I run the infrastructure I write about.
A production site, a private GPU inference node, and the monitoring that watches both. No team, no budget, no on-call rotation, and a duty of care over minors' data. I write up the incidents and the controls, including the ones that were missing.
Written from primary sources. Every claim traces to something recorded.
Field Notes
Recent writing
The long pieces follow one shape: threat, decision, implementation, verification, residual risk. The short ones are me arguing with something I read.
My site returned HTTP 200 for every one of the six days it was compromised.
A case study in detection: why uptime monitoring would have sat green through a six day compromise, the three monitors that replaced it, how each one was proven capable of failing, and the residual gaps that are still open.
AI GovernanceThe AI that grades student work never leaves my house.
A working case study in keeping student data local: the threat, the decision, the build, how it was verified, and the risk that is still sitting there. Local LLM inference on a two-GPU node, with the failure behavior written down in advance.
AI GovernanceSteal my AI policy. Here is the thinking behind it.
A classroom-tested AI policy for teachers: three permission levels stamped per assignment, enforcement by defensibility instead of detectors, and how to adapt it for every subject. Free one-page download.
Classroom work
The teaching side lives somewhere else.
Curriculum, lesson materials, and everything student-facing is at STEMageddon. This site is the practitioner side: what I build, what broke, and what I learned closing it.
Visit STEMageddon