Blog
Things that break, and why
I write down the failures I run into in infrastructure, security and AI, especially the ones where the cause took me a while to find. Writing them up keeps me from repeating them.
23 September 2026 7 min read
What it costs to put ModSecurity in front of an application
I measured an application with and without a WAF (ModSecurity and the OWASP CRS) in four scenarios. How much of the cost is the WAF, how much is the configuration, and a false positive at paranoia level 4.
ModSecurityOWASP CRSNginxPerformanceCybersecurity
18 August 2026 6 min read
"FROM ubuntu:latest" is going to break your project (just not today)
A web farm that worked in 2025 was returning 502 on half the requests a year later, without a line of code being touched. How I diagnosed it and how to avoid it.
DockerNginxPHPReproducibilityDevOps