The FEDLIN Blog
Field notes on supply chain security, compliance frameworks, AI governance, web infrastructure, and critical systems.
Before the Algorithm: Where a Post-Quantum Plan Really Starts
The deadline lands and the instinct is to pick an algorithm. The plan actually starts a few phases earlier, and the hard part is the calls you make in the middle.
SPIFFE/SPIRE on OpenShift: Building the Workload Identity Plane Your Zero-Trust Model Is Missing
After locking down human and device access, pod-to-pod communication was still trust-the-network. SPIFFE/SPIRE closes that gap. Short-lived cryptographic identities, attested per-workload, chained under your existing Root CA.
Taking Inventory: You Can't Migrate the Cryptography You Can't See
A federal mandate now requires agencies to inventory the cryptography they're running, with acquisition rules written to reach the contractors who serve them — and mandate or not, you can't migrate what you can't see. My FIPS 140-3 rebuild gave me a validated floor but didn't tell me what was standing on it, so I built the tool that takes the inventory — a secret-safe capture of a live system's cryptography with the CNSA 2.0 judgment on top — against my own cluster first, then for the estates that look nothing like it. It's the first deliverable of FEDLIN's Post-Quantum Readiness service.
What the 2030 Federal Encryption Deadline Means for Your Contracts
A June 2026 executive order set hard 2030 and 2031 deadlines for moving federal systems to quantum-resistant cryptography — with acquisition rules written to pull in the contractors who serve them. In plain terms: what it means, the move to make now, and the first steps to get ahead.
Rebuilding for FIPS 140-3: The Foundation Under Post-Quantum
Turning FIPS 140-3 on disables every cryptographic algorithm that is not validated, so anything built on the rest stops. The engineering problem is raising the cryptographic floor while keeping the platform fully working. I ran that rebuild as an exercise on my own systems — here is what FIPS demands, and the pressures that make it the build target for regulated work.
Do You Need a Penetration Test?
Could a contractor-level account in your environment be the starting point for something worse? It's the question we commissioned a penetration test to ask — and the right question for your environment too.
LLM Guard on Kubernetes — Governing the Content Layer on OpenShift
The cluster governs what AI processes can reach. LLM Guard governs what passes through them — and deploying it changed how I think about agentic architecture.
AI Governance at the Infrastructure Layer on OpenShift
I recently cut over from K3s to OKD. Here's the decision that made every previous decision make sense.
Yes, Wi-Fi Technology Can Map Your House
The same signal that connects your devices can outline who's inside — without cameras.
The Gap Between the Gap Assessment and the Controls
CMMC Level 2 enforcement and enterprise SOC 2 requirements are producing a wave of gap assessments. The assessment is the deliverable. The compliance program is not. That's the structural gap most organizations don't see until the audit window opens.
Email Authentication: SPF, DKIM & DMARC
SPF defines authorized senders. DKIM provides a cryptographic signature. DMARC enforces policy when either check fails. Configuration sequence matters — here's what each record does and what each state produces.
One of the Four NIST PQC Algorithms Can Already Run on Your Infrastructure
If your infrastructure runs behind Cloudflare, you may be further along than you think — post-quantum encryption at the edge is on by default. The three signing algorithms are still open decisions: code signing pipelines, long-lived records, and bandwidth-constrained systems each map to a different algorithm, a different readiness level, and one with documented implementation risk that NSA's own guidance flags.
Anthropic's Mythos is Coming. Is your business ready?
Mythos autonomously discovers and chains zero-day vulnerabilities. The barrier to sophisticated exploitation has collapsed — and the pool of actors who can target your organization has expanded to match.
Flock Safety Cameras: Security Concerns in Mass Surveillance Infrastructure
Those blinking red lights—what they are, what researchers have documented, and why the security and privacy implications matter.
Cloudflare Fully Adopts Astro—So We Are Too
How the acquisition happened, what Cloudflare and Astro actually said, and why it matters when you run both stacks in tandem.
Anthropic, OpenAI, and the Government
A technologist and former AI doomer walks through the government–Anthropic–OpenAI standoff: what each side actually said, why the lines drawn matter, and what it signals for anyone paying attention.
Satellite Security: Why Orbiting Assets Are More Vulnerable Than You Think
With minimal equipment, attackers can intercept, track, and potentially compromise satellites running decades-old software.
The Great Windows Exodus: Why Zorin OS Is Winning the Desktop Migration
Windows 10 EOL, hardware lock-in, and telemetry concerns are driving users to Linux. Here's why Zorin OS is leading the charge.
How Araptus' PNPM Security Scanner Caught Malware in My Dependencies
Self-hosting Araptus' PNPM Supply Chain Security Scanner led to discovering protest-ware hiding in transitive dependencies—before it reached production.
CSP Nonces vs Hashes: Why We Use Cloudflare Workers for Dynamic Script Protection
Hash-based CSP breaks on every deploy. Here's how nonces solve that—and why edge computing makes it practical.
Your Security Headers Are Probably Failing. Here's How to Check (Free).
Why your security baseline stops enterprise deals—and how to fix it.
Threat Intelligence
Emerging threat vectors for frontier builders
Cryptography
Post-quantum, ML-KEM, SPHINCS+, and hybrid TLS
Agentic Systems
MCP server hardening and LLM context boundary controls
Infrastructure
Kubernetes, pipeline security, and hardened deployment
Subscribe to Security Insights
Get enterprise security tips, compliance guides, and best practices delivered to your inbox.
No spam, ever. Unsubscribe anytime.