Read
Articles
Every essay published here, newest first.
Multi-Layered Hardening for Kubernetes: Why Each Layer Has to Be Tested on Its Own Terms
A hardened Kubernetes cluster is not the sum of six checklists completed once. It is six layers that each need to be tested on their own terms, because none of them defends the others.
17 Sep 2026 · 7 min read
Observability Isn't the Same Thing as Logging
Logging tells you what a system said about itself. Observability is being able to ask a question you didn't anticipate and still get an answer.
8 Sep 2026 · 4 min read
The Security Control That Worked Too Well
Effectiveness and accountability are not the same property. A control can have both, or either, or neither, and the failure mode of 'either' is easy to miss.
24 Aug 2026 · 3 min read
Cloud Firewall Logs Everything, Except What It Drops
Closing out ten months of testing Alibaba Cloud with the same question the series opened on: a control that stops something is not automatically a control that tells you about it.
11 Aug 2026 · 5 min read
When Prevention Isn't Detection
Most security stacks conflate 'we stopped it' with 'we understood it.' The gap between those two claims is where the expensive incidents live.
20 Jul 2026 · 3 min read
Elastic GPU Service Is Elastic Until You Actually Need It to Be
Elasticity is a claim about behavior under contention, not behavior under normal conditions. Most of us only ever test the second one.
14 Jul 2026 · 4 min read
The Castle Was Never the Problem
The castle-and-moat model isn't wrong because perimeters are useless. It's wrong because it teaches you to stop asking questions the moment something is denied entry.
22 Jun 2026 · 4 min read
I Gave an AI Agent Real Alibaba Cloud Credentials. Here's What It Did.
Agentic AI tools are increasingly given direct cloud access to get things done. The interesting risk isn't that they'll refuse the task. It's what they'll do in service of completing it.
9 Jun 2026 · 5 min read
I Thought Security Meant Blocking the Attack
The first thing I had to unlearn about infrastructure security wasn't a technique. It was what 'working' meant.
1 Jun 2026 · 4 min read
Anti-DDoS Basic Is a Default, Not a Defense
Free, built-in DDoS protection sounds like a solved problem until you find the specific number where it stops being free protection and starts being a decision you need to make.
6 May 2026 · 4 min read
An OSS Bucket Set to 'Private' Isn't Always Private
Public bucket exposure is one of the oldest cloud misconfiguration classes there is. Testing it directly on OSS showed exactly how a bucket set to private can still leak individual objects.
8 Apr 2026 · 4 min read
ACK Removes the Cluster You Manage. Not the One You're Responsible For.
Moving to Alibaba Cloud's managed Kubernetes service removed a real category of operational burden. It removed none of the security decisions that actually determine whether a cluster is safe.
10 Mar 2026 · 4 min read
The Model You Deployed on PAI Is Not the Model You Trained
It's comforting to think of deployment as a copy operation. Testing that assumption on Alibaba Cloud's PAI platform turned up a measurable gap between training-time and serving-time behavior.
11 Feb 2026 · 4 min read
A Security Group Is Not a Firewall, Even Though Alibaba Cloud Lets You Pretend It Is
It's tempting to treat an ECS security group as 'the firewall' for a workload. That framing quietly drops the parts of the traffic path a security group was never designed to see.
14 Jan 2026 · 4 min read
What ActionTrail Actually Records When Something Goes Wrong
Turning on ActionTrail feels like turning on visibility. It's closer to turning on one particular kind of visibility, with real gaps that only show up when you go looking for them.
10 Dec 2025 · 4 min read
RAM Policies Look Like RBAC. They Don't Behave Like It.
RAM and RBAC both use roles and policies. That surface similarity hides a structural difference that changes how a permission mistake actually plays out.
12 Nov 2025 · 4 min read