Rules added with iptables directly are gone after a restart, which is how a database port ends up open on a machine that was firewalled last Tuesday. UFW…
The header is one line. The work is finding out what it will break — which means report-only for weeks, and reading violations that are mostly not your…
Six applications with six database users means six sets of grants maintained by hand, and the reporting tool ends up with write access because copying an existing user…
7.2 removed mcrypt and added libsodium to core in the same release, which is a clearer statement of intent than any deprecation notice. The API is deliberately small…
Every conversation about personal data stalls in the same place: nobody can say which tables hold it. The inventory is not documentation produced at the end, it is…
1.3 was finalised in August, and its cipher suites are configured separately from 1.2’s — so a hardened ssl_ciphers line copied from a 2016 guide silently governs only…
7.2 added Argon2i to password_hash, and the useful detail is that it did not change the default. Code that passes PASSWORD_DEFAULT still gets bcrypt, deliberately, because the default…
permission_callback was optional until recently and defaulting it to __return_true is the same as having no authorisation at all, which is how endpoints intended for the admin end…