https://letshost.blkleg.app/ Software supply-chain security and self-hosted infrastructure by Shawn Phillips — Trust & Safety at GitHub, investigating the npm ecosystem. en https://letshost.blkleg.app/articles/writes-to-a-dead-socket-succeed https://letshost.blkleg.app/articles/writes-to-a-dead-socket-succeed Wed, 02 Sep 2026 12:00:00 GMT A firewall rule, a container detach or an expired NAT entry severs a TCP connection without closing it. Writes keep returning success into nothing, and the only thing that notices is a read deadline you set yourself. https://letshost.blkleg.app/guides/setting-up-ssh https://letshost.blkleg.app/guides/setting-up-ssh Wed, 02 Sep 2026 12:00:00 GMT Every box in this homelab starts the same way: install the server, generate a key, and turn passwords off before anything else touches the network. The order matters more than any individual step. https://letshost.blkleg.app/articles/a-heros-journey https://letshost.blkleg.app/articles/a-heros-journey Tue, 01 Sep 2026 12:00:00 GMT Laid off from Uber when the company went all-in on AI, and hired by GitHub thirty days later. What it took, and what I had already built without knowing why. https://letshost.blkleg.app/articles/the-docker-socket-is-root https://letshost.blkleg.app/articles/the-docker-socket-is-root Wed, 12 Aug 2026 12:00:00 GMT Mounting the Docker socket into a container hands that container the host. The read-only flag most compose files use does not change this, and the reason is a detail about what :ro actually applies to. https://letshost.blkleg.app/articles/cooldowns-and-lifecycle-scripts https://letshost.blkleg.app/articles/cooldowns-and-lifecycle-scripts Thu, 30 Jul 2026 12:00:00 GMT The defences that actually change the outcome of an npm supply-chain attack are unglamorous: do not run install scripts, do not install code published this morning, and do not let a stolen token publish anything. https://letshost.blkleg.app/articles/npm-worm-that-publishes-itself https://letshost.blkleg.app/articles/npm-worm-that-publishes-itself Sun, 14 Jun 2026 12:00:00 GMT Shai-Hulud steals a maintainer's npm token, uses it to republish every package that maintainer owns, and repeats. No operator, no command server, no human in the loop after the first compromise. https://letshost.blkleg.app/articles/quorum-is-a-voting-problem https://letshost.blkleg.app/articles/quorum-is-a-voting-problem Sat, 09 May 2026 12:00:00 GMT A two-node Proxmox cluster is not a smaller three-node cluster. It is a cluster that stops working the moment either node reboots, and the reason is arithmetic rather than configuration. https://letshost.blkleg.app/articles/one-maintainer-two-billion-installs https://letshost.blkleg.app/articles/one-maintainer-two-billion-installs Wed, 22 Apr 2026 12:00:00 GMT In September 2025 a phishing email to a single npm maintainer put malicious code into eighteen packages downloaded 2.6 billion times a week. The interesting part is not the phish. It is how ordinary it was.