Cyberattacks
339 episodes
#6472: What a VPN Node Can Actually See
A VPN provider decrypts your outer tunnel, but TLS still protects your web pages while exposing hostnames and timestamps.
#6471: Why Commercial VPNs Cannot Be End-to-End
A commercial VPN uses hop-by-hop encryption rather than end-to-end, decrypting traffic at the exit node to reach ordinary websites.
#6450: Securing MCP Endpoints and Webhooks Without Open Doors
Over half of all internet requests at one edge endpoint in a single day came from automated scanners probing for secrets.
#6449: Why PHP2Shell Was a Sniper Rifle, Not a Nuke
A decade-old PHP flaw affected 46 million servers, but attackers bypassed broad waves to cherry-pick narrow target builds.
#6426: Tracing How IP Cameras Phone Home in OPNsense
When firewall rules change, an IP camera's cloud stream stays alive because the kernel preserves existing connections in the PF state table.
#6425: Mapping Undocumented APIs Without Breaking Them
When documentation diverges from reality, a single GET request returning a 405 status code can cheaply prove an unlisted POST endpoint exists.
#6420: Programmable Email Routing with Cloudflare Workers
Cloudflare Email Workers offer three core verbs—forward, reply, reject—operating before delivery to bounce spam at the edge.
#6396: How Political Scandals Exposed Boring Email Bugs
A 2007 congressional inquiry found the Republican National Committee preserved zero emails for 51 of 88 senior White House accounts.
#6391: How Forensic Tools Search Android for Spyware
Amnesty's Mobile Verification Toolkit removed direct ADB shell analysis because device shell differences caused inconsistent outputs.
#6351: Why GPG Builds an Entire Department Instead of a Key
OpenPGP divides key management into four distinct capabilities: certify, sign, encrypt, and authenticate.
#6350: Why Modern SSH Keys Cannot Fix Harvested Traffic
Upgrading your user key to Ed25519 authenticates you cleanly, but it leaves recorded traffic vulnerable to future key-exchange attacks.
#6337: Where Email Filtering Actually Happens
Business email compromise caused $2.8 billion in losses in 2024 despite passing standard SPF and DKIM authentication checks.
#6255: Routing Claude Code Tasks to Local Ollama Models
A feature request to support local subagent endpoints in Claude Code was closed for inactivity after less than two months.
#6236: Synthetic Logs Without Leaking Your Clients
You can rewrite your logs with a cheap model — but can you keep the task boundaries while losing the client names?
#6193: Why Email Images Still Phone Home
That "load remote images?" prompt is older than your phone. Here's what fetching a picture actually tells the sender.
#6183: Private Podcast Feeds: Tokens, Buckets, and Basic Auth
How do you keep a podcast feed for four people away from everyone else? Tokens, buckets, and the auth podcast apps barely support.
#6182: Running a Private APT Repo for Family Machines
Daniel wants his Debian packages on family machines without becoming their unpaid update service. Here's the modern way to do it.
#6181: Shipping Private Android Apps to Your Family
Daniel wants to ship private Android apps to non-technical relatives. F-Droid repos, Basic Auth, and the Google verification cloud on the horizon.
#6179: Voice Cloning: 10 Seconds to Steal Your Voice
Ten seconds of audio is all it takes to clone a voice. Here's what the law actually protects — and what it doesn't.
#6167: Streaming Browser Cookies to a Headless Server
Daniel wants his logged-in browser on the home server. Chrome bolted the front door — so what's left?
#6151: Invisible Characters That Catch Leakers
Canary traps, binary space codes, and zero-width Unicode characters: how organizations actually trace a leaked document back to its source.
#6144: 8 Real Steganography Cases and How They Got Caught
eBay, a doll shop, and a blink in Morse code — eight real steganography cases, and the tell that exposed every one.
#6140: Did Flight FZ1073 Really Happen? Inside a False-Flag Claim
A hijacking attempt on Flydubai FZ1073 was declared staged within 67 minutes. What the evidence actually supports — and what it doesn't.
#6124: One Vault, Two Readers: Secrets for a Home AI Gateway
One source, two readers — not two copies kept in sync. How a home AI gateway should actually get its API keys.