Hermes vs OpenClaw, NanoClaw, ZeroClaw, IronClaw: Agent Architecture
A practical, architectural comparison of Hermes, OpenClaw, NanoClaw, ZeroClaw, and IronClaw, and why a layered agent system beats picking one winner.
Tag: security
I Audited the OpenVPN Server I Wrote a Guide For
Two years after publishing a guide to restricting OpenVPN clients to specific IPs, I audited the server it built, and most of the findings trace back to the guide.
Tightening a dev VM that was quietly living without a firewall
What a routine security audit found on a small always-on dev VM: passwordless databases, no host firewall, over-privileged jobs, and how it got fixed.
Tightening Hermes Secrets with Bitwarden
A practical walkthrough for moving Hermes API keys out of local env files and into Bitwarden Secrets Manager, with verification and cleanup steps.
Shared AI Artifacts Aren't Private From a Hard-to-Guess URL
A security note on the Claude shared-chat and Artifacts leak, and why AI workspaces need clear boundaries between private, unlisted, and public content.
Tightening Hermes Agent Security for Local Sensitive Work
How I tightened my Hermes agent setup after adding a local model for PII and credential-sensitive work: tool limits, manual approvals, and a quiet watchdog.
Securing Hermes Agent with OpenShell
Why I run Hermes Agent inside OpenShell when it reads untrusted content, and how filesystem, network, process, and credential policy change the security model.
Giving Hermes Read-Only Access to GCP, AWS, and Kubernetes
A practical setup giving an AI agent read-only access to debug QA and production on GCP, AWS, GKE, and EKS without touching workloads or secrets.
Identity-Aware GCS Access Instead of Hashed Secret URLs
Replacing hashed 'secret' URLs in Google Cloud Storage with IAM Conditions and domain-restricted access that verifies identity instead of hiding a path.
Sending Email from an Ubuntu VM on Oracle Cloud (OCI)
A Postfix and OCI Email Delivery setup guide covering SMTP auth, sender approval, SPF/DKIM/DMARC, and the errors that block delivery.
An SSH SOCKS5 proxy that stops DNS leaks
An SSH dynamic port forward (ssh -D) turns a remote server into a SOCKS5 proxy so DNS resolution happens remotely, which matters when DoH is blocked by policy.
Why macOS ignores your manual DNS settings
On a managed MacBook, iCloud Private Relay and MDM scoped resolvers silently override manual DNS settings, and scutil --dns shows you which one is winning.
PostgreSQL MD5 to SCRAM-SHA-256: a zero-downtime migration
PostgreSQL 18 deprecates MD5 authentication, and migrating to SCRAM-SHA-256 in mixed mode lets you switch pg_hba.conf without downtime or forced app changes.
Securing AWS Credentials: aws-vault vs 1Password
Storing long-lived AWS access keys in ~/.aws/credentials is a common anti-pattern; aws-vault and the 1Password AWS Shell Plugin both fix it with short-lived STS tokens.
Enabling Local HTTPS for Development and Debugging
Local HTTPS matters because browser APIs like Service Workers require a secure context, and this covers Caddy, Nginx with mkcert, Puma-dev, and Cert-Manager.
User Impersonation in Rails with the Pretender Gem
User impersonation lets an admin temporarily act as another user for debugging and support, and the pretender gem handles the current_user switch and session state.
Custom HTTP Headers in Rails: Picking the Right Format
Rails normalizes headers to HTTP_-prefixed names, which decides whether Accept, a legacy X- prefix, or a plain name is right for a custom API header.
How Rails Sessions Work with Warden and Cookies
Rails keeps users logged in by encrypting the whole session into a browser cookie, then lets Warden authenticate each request, which changes how you should test it.
Detecting Cloudflare Zero Trust Beyond the WARP Flag
WARP can report itself as off while Zero Trust still routes your Mac's traffic; here is how to check DNS, ASN, and DoH to find out for sure.
Monitor Cloudflare WARP Status on macOS with launchd
A launchd-scheduled shell script that detects when Cloudflare WARP reconnects on a company-managed Mac and sends a desktop notification.
Migrating OTP Secrets Out of Google Authenticator
How to export TOTP secrets from Google Authenticator with the otpauth tool and import them into Authy, Aegis, or 1Password without losing account access.
ARG, ENV, and BuildKit secrets: how each behaves in Docker
ARG, ENV, exported shell variables, and BuildKit secret mounts each persist differently in a Docker image, and only one of them is actually safe for tokens.
Docker secrets: how layers leak them and how BuildKit fixes it
Docker's layer history persists secrets baked into ARG and ENV instructions, and BuildKit secret mounts are the practical fix that keeps them out of the image.
Leapp vs aws-vault: Comparing AWS CLI Credential Tools
A practical comparison of Leapp and aws-vault for managing AWS CLI credentials, covering SSO and IAM setup, session tokens, and when each tool fits better.
OpenVPN: Restrict Client Access to Specific IPs Only
How to restrict OpenVPN clients to a limited set of destination IPs, using client-config-dir routes, a client-connect script, and iptables rules.
Fixing Multi-Tab Session Bugs with JWT and sessionStorage
How cookie-based session state breaks when a user opens multiple tabs in a single-page app, and how splitting auth into JWT plus sessionStorage fixes it.
How to Rotate GKE Cluster Credentials
The gcloud commands for checking certificate expiry, starting rotation, upgrading nodes to the new certificate, and completing GKE credential rotation.
Container Security with Fine-Grained Permission Control
How Linux file permissions and Kubernetes securityContext settings enforce least-privilege access for containerized workloads, with a worked example.
Rails Session Stores: Cookie, ActiveRecord, and Redis
A comparison of Rails session stores: cookie sessions, ActiveRecord, and Redis, including how to share sessions across subdomains and multiple apps.
Rails Secrets: Credentials, 1Password, and Cloud Vaults
A rundown of Rails credentials, environment variables, 1Password CLI, and cloud secret managers like AWS Secrets Manager and Vault, and when to use each.
Config Approaches: Files, Env Vars, and Config Servers
A comparison of YAML config files, Rails encrypted credentials, environment variables, and centralized config servers, with the trade-offs of each approach.
Database Auditing: pg_audit vs audited vs paper_trail
A comparison of database auditing options, pg_audit, audited, paper_trail, Hibernate Envers, and SQL Server temporal tables, and when each one fits.
Defending Against DoS Attacks
How to defend against DoS and DDoS attacks with request throttling, input validation, firewall rules, load balancers, and cloud-based mitigation.
NETSCREEN 5GT密码破解方法
恢复 NetScreen 5GT 密码的两种方法：通过 Console 输入序列号初始化，或用重置针孔硬复位，以及导入旧配置文件前的编辑注意事项。