Writing
Notes on security, data, and building for the long term.
A mix of long-form essays published here, and shorter field notes from blog.farrosfr.com.
Long-form
Essays
May 22, 2026 · 7 min
Building for the long term when every dependency wants to break
Why I default to static-first architectures, small dependency trees, and a bias for boring tools, and what changes when you build a web product that has to survive five years of someone else's decisions.
web
Apr 8, 2026 · 9 min
Practical red-team notes: what offensive work taught me about defensive defaults
Field notes from running offensive security exercises on web applications I have also built, and the small defensive defaults that survive contact with a real attacker mindset.
security
Feb 14, 2026 · 8 min
Data engineering without a team: what one person can realistically own
An honest accounting of what a single data engineer can keep running well, what has to be deferred, and the smallest possible stack that survives a 90-day vacation.
data
Archive
Field notes from blog.farrosfr.com
Showing all 50 articles
AOC 25 Days 14-18: Docker, Web DFIR, & Registry Hives
Escape Docker containers via UNIX sockets, triage Apache web attacks in Splunk, parse Windows registry hives, solve CyberChef locks, and deobfuscate C2 scripts.
AOC 25 Days 9-13: Hashcat, Sentinel, XSS, & YARA
Crack encrypted PDF/ZIP archives, triage Linux privilege escalation in Microsoft Sentinel, exploit reflected/stored XSS, inspect phishing, and run YARA rules.
AOC 25 Days 4-8: AI, IDOR, Malware Sandbox, & Nmap
Junior PenTester: Web Recon and Server Exploitation Guide
Manual browser inspection, OSINT and Gobuster discovery, Linux server hardening flaws, modern web stack CVEs, and IIS WebDAV shell execution.
Junior PenTester: Complete Nmap Network Scanning Guide
Complete 4-in-1 guide to Nmap: Live host discovery, basic and advanced port scans, OS fingerprinting, and the Nmap Scripting Engine (NSE).
Fix Firefox Dev Edition Sign-Out Loop on Shutdown
Quick fix for Firefox Developer Edition constantly logging out and disabling Sync after every browser shutdown.
Junior PenTester: Network Recon & Protocol Exploitation
Complete 4-in-1 guide to Jr PenTester network fundamentals: Passive OSINT, Active Probing, Cleartext State Machines, and Network Sniffing & TLS.
Report Writing for SOC L2 | study notes
Complete study notes for Report Writing for SOC L2. Master executive summaries, DFIR handover notes, and client incident reporting.
SOC L2 Alert Triage | study notes
Complete study notes for the SOC L2 Alert Triage room. Learn advanced SOC level 2 incident investigation and alert analysis.
Man vs. Himself | Chapter 1
Do your best today, do better tomorrow
Complimentary | study notes
Complete study notes for the Complimentary room. Uncover AWS Cognito IAM misconfigurations and extract guest records from DynamoDB.
Packed Light | study notes
Complete study notes for Packed Light room. Analyze network PCAPs, decode covert HTTP traffic, and reassemble exfiltrated data.
Room 404 | study notes
study notes for Room 404 room. Discover an exposed .git directory via web enumeration, dump the repository, and extract the hidden flag.
The Concierge Knows Too Much | study notes
study notes for The Concierge Knows Too Much room. Bypass VERA's AI prompt guardrails using persona impersonation to extract the escalation flag.
Intro to Cloud Security | study notes
OWASP API Security Top 10 - 1 | study notes
Virtualization and Containers | study notes
study notes for Virtualization and Containers room. Learn bare-metal and hosted hypervisors, Docker containers, and Kubernetes orchestration.
Network Security Protocols | study notes
Complete study notes for Network Security Protocols room. Learn about secure network protocols at the different layers of the OSI model.
Network Device Hardening | study notes
A complete study notes for the Network Device Hardening room, showing how to secure VPNs, routers, switches, firewalls, and logging.
Active Directory Hardening | study notes
A complete study notes and study notes for the Active Directory Hardening room, focusing on securing AD environments and domain controllers.
How I Contributed to Astro Core: Fixing Cryptic Zod CSP Errors
How I improved Content Security Policy validation in Astro by refactoring Zod schemas and custom error mapping.
Stop Letting AI Guess Your Requirements: The Grill-Me Paradigm
Why Socratic interrogations through the Grill-Me skill are essential to align developer plans, prevent agent assumptions, and write better code.
Boredom by Design: Why Staring at a Wall Requires a Clean Mind
My experience with the 10-minute wall-staring method, and why mental visual clarity and self-control are essential to unlocking deep, productive focus.
Strava API Changes: The Death of the Free Developer Tier
My experience integrating the Strava API in my Threads Watermark app, and how Strava's 2026 subscription mandate broke free-tier API access.
How I Added Affixed Capture Support to Axum's Typed Paths
How I contributed to tokio-rs/axum to support prefixed and suffixed typed path captures like /@{username} and /files/{name}.json.
Microsoft Windows Hardening | study notes
Complete study notes for the Microsoft Windows Hardening room. Learn how to secure and harden Windows 10 OS configurations.
Building a Full-Stack App on Cloudflare's Free Tier with Astro SSR
A practical guide to building and deploying a full-stack web app using Cloudflare Workers, D1 database, KV storage, and Astro SSR. Completely free.
Linux System Hardening | study notes
Complete study notes for Linux System Hardening room. Learn how to improve the security posture of your Linux systems.
Solar PV Monitoring Networks: Troubleshooting Routing and Subnets
A comprehensive guide on network architecture, troubleshooting subnets, routing gateways, and DNS settings for industrial solar PV loggers.
Become a Defender | study notes
Complete study notes for Become a Defender room. Explore defensive security, cyber infrastructure, and how to protect systems from attacks.
Cryptography Concepts | study notes
Complete study notes for Cryptography Concepts room. This room provides an understanding of cryptography in our everyday digital encounters.
JavaScript: Simple Demo | study notes
Complete study notes for JavaScript: Simple Demo room. Explore what a basic JavaScript program looks like.
The CIA Triad | study notes
Complete study notes for The CIA Triad room. Understand the CIA Triad and how it shapes cyber security mindset.
Python: Simple Demo | study notes
Complete study notes for Python: Simple Demo room. Explore what a basic Python program looks like.
Windows CLI Basics | study notes
Complete study notes for Windows CLI Basics room. Explore what Windows CLI is, how to navigate, and interact with the system using Windows CLI.
Data Encoding | study notes
Complete study notes for Data Encoding room. Learn how computer encodes characters, from ASCII to Unicode's UTF.
Secure Network Architecture | study notes
Complete study notes for Secure Network Architecture room. Learn about and implement security best practices for network environments.
Building Custom ERP Superapps with Rust
An architectural look at building type-safe, high-performance custom ERP systems and superapps in Rust, and how they compare with Odoo and SAP.
Automating Meeting Minutes with Whisper and Python
A guide to setting up a local AI transcription pipeline and converting raw audio into structured Minutes of Meeting (MoM) documents.
Cloud Computing Fundamentals | study notes
study notes for the Cloud Computing Fundamentals room. Learn how cloud computing allows businesses to build, scale, and manage infrastructure.
Virtualisation Basics | study notes
study notes for the Virtualisation Basics room. Learn how virtualisation powers modern IT, improves efficiency, and isolates environments.
Penetration Testing Frameworks | study notes
Complete study notes for Penetration Testing Frameworks room. Explore the landscape of penetration testing frameworks.
Cyber Kill Chain | study notes
study notes for the Cyber Kill Chain room. Learn the seven stages of Lockheed Martin's framework for defending against cyber attacks.
CVE-2026-42945: Nginx Rift | study notes
study notes for CVE-2026-42945: Nginx Rift room. Exploit the NGINX rewrite module heap overflow RCE vulnerability.
UnIndexed | study notes
Complete study notes for UnIndexed room. An AI assistant was given access to everything. Nobody checked what everything included.
Lockdown | study notes
Complete study notes for Lockdown room. Secure the Bastion AI assistant by auditing and remediating configuration vulnerabilities.
Sensitive Information Disclosure | study notes
study notes for Sensitive Information Disclosure room. Learn how embeddings and weak access controls leak private data.
Data Poisoning in RAG Systems | study notes
study notes for Data Poisoning in RAG Systems room. Learn how data poisoning alters AI embeddings and retrieval results.
RAG Security Fundamentals | study notes
study notes for RAG Security Fundamentals room. Learn how RAG works and how attackers exploit retrieval and trust boundaries.
Securing AI Agents in CI/CD
How AI agents in development pipelines can be subverted via indirect prompt injection, and how to defend using runtime sandboxes and least-privilege APIs.