ShieldedBytes

The “find … -delete” Catastrophe and How to Stop It

A single typo in a find command can wipe a production directory, a backup, or an entire filesystem. The classic recipe that trips even seasoned sysadmins is:

find / -name '*.tmp' -delete

If the leading slash is omitted or the pattern is too broad, the command starts at the wrong root and deletes everything that matches. In 2025, a handful of high‑profile incidents were traced back to this exact mistake, underscoring that defensive scripting is as much about guardrails as it is about automation.

Flickering isn’t just a visual nuisance; in a hardened environment it can hide real alerts, break scripts that poll the status line, or even leak timing info to an attacker. A recent upgrade that swapped in a new terminal renderer, patched a font, or tweaked an environment variable can push the status bar past the terminal’s refresh limits. Below is a practical, step‑by‑step walk‑through that covers the usual suspects, fixes you can apply immediately, and how to keep the bar steady without opening new attack vectors.

No. But the version of the WAF most organizations are running — a signature-matching appliance at the perimeter — is being bypassed in real time by actors who no longer need to be creative. They need to be persistent, and they need an API key.

This post looks at what “obsolete” actually means in 2026, using four specific incidents from the last five months and one academic paper that quantifies the problem.

For years, a web application firewall was mostly a large list of known-bad patterns. It was useful, but brittle. A new attack vector slipped through until someone wrote a signature, and legitimate traffic that happened to look like an old attack got blocked. The usual fix was more rules, more tuning, and more full-time WAF administration.

A different model is now in production at several major vendors. Instead of asking “does this request match a known attack?”, these systems ask “does this request look like it belongs here?” The answer comes from models that learn what normal traffic looks like for a specific application and flag deviations from that baseline.

Running a multi‑site reverse proxy on a Raspberry Pi is a classic hobby‑project. The Pi’s low power draw and cheap price make it a go‑to for hosting tiny web services, internal dashboards, or a personal API gateway. Throw TLS in there and you get confidentiality and integrity, but one small mis‑configuration can make every HTTPS request hang until the client gives up.

The usual culprit is the dance between SNI, OpenSSL’s default cipher selection, and the Pi’s limited CPU. Below I’ll walk through why this happens, how to spot it, and the practical tweaks that keep the Pi from blowing up the handshake.

On a busy home‑lab or a small office server, the first thing you notice when ping myapp.local suddenly fails is that systemd‑resolved has stopped resolving the name. The culprit is almost always a mis‑configured or stale entry in /etc/hosts. This post walks through a systematic hunt, shows how to keep the file tidy, and highlights security implications of host‑name resolution.

Why /etc/hosts still matters

systemd‑resolved reads /etc/hosts before querying DNS. It treats the file as a local override list, so any line that matches a query will short‑circuit DNS. That design is handy for internal services, but it also means that a stray duplicate or a typo can silently break name resolution for the whole system.

Persisting a Rootless Podman Home Assistant Without a Registry

Running Home Assistant in a rootless Podman container feels like a no‑frills, privilege‑minimal setup that sits comfortably in a homelab. The real pain point is making sure the image and its data stick around after a reboot when you don’t want to hit a Docker‑compatible registry. The trick is to treat a small part of the local filesystem as a “registry” and let Podman pull from it every time the system boots.

The Problem: Docker’s Verbose Journal Entries

When Docker runs on a modern Linux distro, every container start, stop, or health‑check event is logged by the Docker daemon (dockerd). Those logs are forwarded to systemd‑journal, which is great for auditability but can quickly flood the journal with repetitive, low‑value messages. On a busy host a single day of activity can generate several megabytes of journal data, making it hard to spot real issues and bumping disk usage.

Orphaned Swap Files on a 2 GB VPS – How to Spot, Clean, and Harden

A 2 GB VPS is a tight budget. Every megabyte counts, and swap files that never get freed can silently eat the space you need for logs, containers, or backups. This post walks through how to find those orphaned swap files, safely remove them, and set up a swap strategy that keeps the system lean and secure.

Silent NFS Export Leaks on Home NAS

Running a lightweight NFS server on a Raspberry Pi or a small Ubuntu Server is a common way to share media or backups.
The problem? A mis‑configured export table can let a client mount a directory that was never meant to be exposed. The server happily replies “yes”, so the admin might not notice until a log entry pops up or a backup job starts to fail.