Cyberattacks
325 episodes
#6193: Why Email Images Still Phone Home
That "load remote images?" prompt is older than your phone. Here's what fetching a picture actually tells the sender.
#6183: Private Podcast Feeds: Tokens, Buckets, and Basic Auth
How do you keep a podcast feed for four people away from everyone else? Tokens, buckets, and the auth podcast apps barely support.
#6182: Running a Private APT Repo for Family Machines
Daniel wants his Debian packages on family machines without becoming their unpaid update service. Here's the modern way to do it.
#6181: Shipping Private Android Apps to Your Family
Daniel wants to ship private Android apps to non-technical relatives. F-Droid repos, Basic Auth, and the Google verification cloud on the horizon.
#6179: Voice Cloning: 10 Seconds to Steal Your Voice
Ten seconds of audio is all it takes to clone a voice. Here's what the law actually protects — and what it doesn't.
#6167: Streaming Browser Cookies to a Headless Server
Daniel wants his logged-in browser on the home server. Chrome bolted the front door — so what's left?
#6151: Invisible Characters That Catch Leakers
Canary traps, binary space codes, and zero-width Unicode characters: how organizations actually trace a leaked document back to its source.
#6144: 8 Real Steganography Cases and How They Got Caught
eBay, a doll shop, and a blink in Morse code — eight real steganography cases, and the tell that exposed every one.
#6140: Did Flight FZ1073 Really Happen? Inside a False-Flag Claim
A hijacking attempt on Flydubai FZ1073 was declared staged within 67 minutes. What the evidence actually supports — and what it doesn't.
#6124: One Vault, Two Readers: Secrets for a Home AI Gateway
One source, two readers — not two copies kept in sync. How a home AI gateway should actually get its API keys.
#6123: OAuth or a Personal Access Token for Your MCP Server?
GitHub CLI login hands your agent one long-lived token with access to everything. Fine-grained PATs can't. Which should your MCP server use?
#6095: How to Prove Your Photo Is Real
Deepfakes made faking easy. Now the harder problem: proving your real photos and video are real. A field guide.
#6044: One Door for Every AI: Cloudflare MCP Portals
Cloudflare's MCP Portals put every on-prem MCP server behind one authenticated endpoint — and why service tokens can't work for ChatGPT.
#6015: How Banks Move a Million vs a Billion Dollars
A million and a billion are the same number to a computer. The difference is liquidity, netting, and where the payment actually settles.
#5973: MCP Security: Tool Poisoning and Agent Identity
MCP servers trust their own tool descriptions. That design choice creates a whole new class of attack — and a new observability problem.
#5967: How UEFI, Secure Boot, and the Boot Chain Actually Work
Twenty years of Linux and nobody explains the firmware. Here's the boot chain, the keys, and what's changing in 2026.
#5954: Layered Safeguards and the Math Behind Them
Three safeguards at 90% each seems bulletproof—until shared failure modes collapse the math.
#5952: Inside Malmab: Israel's Most Secretive Security Body
Israel's classified defense security body and what its extreme information practices teach about protecting secrets.
#5947: Who Actually Trades on Polymarket?
Three percent of wallets drive 90% of Polymarket's volume — and most retail accounts quietly lose money. Here's who's really on the other side.
#5916: Grey Rocking Meets OPSEC: A Family Firewall
Grey rocking has no clinical trials—just a 2012 blog post. What happens when you rebuild it on need-to-know and OPSEC?
#5910: Revit MCP in a VM: What Actually Works
Autodesk's official Revit MCP server is locked down and reliable-ish. The community ones execute arbitrary code on an open port. Neither runs unatt...
#5906: Running a Company Like a Spy Agency
What if an ordinary company ran on intelligence-style need-to-know? Oak Ridge and a 1977 CIA self-audit already ran the experiment.
#5905: Bare Linux Routing vs OPNsense: What Actually Wins?
You can build a router on plain Debian or Ubuntu. The question is whether you should — and what it costs you over ten years.
#5869: Scraping AliExpress Specs: Selectors, Agents, or Neither?
Daniel wants to snapshot AliExpress spec sheets into his inventory system. The selector approach is already dead — here's what actually works.