Security

A few weeks ago I shelved my “homemade Bitwarden” and moved to 1Password on the family plan. Yes, you have to pay, but sharing with the family and the ease of use make up for it. Shortly after migrating the passwords I ran into the Developer tab and its SSH agent: private keys live in the vault, they sync themselves across my machines, and every use is authorized with a fingerprint or with Windows Hello. By the way, I later found out that Bitwarden has had an SSH agent too since early 2025. You learn something new every day. It sounded too good to be true, so I set out to check whether it fit my case: several workstations (macOS, Windows, Linux), lots of servers, network gear with SSH from another era, and more and more scripts and AI agents running ssh without me being at the keyboard. In this post I go through what I learned, how I set it up, and where I do NOT use it. …

Sancho is skeptical by design, and with Skills you need to be more skeptical than ever. In my note “Sancho Learns Skills” I described how convenient it is to download a ready-made Skill and plug it into your agent. What I didn’t mention is the dark side: every Skill you download from a public marketplace is someone else’s code that your agent will run with your permissions. That’s the new weak link in the supply chain: attackers are already poisoning these repositories with malicious Skills. In this note I lay out a few ideas to protect yourself. …

In this post I describe the process of installing a “Bitwarden” server. I’ve been using their Cloud service for several years, but I’ve decided to go with an on-premise home installation. While researching I discover with surprise that I have two options, the first is to use the official Bitwarden self-hosted (which consumes quite a few resources and seems complex) or go with a lightweight Vaultwarden, a clone of the former, which apparently installs quickly and is simple. …

In this technical post I’ll describe how to set up a home VPN Server based on OpenVPN, which remains the best solution today despite being more complex to implement. The goal is to have access to the internal services of my home network from the internet. …

Geek quote: “Logging what happens is wise…” In the past I used ULOG to analyze which packets were being dropped by iptables, but since it’s been marked as deprecated I’ve switched to NFLOG. …

The SSH service is the first thing you should configure on a Linux system. With OpenSSH you get a set of tools – including ssh, sshd, scp, etc. – that allow you to enable secure remote shell access to your machine. If you come from the “telnet” era, you should forget about it; its replacement today is SSH. …