Posts

The Claim Under Test If your password and your TOTP seed live in the same 1Password vault, unlocked by the same master password, you are running two-step verification (2SV), not multi-factor authentication (MFA). Same secret store, same unlock event, same attacker who now has both factors the moment they get one. This isn’t a hot take. It’s already worked out, published, and ignored, largely because PCI DSS Requirement 8.3 only mandates two factors from two categories, not factor independence or phishing resistance, and most cyber insurance underwriting still treats SMS OTP as an acceptable floor for standard users, even as carriers increasingly downgrade or reject it for privileged accounts. It’s really the same reason why faxing in the USA is considered acceptable for patient health data: HIPAA’s Security Rule requires reasonable and appropriate administrative, technical, and physical safeguards for transmitting e-PHI, not a specific transmission technology, so fax was never excluded and never got re-evaluated once better options existed. Not because either is safe or secure: because it’s legacy knowledge enshrined in permanance. The compliance bar and the security bar diverged years ago for MFA and 2SV; the industry kept building to the compliance bar. ...

The Problem: Selective Network Outages Over Tailscale When users reported that database access through a Tailscale exit node was failing while RDP connections remained functional, the initial symptoms suggested a routing or firewall issue. However, the real culprit was much more subtle: DNS resolution was being silently dropped at the exit node level. Why This Setup Exists at All: Azure Private Link Resolves Differently Depending on Where You’re Standing Before getting into the dnsmasq “bug” itself, it’s worth explaining why this infrastructure exists in the first place, because the root problem isn’t Tailscale or dnsmasq, it’s that Azure Private Link’s DNS behavior is context-dependent, and a VPN mesh network doesn’t naturally live in any single context. ...

SREs split into two camps, and neither one is fully right. The first camp matured out of operational IT. They’ve lived through a bad patch Tuesday, a driver update that bricked a fleet, a vendor hotfix that took down a cluster. Their instinct: let a patch cycle pass before you touch it. Let someone else find the landmine. This dates me, but is the world I learned in myself. The second camp never did operational IT work. They came up through cloud-native, IaC, CI/CD. They don’t have the scar tissue, but they inherit the doctrine anyway, because the first camp is louder and… has tenure. ...

The Problem: Conflicting MFA Configurations When your organization has both per-user Multi-Factor Authentication (MFA) and Conditional Access (CA) policies enabled simultaneously, per-user MFA takes precedence. This creates a cascading problem: users face excessive MFA prompts, support tickets increase, and your security posture becomes difficult to audit and control centrally. In one organization with ~200 users on per-user MFA and ~400 users on CA policies, this conflict was creating unnecessary friction and made it difficult to implement granular access controls based on risk and resource sensitivity. ...

This documents how our Terraform CI/CD pipeline is set up in GitHub Actions: specifically the auth model, the state backend, the two-file workflow structure, and how I close the loop on post-merge apply results showing up on the PR that triggered them. The Two-File Workflow Structure The pipeline is split into two files: a thin caller and a reusable template. terraform.yml — the caller. It defines the triggers and hands off to the template: ...