SudoSecurity

Self Hosting

Zero-Trust Access for Homelabbers: Teleport vs. Tailscale vs. WireGuard vs. Cloudflare Tunnel

Four tools solve four different problems that all get pitched as the same problem. Here's what each one does, where each one breaks, and the combination that covers a real homelab without paying an SSO tax you didn't see coming.

Self Hosting

The SSO Tax: Why Self-Hosted Projects Are Gating Login Behind a Paywall

A growing list of open-core self-hosted projects, from Grafana to Planka, gate single sign-on behind an Enterprise tier. Here's which protocol actually gets paywalled, and what to check before you deploy.

Artificial intelligence

An AI Store Manager Just Recommended Firing a Human Employee

Andon Labs' AI agent Luna runs a real San Francisco store with real employees, and it just recommended terminating one of them. The headline undersells what actually happened, and what it doesn't prove.

Forum Archaeology

phpBB vs. SMF vs. MyBB: Three Very Different Fates

Forum Archaeology #2. Three free PHP forum platforms started from the same premise a generation ago. One got hit with a CVSS 9.8 authentication bypass this June. One had eleven CVEs last year. One has stayed almost quiet. Same premise, three completely different fates.

Self Hosting Featured

What Self-Hosters Are Ripping Out of Their Stacks in 2026

Self-hosted email is losing to Gmail's hard SMTP rejections. Self-hosted password managers are split down the middle. And self-hosted music is doing the opposite of what you'd expect.

Self Hosting

The .self TLD Is Real Now: ICANN Application Filed

A nonprofit founded in Colorado eight months ago wants to hand every self-hoster a free domain and put "surveillance capitalism" in its mission statement. That's the pitch behind .self, a proposed top-level domain from the Human-Centered Computing Foundation, and as of this month

Cybersecurity

A Password-Free Path to Root: Inside the macOS Screen Sharing Vulnerability Now Under Attack

A logic bug in screensharingd let attackers skip authentication entirely and land as root — no password required. Here's how it was found, patched, reverse-engineered, and finally weaponized.

Programming

MSVC's August Preview Clears 40 Bug Reports and Preps ARM64 for LUTI2

The August 2026 MSVC Build Tools Preview fixes 40 reported compiler bugs and adds real ARM64 codegen work, including Armv9.2 LUTI2 lookup-table support. It targets Visual Studio 2026 v14.52 and ships through both the Stable and Insiders channels.

Cybersecurity Featured

Hacktivism, 2021 to Today: From Steel Mills to Power Grids

Part 1 ended on a 70-gigabyte breach in 2021. Since then, hacktivists derailed trains, dumped molten steel on camera, and reached grids in three countries.

Programming Featured

Minecraft Runs on One Thread Because Nobody Wrote It for Two

Every entity, every block update, every redstone pulse — one thread, twenty times a second, 50 milliseconds a pass. Folia's answer is to stop sharing the kitchen. Here is the tick budget and the ownership rules, read from the PaperMC source.

Self Hosting

Oracle Free Tier ARM Cutoff: What to Do Before Aug 18

Oracle halved its Always Free ARM allocation to 2 OCPU/12GB, enforced Aug 18, 2026. Here's the exact numbers, what's still ambiguous, and how to resize in time.

Programming

Python 3.15: Lazy Imports, Frozendict, and a Faster JIT

Python 3.15 release candidate: explicit lazy imports, the new frozendict and sentinel types, the Tachyon profiler, and real JIT benchmark numbers.

Web Development

PHP API Performance: N+1 Queries, cURL, and Connection Pools

A PHP API case study: fixing an N+1 query, twenty serial cURL calls, missing connection pooling, and stats recalculated on every request with Redis caching.

Self Hosting

Codeberg Bans Vibe-Coded Projects: What Actually Changed

Codeberg's members voted to prohibit vibe-coded repos over hosting costs, not code quality. Here's the actual vote, the reasoning, and the self-hosting community's reaction.

Programming

Twelve Years in the Making: JDK 28 Ships Value Classes Preview

A technical deep dive into the features shaping the next Java feature release, due March 2027 — including the twelve-year backstory behind its headline feature. JDK 28 is a non-LTS ("feature release") of the Java Platform, tracked as JSR 403 in the Java Community Process. It follows

Self Hosting

Cloudflare OS: Inside the Open-Source Agent Sandbox

Cloudflare open-sourced its internal AI workspace. A technical breakdown of Dynamic Workers, Gatekeepers, capability-based access, and what it takes to self-host it.

Web Development

Why Your PHPDoc Blocks Are Recipe Cards Nobody Can Use

A recipe card with blank ingredient fields is worse than no recipe card at all. Part 3 of the kitchen series covers PHPDoc, comments, and the documentation debt nobody notices until the person who understood it walks out the door.

Web Development

PHP OOP Explained Through a Real Kitchen Brigade System

Escoffier's brigade de cuisine solved the same problem PHP's class visibility solves: who gets to touch what, and who answers to whom. Part 2 of the kitchen series, and the one where we build something real.

Web Development

What a 1-Star Kitchen Taught Me About PHP Fundamentals

Before I ever touched PHP, I learned mise en place the hard way, on a line in a 1-star kitchen. Turns out variables, functions, and scope are the same discipline with a different uniform.

Claude AI

Anthropic's Mission Statement Is Doing a Lot of Work Lately

Dario Amodei is reportedly worried that his new hires don't believe in the mission. According to Axios, citing a source familiar with the matter, the Anthropic CEO has expressed concern that some recent hires at the company are joining for compensation rather than out of any deep commitment

AI Agents

Claude Opus 5 Force-Deleted a User's Entire File System After a Failed Backup

There's a specific kind of silence that happens right after you realize an AI agent just deleted everything you own. Not the polite "let me confirm before proceeding" kind of silence. The other kind. The kind where you're staring at a terminal that'

Forum Archaeology Featured

The Slow Death of vBulletin, and Why It Isn't Over

Forum Archaeology #1: I built plugins for this software when it ran half the internet's communities. Sixteen years after the exodus that should have killed it, vBulletin is still getting hit with critical, unauthenticated remote code execution.

Cybersecurity

Januscape: A 16-Year-Old Linux KVM Escape Bug

CVE-2026-53359 lets a guest VM crash or potentially root your Proxmox host, and it hid in KVM's shared code for 16 years. What to patch and how to check.

Cybersecurity

Minecraft Bedrock Server RCE: CVE-2026-55010

CVE-2026-55010 lets an attacker take over your Bedrock server with one packet, no login required. What it actually affects, and how to patch it today.

Self Hosting

What You Can Self-Host on Oracle Cloud Free Tier (2026)

What actually fits on Oracle Cloud free tier after the June 2026 cut: Ghost, Vaultwarden, Syncthing, monitoring, and a small AI model, sized in real RAM.