Writing
Incidents, controls, and what was missing.
Long pieces follow one shape: the threat, the decision, what got built, how it was verified, and the risk still sitting there. Shorter notes are me arguing with something I read. Both are here.
My site returned HTTP 200 for every one of the six days it was compromised.
A case study in detection: why uptime monitoring would have sat green through a six day compromise, the three monitors that replaced it, how each one was proven capable of failing, and the residual gaps that are still open.
AI GovernanceThe AI that grades student work never leaves my house.
A working case study in keeping student data local: the threat, the decision, the build, how it was verified, and the risk that is still sitting there. Local LLM inference on a two-GPU node, with the failure behavior written down in advance.
AI GovernanceSteal my AI policy. Here is the thinking behind it.
A classroom-tested AI policy for teachers: three permission levels stamped per assignment, enforcement by defensibility instead of detectors, and how to adapt it for every subject. Free one-page download.