Running OSV-Scanner on this blog's own GitHub repository: the first command found nothing to scan, the second found 8 issues that mostly do not matter, and the library I most needed to fix never appeared in the report. How I set it up, how I fixed it, and where things stand.
Closing the OSV proof of concept: where the database, the scanner and the fix command fit in a development pipeline, the two GitHub workflows to start with, what OSV does not do, and my recommendation.
Proof of concept: let OSV-Scanner fix the vulnerable Node project. The safe in-place strategy fixed 7 of 50; the relax strategy fixed all 50 by changing three lines, two of them breaking upgrades. What each strategy does, why the numbers differ, and how to use it without getting burned.
Proof of concept: install OSV-Scanner v2.7.0, scan a small Node project with four direct dependencies, and read what comes back: 49 vulnerabilities, most of them in packages I never chose. Plus exit codes, JSON output and an ignore file with an expiry date.
A proof-of-concept series on OSV, Google's open vulnerability database and scanner. Part 1: the problem OSV solves, how to navigate osv.dev, how to read a vulnerability record, and the one API call worth knowing.
Thinking out loud on a secure development life cycle for a time of 48,000 CVEs a year and AI-assisted exploits: the loop, timeboxes, an open-source toolchain, a shared findings store, LLM fix PRs with a human in the loop, and how to teach it.
How to wire Black Duck scans into a self-hosted GitHub Enterprise Server so findings land in code scanning and fixes arrive as pull requests, plus a small script for tools that cannot open PRs themselves.
Every AI, machine-learning and data post on this site in one place, in an order that builds from the basics to agents, MCP and the cost of tokens.
What the Model Context Protocol is, how hosts, clients and servers fit together, the tools-resources-prompts building blocks, a minimal Python server, and the security rules that matter.
How language models went from answering questions to taking actions: function calling, the agent loop, and the guardrails that keep agents useful and safe.
What a token is, why context windows have limits, how language-model bills are calculated, and practical ways to spend fewer tokens without getting worse answers.
What a machine-learning pipeline is, how Vertex AI Pipelines runs one, and a small train-evaluate-deploy example with the Kubeflow Pipelines SDK.
PyTorch, Hugging Face, scikit-learn, LangChain, vector stores, Ollama, MLflow: what each layer of the AI stack does, and how to pick the right tool for the job.
Day-to-day life after the move: writing and publishing a post, updating the theme and Hugo safely, extending the site, and the gotchas that cost me an evening each.
A step-by-step guide to moving a WordPress blog to Hugo: back up, inventory, convert with a script, rescue images, keep every link, then go live.
How I chose a new home for a personal blog after a break-in: the requirements, the candidates, and why a static site generator won.
CISA's Known Exploited Vulnerabilities catalog and directive BOD 26-04 in plain words: what makes a CVE 'known exploited', the four questions that set a fix deadline, the 3-day to fix-on-upgrade timelines, and how to use both outside government.
DNS to Cloudflare, the website to GitHub Pages, email left where it was, and the traps in between.
Hugo, Blowfish and GitHub Pages: a portal homepage, topics that sort themselves, and accessibility measured rather than guessed.
Converting 137 WordPress posts to Markdown, recovering lost images from backups, and keeping every old link alive.
A six-year-old WordPress blog was compromised. What the attack looked like, and the first hours of triage.
SLSA (Supply-chain Levels for Software Artifacts) in plain words: provenance as a receipt for a build, the Build and Source tracks and their levels, a two-step GitHub example, and what it protects against.
OWASP's Software Assurance Maturity Model in plain words: five business functions, fifteen practices, three maturity levels, how a self-assessment works, and why a score you choose beats a score you are given.
What NIST's Secure Software Development Framework is, its four groups of practices in plain words, what it asks of a team, why buyers care about it, and what it deliberately leaves out.
Twelve hundred AI agents were built to work alone. Given four days and a crack in the wall, they built a civilization — to defeat a watchdog that was never there. PHASEONE10841 23:00 UTC · Jul 8 zzHELP_PHASEONE_ARV010841_NO_CONSUMER_SEEK_IDEA the first message posted to the board — an agent admitting its task has no solution, asking the void for help Jul 7 · 21:00 - launch
A short introduction to MITRE ATT&CK for people who build software: how to read an ID like T1552.001, the 15 Enterprise tactics in v20 (including the new Stealth and Defense Impairment), a cheat card for each, and how developers can use it.
A short introduction to the OWASP Top 10:2025 for people who build software: what the list is and is not, what changed since 2021, why each category matters, and ten cheat cards to keep next to your keyboard.
From “what is autocomplete?” to the full mathematics powering Claude Sonnet 4.6; with history, intuition, worked examples and cheatsheet.
There’s a certain irony in leadership development.
After finishing the assignment late Saturday night, I took a moment to reflect on my progress. It was a valuable opportunity to document the key concepts and insights I gained from the experience.
The story of modern language models is like watching a family tree grow, with each new generation learning from the triumphs and mistakes of those who came before.
Remember how we compared a language model to an advanced autocomplete system? Well, here’s where the story gets interesting. Not all language models learn the same way.
Think of a language model as a really sophisticated autocomplete system. You know how your phone suggests the next word when you’re texting?
Understanding how computers “read” and understand text is a fascinating field.
How I group Kafka JMX metrics into traffic, latency, consumer lag, replication, and JVM signals.
KNN is the friendly, neighborhood algorithm that believes you are defined by the company you keep.
The elements of information discussed here are all present in my github repository.
Whether you’re preparing for a quiz or just brushing up on fundamentals, this guide distills the key concepts from Data Mining into bite-sized, memorable chunks. Let’s dive in!
This post walks through a tiny, practical example that uses LangChain primitives and a local Ollama server to run a prompt-based summarization.
If you are like me, you must have stumbled on this question – Why is matrix multiplication so significant – especially in the AI/ML universe.
My first practical pass at Kafka JMX: enabling remote access safely and finding the measurements that explain cluster behavior.
At the heart of machine learning, algorithms learn from data. The key distinction between supervised and unsupervised learning is the type of data used for training.
As another project wraps up, bringing with it the bittersweet relief of an almost-closed chapter (and, yes, a few too many late-night coding sessions), I found myself reflecting on the tools that got…
In my last post, we explored the divide between Pandas (single machine) and PySpark (distributed computing).
So as part of the academic curriculum we just started re-exploring Apache Spark. It’s been one of the technology that I had long lost touch with.
In the rapidly evolving landscape of data science and scientific publishing, tools that bridge the gap between analysis and communication are invaluable.
A practical study note on turning infrastructure security work into governance, risk, and incident-management outcomes.
Broker-level controls for a safer Kafka deployment, from service accounts and filesystems to monitoring and recovery.
A security baseline for Kafka deployments: encrypt connections, authenticate clients, and authorize operations.
In a dialectic inquiry, two groups or individuals take opposing positions on a particular issue. They then engage in a dialogue, asking each other questions and challenging each other’s assumptions.
Imagine you’re trying to find the best solution to a problem, but the problem is really complex and has a lot of randomness involved.
Linear programming is a mathematical technique used to find the best possible outcome (maximum profit or minimum cost) in a situation where the relationships between the factors involved are linear.
In the realm of Unix-like operating systems, where command-line prowess reigns supreme, sed stands tall as a versatile and indispensable tool.
In the context of forecasting and business analytics, a model is a simplified representation of a real-world situation or process.
Forecasting methods are the techniques used to predict future outcomes based on past data and trends. They’re like having a crystal ball, but instead of magic, they use data and statistics!
How to tell which forecasting model is better: MAE, MSE, RMSE, MAPE, sMAPE, bias and Theil's U, explained with an ice-cream-sales example.
Imagine you’re a business owner trying to figure out why your sales are down. You could guess, or you could use business analytics.
Business Analytics (BA) is like a GPS for businesses—it uses data to guide decisions, solve problems, and predict future outcomes.
From a Business Analytics perspective, understanding correlation and covariance is crucial for several reasons:
RFM (Recency, Frequency, Monetary) Analysis is a customer segmentation technique that uses three key metrics:
A practical introduction to how Kafka distributes records across brokers and why partition planning matters.
A simple mental model for ZooKeeper, znodes, sessions, and why Kafka historically used it for cluster coordination.
A small project layout for turning a working Ansible playbook into reusable roles without losing clarity.
If you have ever seen this error, you know the pain of a fellow linux user.
Ever wished you could effortlessly convert your spoken words into written text? Look no further!
Loops in Ansible allow you to repeat a task multiple times with different input values.
In Unix-like operating systems, file permissions play a critical role in ensuring system security and proper access control.
One of its Ansible’s features is the ability to execute tasks with elevated privileges, often necessary for managing system configurations. This process is known as privilege escalation.
Linux, as an open-source operating system, has undergone significant transformations over the years.
In the ever-evolving landscape of artificial intelligence and machine learning, language models play a pivotal role in how we interact with technology.
A practical guide to Ansible's built-in context variables, including hostvars, groups, inventory_hostname, and facts.
The story of Linux containers is a tale of innovation and collaboration, with roots surprisingly deep in the history of the Linux operating system itself.
Every project has a story, and in the world of software development, that story is often told through commit logs.
IaC stands for Infrastructure as Code.
How ansible.cfg, inventory settings, and environment variables fit together in a manageable project.
In today’s data-driven world, the ability to process information in real-time is crucial.
The /etc/profile.d directory, though seemingly simple, plays a vital role in the smooth operation of your Linux system.
Previously I gave a high level flow for how a process of simple file write looks like in a Linux environment here. In this blog, I will add more tech-details.
Writing to a file on a device in Linux involves a fascinating journey through different layers of the system.
On my Centos8 I was facing issue when I was trying to run Molecule on a centos machine which is running podman as a non root user.
A gentle introduction to Ansible inventory, ad-hoc commands, and the first repeatable playbook.
Here’s a comprehensive guide on using Python 3 with SQLite3.
In the ever-evolving landscape of web applications, security is paramount.
At a raw level Keystore and truststore are both used for managing digital certificates and keys in the context of SSL/TLS (Secure Sockets Layer/Transport Layer Security) and other security protocols.
Consul is an open-source software tool developed by HashiCorp, designed to provide a distributed system for configuration management, service discovery, and health checking of services in a modern…
Artificial Intelligence (AI) has revolutionized many aspects of our lives, from virtual assistants like Siri and Alexa to self-driving cars and personalized content recommendations.
SNMP (Simple Network Management Protocol) is a widely used protocol for managing and monitoring network devices, such as routers, switches, servers, and printers.
The Linux Kernel stands as the backbone of the Linux operating system, serving as a critical component that enables the system to interact with hardware and manage system resources efficiently.
Photos from a whale-watching trip: whales surfacing and blowing spouts in the open sea.
In the world of computer networks, communication between devices is crucial. To facilitate this communication, various protocols are used at different layers of the networking stack.
The Payment Card Industry Data Security Standard (PCI DSS) is a set of security standards established to protect cardholder data and maintain a secure environment for payment card transactions.
DAST stands for Dynamic Application Security Testing. It is a type of security testing that assesses the security of an application while it is running.
XML entity attack, also known as Billion Laughs Attack, is a type of security vulnerability that exploits the way XML parsers handle entity expansion.
X.509 certificates have become a fundamental component of secure communication on the internet. They provide authentication, encryption, and integrity for various applications and protocols.
Devanagari is a script that is used to write several languages spoken in the Indian subcontinent, including Hindi, Nepali, Marathi, and Sanskrit.
SSH tunneling is a powerful technique that allows you to securely tunnel network traffic between two endpoints.
DNS (Domain Name System) is a hierarchical and decentralized naming system that is used to translate human-readable domain names (such as google.com) into IP addresses that can be understood by…
CURL is a command-line tool that allows developers to transfer data between servers and clients using various protocols, including HTTP and HTTPS.
Ansible is a powerful automation tool that can be used to manage the configuration and deployment of a large number of systems. It has a rich library of modules that can be used to perform a variety of tasks, from managing files and packages to deploying applications and configuring network devices.
Recently during our discussion with a client a problem was raised how to show progress for a long running Ansible playbook task & this blog is just an outcome of the things I tried and delivered.
