt [CentOS + Nginx Edition]

Setting up a Let's Encrypt SSL certificate on CentOS + Nginx with certbot-auto.

[Let's Encrypt] How to resolve 'Client with the currently selected authenticator does not support any combination of challenges that will satisfy the CA.' error

Fixing certbot's authenticator-challenges error by upgrading certbot and re-running renew.

[Let's Encrypt] How to resolve 'The requested nginx plugin does not appear to be installed'

Fixing certbot's missing Nginx plugin error by installing python-certbot-nginx.

Library Vulnerability Update Policy Guide - Designing Severity-Based SLAs from Global Standards

'How many days do we have to patch a Critical vulnerability?' — There is no single authoritative answer. This article surveys major global frameworks, extracts the few that prescribe concrete timelines, and synthesizes them into a unified SLA design that is audit-ready and operationally practical.

Security of Limited Access URLs and Basic Authentication

Comparing limited access URLs and Basic authentication for exposing pages to specific end users.

[Linux] Commands to Get File Hash Values

Compute file hashes on Linux with openssl sha1 for SHA-1 and md5sum -b for MD5.

[Linux] Using mktemp Command is Safe for Creating tmp Files

Use mktemp with mv or ln to safely create temporary files on Linux, and gmktemp on macOS for the same behavior.

Apache Log4j Vulnerability and Elasticsearch

How CVE-2021-44228 affects Elasticsearch, and the response needed for clusters running on JDK 8 or below.

[Mac] Installing OpenSSL with Homebrew

A memo on installing OpenSSL via Homebrew and using brew link --force to replace the macOS default.

[Mac] Infected with virus and search-quick.com gets set as the default page

Cleaning a search-quick.com adware infection on a Mac using Safari extension cleanup and AdwareMedic.

[macOS] Migrated memory cleaner from "Dr. Cleaner" to "Memory Cleaner"

Losing trust in Trend Micro and migrating from Dr. Cleaner to Nektony's Memory Cleaner on macOS.

macOS Password Reset Methods and Countermeasures

How Recovery Mode's resetpassword can be abused on a stolen Mac, and setting a firmware password as a countermeasure.

Authentication protocol 'MS-CHAP v2' used for VPN connections

MS-CHAP v2 for PPTP VPNs and its vulnerability, plus mitigations like PEAP pairing or L2TP/IPSec.

[Nagios] Configuration Method for Operating from Web Management Interface

Fixing the Nagios web UI permission error by joining nginx to the nagios group and tuning cgi.cfg authentication.

[Nginx] add_header Not Reflected Due to Overwrite Issue and Solution

Why Nginx add_header at the server level disappears when a location block adds one, and how to work around it.

[Nginx] Access restriction configuration to block specific IP addresses

Adding a deny directive inside a location block to block a specific IP address in Nginx.

[Nginx] How to Exclude Specific URLs from Basic Authentication

Using satisfy any and allow all to exempt specific URLs or static assets from Nginx Basic auth.

[Nginx] Configuration to Redirect HTTP to HTTPS & HTTP Strict Transport Security (HSTS) Support

Nginx configs for a 301 HTTP→HTTPS redirect and the HSTS header, plus how to submit to the HSTS Preload List.

OAuth Beginner's Article Collection

A curated reading list of beginner-friendly OAuth articles.

OAuth Articles for Beginners Summary

A link roundup of beginner-friendly OAuth articles I compiled for myself.

How to Use OAuth 2.0 in CLI and Batch Processing

A collection of references for using OAuth 2.0 from CLI tools and batch processing.

Reference Information Summary for Learning the Difference Between OpenID Connect and OAuth 2.0

Reference links and a ChatGPT-based summary to understand how OpenID Connect differs from OAuth 2.0.

[OpenSSL] How to Create Self-Signed Certificates (Ore-ore Certificates)

Three openssl commands to generate a private key, a CSR, and a self-signed certificate.

Bug Bounty Programs in Open Source Projects - Lessons from Implementation and Termination Cases

Investigating bug bounty program implementation and termination cases in open source projects. From big tech-led programs to OSS companies like Vercel, Supabase, and Neon, and new challenges in the AI era, we explore the current state of OSS security.

Introducing SECURITY.md and security.txt to Open Source Projects - Learning from Giselle

Learn how to introduce SECURITY.md and security.txt to open source projects using Giselle as an example. Covers security policy writing, vulnerability reporting methods, and automating update reminders with GitHub Actions.

OWASP Security Standards Adopted by Major Platforms - Learning from Google, Microsoft, Salesforce, and Slack

We introduce cases where major platforms have adopted OWASP as a security review standard for web application development. The fact that giant platforms like Google, Microsoft, Salesforce, and Slack have adopted OWASP as their standard demonstrates that it serves as the security baseline for modern web application development.

How pnpm's minimumReleaseAgeExclude Helped with Emergency Security Updates

pnpm's minimumReleaseAge is a useful setting that delays installing freshly released packages to improve stability. However, when you need to urgently apply security patches, this setting can work against you. This article introduces a real-world example of using minimumReleaseAgeExclude to exclude specific packages from the restriction, enabling rapid and safe security update responses.

[macOS] Random String Generation Command for Passwords: pwgen

Installing and using pwgen on macOS to generate random password strings, including symbol characters.

[Ruby on Rails] Setting for Always Using HTTPS Connection: config.force_ssl = true

Notes on enabling config.force_ssl = true in production.rb to force HTTPS connections in Rails.

Deciding Whether to Enable or Disable Redis TLS Support

Two perspectives — zero trust vs. safe-within-VPC — for deciding whether to enable Redis TLS.

RubyGems.org New Registration and Initial Setup (MFA)

A record of signing up for RubyGems.org and enabling two-factor authentication as initial account setup.

[Server] Initial Setup of CentOS 6.3 on Sakura VPS

Initial setup for Sakura VPS's CentOS 6.3 — admin user, SSH, iptables, and yum.

Notes on Comparing SecureSAMBA with Major Online Storage — Where Capacity-Based Pricing Wins and Constraints to Check Before Signing

Notes from evaluating SecureSAMBA against seven major online storage services. The breakeven between per-user and per-capacity billing lands around 28-30 users. In March 2026 SecureSAMBA's flagship plan was overhauled from 100GB/50 users/15,000 yen to 300GB/unlimited users/25,000 yen, and in September 2026 DirectCloud launched a per-user Team Business plan. If ISMAP is a hard requirement, the shortlist collapses to Box, CryptoBin, Microsoft 365, and Google Workspace. On the SecureSAMBA side, there are constraints feature-matrix comparisons tend to hide: no browser real-time co-editing, weak Mac support, the discontinued full-text search option, and caps on transfer volume and concurrent sessions.

Summary of Shopify Fraudulent Order Countermeasures

A reference roundup of Shopify fraudulent-order countermeasures from the Help Center, Shopify Blog, and outside articles.

Shopify Password Policy

Investigating Shopify's undocumented password policy and options for enforcing a custom policy.

[npm] Use Showdownjs instead of markdown-to-html for converting Markdown to HTML

markdown-to-html has npm audit vulnerabilities, so use Showdownjs for Markdown-to-HTML in Node.js.

Setting Smaregi 'Credit Manual Input' Function to OFF

Two ways to turn off Smaregi's Credit Manual Input feature — from the management screen or per app.

Free Tools to Check SPF, DKIM, and DMARC Settings

SPF, DKIM, and DMARC settings are essential for email security and deliverability. This article introduces free tools to check these settings and compares their features. Use these tools to enhance your email reliability.

Setting Up SPF, DKIM, and DMARC

Setting up SPF and DKIM for a Google Workspace domain and verifying PASS in Gmail message headers.

[Security] Essential Sites to Read When Understanding SQL Injection Countermeasures

A personal reading list of articles for understanding SQL injection countermeasures.

[SSH] Things to Be Careful About When Setting Up Public Keys and How to Handle 'Permission denied (publickey,gssapi-with-mic).'

Fixing 'Permission denied' during SSH public key auth by adjusting .ssh and authorized_keys permissions.

Options I Use with ssh-keygen When Creating SSH Public and Private Keys

The ssh-keygen options (-t, -b, -f, -C, -l) I regularly use to create SSH key pairs.

[SSH] SSH connection with users who don't have password set fails even with public key authentication only

Why SSH public key auth fails for users without a password, and how to fix it.

Starbucks Wi-Fi 'at_STARBUCKS_Wi2'

A quick note on measuring Starbucks Japan's `at_STARBUCKS_Wi2` Wi-Fi speed with Speedtest.net.

Stopped MAC Address Filtering Function

Why I turned off office Wi-Fi MAC address filtering after finding the security benefit didn't justify the maintenance cost.

Supabase Privacy and Security

A quick check of Supabase's privacy policy, region options, open source edition, and SOC 2 Type 2 status.

[Symfony1.4] csrf token: Required.

How I fixed the `csrf token: Required.` error in Symfony 1.4 by rendering the form's hidden fields.

[Symfony1.4] Authentication and Authorization Checks Are Configured in security.yml

Configuring Symfony 1.4 authentication and authorization declaratively via security.yml.

[DoS Attack] Teardrop Attack

A note on Teardrop, a DoS attack that abuses overlapping IP-fragment offsets to crash vulnerable TCP/IP stacks.

Detecting Terraform Misconfigurations with Trivy: A Comparison Demo with Checkov

Following our Checkov demo, we scanned the same Terraform code with Trivy. Checkov found 37 issues; Trivy found 27. Where does the gap come from? We compare severity classification, IAM wildcard handling, and check ID systems using actual scan results.

Beyond Trivy and tfsec - Comparing Alternative Security Scanning Tools (Grype, Checkov, Snyk, KICS)

The Trivy supply chain compromise and tfsec's maintenance-mode status have made it urgent to evaluate alternative security scanning tools. This article compares options beyond Trivy and tfsec: Grype, Snyk, and Docker Scout for vulnerability scanning, and Checkov and KICS for IaC scanning, with practical guidance on selection criteria and recommended combinations.

The Vercel Breach Started with a Roblox Cheat Search — Personal and Corporate Defenses Against Lumma Stealer

The Vercel breach began with a Context.ai employee searching for Roblox cheats and getting infected with Lumma Stealer. OAuth tokens for Google Workspace leaked, and an over-privileged third-party SaaS integration carried the attacker all the way into Vercel. This post lays out what individuals should be careful about and what organizations can actually do.

Opening a Folder Can Run Malware — A Safe Demo of Developer-Targeted Attacks Disguised as Job Recruiting via VS Code folderOpen and npm Lifecycle Scripts

Attacks that lure developers into running malware-laden repositories under the guise of recruiting or coding tests are on the rise. The steps you take right after git clone (opening the folder in an editor, running npm install) can themselves be the code-execution trigger. I built a demo repository to reproduce that safely on localhost, and here are the design decisions and defenses worth taking away.

[Windows] Fake Java Update Sites and Solutions

How I cleaned up a Windows machine hit by fake Java update sites, using browser cache clearing and IObit Uninstaller.

[WordPress] Disable XML-RPC

Disabling WordPress XML-RPC at the Nginx layer to mitigate DoS abuse.

Set WordPress author name to be hidden

Hiding the WordPress author name on single-author sites via a theme option.