>_
nerdstuckathome

#security

Oct 23, 2026

CSP the hard way: what rolling it out at Workera taught me

A key customer asked for a strict Content Security Policy, with a deadline. We planned a month and it took four: removing inline code, chasing third-party vendors and teaching a new vocabulary to the whole engineering team.

Oct 7, 2026

I disabled SSH passwords. cloud-init disagreed.

On a fresh Ubuntu VPS, two drop-in files disagreed about PasswordAuthentication, and the one I didn't know about won. sshd's first-value-wins rule, and how to check what's really in effect.