One day, I’ll get some consistency on this blog. Just wanted to throw in an update

Things that I’m setting out to do

Few short term goals with plans:

Obtain a CISSP. I’ve been in tech for a while and this would provide me a bunch more exposure to security concepts I don’t see day-to-day. Supposedly, it also helps map security concepts to business concepts. In my mind, it sounds like a security-oriented MBA as a cert.
Publish maven on winget. Winget is pretty awesome. It’s like debian’s apt or mac’s brew *. Currently there’s an issue where the default zip style install bundles don’t support custom paths - they only add a path to $PKG_HOME, where $PKG_HOME is the destination folder of the package. However, the zip files created by maven vendor shell scripts to be “agnostic” live in $PKG_HOME/bin. As a result, the maven-published zip files for maven aren’t immediately supported by just the manifests. I’ve vibed a flow to auto-ingest new maven zips into a correlated msi file (whic does allow adding custom locations to PATH) at https://github.com/eye942/maven-winget. Currently waiting on the first ingestion of into the official winget-pkgs repository.
Read more serious literature. Somebody I respect a decent amount recommended Walden.
Vibe a publishing frontend so it’s easier to publish here.

Medium term goals:

AutoThreat Modeling. I saw an interesting talk at OWASP about a team that had linked pyTM and ThreatSpec. It would be really cool to be able to do something that links a lot of the things I think are really cool. One of the bigger goals, especially because I hate needing to pay for functionality, is to minimize the requirement for AI. AI will still be a core component, but as a hobbyist, needing to have tokens to do security seems as distasteful to me as the SSO tax.
- I think it’s really important to have architecture linked with diagramming. Likewise, implementation should also link back to architecture/preconditions. I’m still not sure where I want to go with this yet, but there are definitely some interesting paths for this.
- Would be really cool to link this to the property-based testing (e.g. Hypothesis) and proving program correctness (e.g. Lean Hillel Wayne)
Local LLM runner optimization. I have one of the 1st gen NPU in the Intel EVO Cores NPUs. In theory, I should be able to use it.
Exercise more. Not looking to get jacked, but as we edge towards collapse, I like my brother’s viewpoint. Exercise enough to be able to fend off others in

Longer term goals:

Random thoughts

It’s pretty crazy but containers are not exactly the security boundary that everybody thinks. There’s a couple pretty good practices for using/running containers.

Use the --rm flag when running a new ad-hoc container. This helps remove the leftover containers when you’re testing the behavior. Otherwise, pruning will be needed much sooner.
Set the host_ip of the container. Docker/podman default behavior for -p binds to all ports so that other people can reach your computer if you do simple port binding.

Winget Caveats

Winget doesn’t seem to force the same sort of sandbox execution like brew or snap. It’s really up to the installer type.