Posts

fail2ban listed the address as banned, and the address still got in. On a Debian host with firewalld, the nft binary was missing, so every ban had failed.

An old config backup lost a per-install channel record. Diagnose the selected target before overriding an update guard protecting newer database state.

A tar of a rootless Podman volume, run as the host user, skips every file owned by the container's subordinate UIDs. For Gitea that meant app.ini and the JWT key. The restore into an unprivileged LXC container then failed on chown.

RouterOS writes autosupout.rif after a crash and tells you to send it to MikroTik support. The file is zlib sections in a bit-reversed base64, and a short Python script turns it into the kernel oops, the log and the config. It also holds your secrets in plain text.

The iptables ACCEPT rule for udp/67 on lxcbr0 kept counting, and dnsmasq never saw a DHCPDISCOVER. With nftables, an accept is not final: firewalld's table hooks in after it and rejected everything from the bridge.

Every ansible-playbook run from a coding agent failed before reading the playbook, even --syntax-check. The agent shell hands Ansible non-blocking file handles; `&1 | cat` gives it blocking ones.

A SwiftUI screen suite recorded with swift-snapshot-testing at precision: 0.99 stayed green after the row's location text was deliberately wired to the wrong value. On a full device frame, 1% of the pixels is about 30,000, and the wrong text changed about 900. Measuring the mutation and setting precision to 0.9999 turned four of the seven cases red.

Agent progress files can preserve unverified assumptions. Rebuild a small factual baseline, then check inherited claims against their original evidence.

Security transcripts mix observations with model guesses, and classifiers may stop the audit. Preserve provenance, checkpoints, and a provider-neutral handoff.

A whole-home Apache UserDir mapping exposes readable dotfiles. Test with a harmless canary, publish only public_html, and rotate exposed secrets.