Blog
Notes on security, farms and software
Posts on network security, Thai livestock farming, Farmeter and building software. Every post links its sources.
67 postsNewest first
Building software
RPC vs REST: what's the difference, and which should you use?
RPC calls a named procedure on a server; REST sends requests to resources through HTTP's uniform interface. A side-by-side comparison with gRPC and JSON-RPC examples, from Fielding, RFC 9110 and the specs.
Beginner10 min read
- API
- RPC
- REST
- gRPC
- JSON-RPC
- HTTP
Thai livestock
Thailand's beef herd in open data: 9.5 million head, 7 per farmer
The DLD register counted 9.5 million beef cattle in Thailand in 2025, about 7 per farmer. The tables, three market channels, and why weighing helps you sell.
Intermediate10 min read
- beef cattle
- DLD
- open data
- market channels
- smallholders
Network security
Patch order with CVSS, EPSS and KEV: severity is not risk
CVSS-B rates severity, EPSS the chance of exploitation within 30 days, KEV confirmed attacks. Six myths, BOD 26-04, and a triage order for firewalls and VPNs.
Advanced10 min read
- Vulnerability Management
- CVSS
- EPSS
- KEV
- SSVC
- Patching
Network security
How to read MITRE ATT&CK without treating it as a checklist
What MITRE ATT&CK is, how tactics, techniques and procedures fit, how to read a technique page, and how to use Navigator layers without chasing 100%.
Beginner9 min read
- MITRE ATT&CK
- D3FEND
- Detection engineering
- Threat intelligence
- SOC
Thai livestock
What is hemorrhagic septicemia in buffalo, and how do you prevent it?
Hemorrhagic septicemia is a fast, often fatal bacterial disease of cattle and buffalo. Signs, why it peaks in the rains, and Thailand's yearly vaccine.
Beginner8 min read
- hemorrhagic septicemia
- buffalo
- beef cattle
- vaccination
- rainy season
- DLD
Building software
WebSocket vs SSE vs polling: how each works and when to use it
Polling sends a new request each round, SSE holds one response open for server events, WebSocket upgrades to two-way frames. Reconnects, proxies and firewalls.
Intermediate9 min read
- WebSocket
- Server-Sent Events
- SSE
- Long Polling
- HTTP
- Reverse Proxy
- nginx
Farmeter guides
How to record treatments and vaccinations in Farmeter Buff
Record symptoms, diseases, treatments and vaccinations in Farmeter Buff step by step: dose, frequency, closing a case, and vaccinating many buffalo at once.
Beginner9 min read
- Farmeter Buff
- buffalo health
- treatment
- vaccination
- farm records
- how-to
Network security
Prompt injection: how one hidden email line hijacks an LLM agent
Walk a toy email assistant through an indirect prompt injection, map it to OWASP LLM01, NIST and MITRE ATLAS, and see which controls limit the damage.
Intermediate11 min read
- Prompt injection
- OWASP LLM Top 10
- AI security
- NIST AI 100-2
- MITRE ATLAS
- LLM agents
Network security
AI model security by lifecycle stage: poisoning, pickles, theft
A five-stage checklist for protecting AI models, from data poisoning and code-running pickle files to model theft, based on NIST, NCSC/CISA, OWASP and ATLAS.
Advanced11 min read
- AI Security
- Machine Learning
- Supply Chain
- NIST AI RMF
- OWASP
- MITRE ATLAS
Network security
NAT, PAT and port forwarding: how does each one rewrite a packet?
Static NAT maps one to one, dynamic NAT uses a pool, PAT shares one address by rewriting ports, and port forwarding is destination NAT. Shown with NAT tables.
Beginner8 min read
- NAT
- PAT
- NAPT
- Port Forwarding
- Destination NAT
- PAN-OS
- nftables
Network security
Phishing-resistant MFA: why passkeys beat codes and push prompts
One-time codes and push prompts can still be phished or fatigued. How FIDO2/WebAuthn passkeys bind sign-in to the real domain, and synced vs device-bound.
Beginner9 min read
- MFA
- passkeys
- WebAuthn
- FIDO2
- phishing
- identity
Farmeter guides
Set up herds and add buffalo in Farmeter Buff
Create herds, then add each buffalo with its tag number, sex, birth date and parents in Farmeter Buff, with a 10-step checklist for a clean setup.
Beginner10 min read
- Farmeter Buff
- herd setup
- tag number
- sire and dam
- animal records
- checklist
Farmeter guides
How to invite farm members in Farmeter Buff
Create an invitation QR or code in Farmeter Buff, approve join requests, remove members, and fix the join errors workers hit most often.
Intermediate9 min read
- Farmeter Buff
- farm members
- invitations
- QR code
- troubleshooting
Thai livestock
Foot-and-mouth disease in cattle and buffalo: 5 myths checked
FMD rarely kills adult cattle or buffalo, but it costs weight, calves and sales. Five beliefs checked against WOAH and Thai DLD sources, with what to do.
Beginner9 min read
- FMD
- foot-and-mouth disease
- buffalo
- beef cattle
- vaccination
- biosecurity
- DLD
Farmeter guides
How to install Farmeter Buff and set up your farm
Install Farmeter Buff, sign in with an SMS code, choose your role and register your farm, step by step, with each button named as it appears in the app.
Beginner9 min read
- Farmeter Buff
- getting started
- install
- sign in
- OTP
- farm setup
Network security
How SSL decryption on a firewall works, and what not to decrypt
Forward proxy and inbound inspection step by step, why clients trust the firewall's CA, what can't or shouldn't be decrypted, and what TLS 1.3 changes.
Advanced10 min read
- SSL Decryption
- TLS Inspection
- Firewalls
- PAN-OS
- FortiGate
- Cisco Secure Firewall
- TLS 1.3
Farmeter guides
View and print a buffalo pedigree in Farmeter Buff
Farmeter Buff builds a three-generation buffalo pedigree from sire, dam and breeding records. A tour of the in-app tree and the printable A4 report.
Advanced9 min read
- Farmeter Buff
- pedigree
- breeding records
- certificate
- buffalo
Farmeter guides
How to read the analytics page in Farmeter Buff
The Farmeter Buff analytics page has a date range, a buffalo status filter and six tabs. What each card counts, and what you can decide with it.
Beginner7 min read
- Farmeter Buff
- analytics
- dashboard
- health
- team
- how-to
Farmeter guides
How to view member farms in Farmeter Cooperative
Farmeter Cooperative is the web portal co-ops use to see member farms in one place: getting access, the dashboards, linking farms and what farmers see.
Intermediate10 min read
- Farmeter Cooperative
- cooperatives
- dashboard
- Farmeter Buff
- Farmeter Beef
- farm network
Farmeter guides
Log a buffalo's breeding cycle in Farmeter Buff
Record heat, breeding, pregnancy checks, calving and weaning for a buffalo cow in Farmeter Buff, and see how each record sets up the next step.
Intermediate7 min read
- Farmeter Buff
- breeding records
- pregnancy check
- calving
- weaning
- buffalo
Farmeter guides
How to run a weighing day in Farmeter Buff
Record weight, heart girth, body length and height for a whole buffalo herd in Farmeter Buff, then read the growth trend, box plot and Scoreboard.
Intermediate9 min read
- Farmeter Buff
- growth
- weight
- heart girth
- analytics
- buffalo
Farmeter guides
Tracking farm income and expenses in Farmeter Buff
How to record a sale or a cost in Farmeter Buff's income and expense tracker, what Balance really means, who can see it, and the Analytics charts.
Beginner8 min read
- Farmeter Buff
- income and expenses
- farm records
- how-to
- FAQ
Farmeter guides
What to record in Farmeter Buff, and when
Follow one made-up buffalo farm through a year in Farmeter Buff, from calving and heat checks to weighing, weaning and sales, to see when each record matters.
Beginner11 min read
- Farmeter Buff
- farm year
- calving
- breeding
- weaning
- vaccination
- buffalo
Building software
How do OAuth 2.0 and OpenID Connect differ?
OAuth 2.0 gets an app an access token to call an API; OpenID Connect adds an ID token that says who signed in. The code flow with PKCE, request by request.
Intermediate7 min read
- OAuth 2.0
- OpenID Connect
- PKCE
- Authentication
- Authorization
- Tokens
Network security
How SIEM and SOAR fit together: logs, alerts and playbooks
A SIEM collects, normalises and correlates logs into alerts; SOAR runs playbooks on them. Covers priority logs and Sigma rules, per NIST and ASD/CISA guidance.
Beginner10 min read
- SIEM
- SOAR
- logging
- detection
- Sigma
- CISA
- NIST
Thai livestock
Why Thailand has a buffalo day, and the bank that lends buffalo
Thai Buffalo Conservation Day on 14 May recalls the first royal directive on the buffalo bank. How tillers cut herd numbers and how the bank lends animals.
Beginner9 min read
- swamp buffalo
- buffalo bank
- Thai Buffalo Conservation Day
- history
- mechanisation
- DLD
Network security
How a phishing email gets past SPF, DKIM and DMARC
One fictional phishing email, checked by SPF, DKIM and DMARC: what each verifies, why p=none and look-alike domains let it through, and what to do if you click.
Beginner8 min read
- Phishing
- Email security
- SPF
- DKIM
- DMARC
- MITRE ATT&CK
Thai livestock
How do you score body condition (BCS) in beef cattle?
Body condition score rates a cow's fat reserves on a 1 to 9 scale. Where to look and feel, and the scores cows should reach at calving and breeding.
Beginner8 min read
- body condition score
- BCS
- beef cattle
- cows
- reproduction
- feeding
Network security
What a firewall sees in a TLS 1.3 handshake, message by message
Walk a TLS 1.3 handshake in Wireshark from ClientHello to Finished: why SNI stays visible, the certificate does not, and 0-RTT can be replayed.
Intermediate11 min read
- TLS
- TLS 1.3
- Decryption
- Firewalls
- Wireshark
- Cryptography
Network security
What DNSSEC, DoH and DoT protect, and what's left for your logs
DNSSEC proves a DNS answer wasn't forged, DoT and DoH encrypt the hop to your resolver, and logs plus protective DNS help you spot DNS tunnels.
Intermediate10 min read
- DNS
- DNSSEC
- DoH
- DoT
- Protective DNS
- Threat Detection
Thai livestock
When should you deworm cattle and buffalo?
The DLD deworming schedule for cattle and buffalo, from calves at 3 weeks to twice a year for older stock, the liver fluke months, and dewormer resistance.
Beginner7 min read
- deworming
- liver fluke
- roundworms
- buffalo
- beef cattle
- calves
- DLD
Network security
SD-WAN vs SASE: path selection and cloud-delivered inspection
SD-WAN measures each link and moves flows to the path that meets the SLA; SASE moves SWG, FWaaS, CASB and ZTNA into cloud PoPs. Based on NIST SP 800-215.
Intermediate9 min read
- SD-WAN
- SASE
- ZTNA
- SWG
- CASB
- FWaaS
- Prisma Access
- Zscaler
- NIST
- network design
Building software
How do Docker and Kubernetes differ, and when do you need Kubernetes?
Docker builds images and runs containers on one host. Kubernetes runs them across many nodes, schedules Pods, keeps replica counts and exposes Services.
Beginner5 min read
- Docker
- Kubernetes
- Containers
- Docker Compose
- OCI
- DevOps
Thai livestock
How to grow Napier Pakchong 1: cutting age, feeding and silage
Plant, cut, feed and ensile Napier Pakchong 1 the way the Thai DLD manual says, and why cutting age trades protein against bulk and fibre for your cattle.
Beginner10 min read
- napier grass
- pakchong 1
- forage
- silage
- beef cattle
- buffalo
- feed
Building software
What is a database index, and why is my query slow?
An index is a separate structure that lets PostgreSQL find rows without reading the whole table. B-trees, Seq Scan vs Index Scan, EXPLAIN ANALYZE, write costs.
Intermediate10 min read
- PostgreSQL
- Database
- Index
- B-tree
- EXPLAIN
- Query Performance
Network security
NIST SP 800-61r3 incident response: a phase-by-phase checklist
NIST SP 800-61r3 recasts incident response as a CSF 2.0 profile. What changed from r2, plus the questions to ask before, during and after an incident.
Intermediate11 min read
- Incident Response
- NIST
- CSF 2.0
- CISA
- Checklist
Network security
Zero trust explained: what NIST SP 800-207 actually asks for
Zero trust is a set of principles, not a product. NIST SP 800-207's seven tenets, the PE/PA/PEP decision loop and CISA's maturity model, in plain terms.
Beginner9 min read
- zero trust
- NIST
- CISA
- identity
- MFA
- architecture
Thai livestock
Registering a Thai beef farm, then moving up to GFM and GAP
Register with Thailand's DLD at no fee, add GFM biosecurity, then certify under GAP (TAS 6400-2555). What each step checks, with checklists.
Intermediate10 min read
- beef cattle
- farm registration
- GFM
- GAP
- DLD
- ACFS
- standards
Network security
Volumetric, protocol and application DDoS: where each is stopped
Volumetric, protocol and application-layer DDoS exhaust different resources, so the ISP, the firewall and the app each stop a different one.
Intermediate7 min read
- DDoS
- SYN Flood
- Amplification
- Reflection
- Firewall
- CISA
- RFC 4987
Network security
Change windows: write and test the rollback before you start
A before, during and after checklist for firewall changes: written go/no-go checkpoints, config snapshots and a tested rollback, mapped to NIST SP 800-128.
Intermediate9 min read
- Change Management
- Rollback
- Firewalls
- NIST
- SRE
- Checklist
Network security
Inside a firewall HA failover: heartbeats, session sync, failback
How Palo Alto, FortiGate and Cisco FTD pairs detect a failure, sync sessions, move the virtual MAC and fail back, and how to test it safely.
Advanced12 min read
- High Availability
- Firewalls
- Palo Alto
- FortiGate
- Cisco FTD
- VRRP
- Change Management
Farmeter guides
Get Farmeter reminders in LINE with Jao Boonmee
Link your LINE account to Farmeter Buff through Jao Boonmee to get a daily task summary, pregnancy checks, due dates and weaning days in chat.
Beginner9 min read
- Farmeter Buff
- LINE
- reminders
- Jao Boonmee
- how-to
Network security
PAN-OS packet flow: six stages and up to three policy checks
The six stages of PAN-OS packet flow, from ingress through session setup and App-ID to egress, and why security policy can be checked up to three times.
Intermediate6 min read
- Palo Alto
- PAN-OS
- Firewalls
Thai livestock
Why small beef farms should weigh their cattle every month
Middlemen often price cattle by eye. What to record for each animal, how to weigh without your own scale, and how to check an offer against your numbers.
Beginner10 min read
- beef cattle
- record keeping
- weighing
- heart girth
- GAP
- selling cattle
Network security
IDS vs IPS: what's the difference between detecting and blocking?
An IDS gets a copy of traffic and can only alert; an IPS sits in the path and can drop. Detection methods, false positives and fail-open, per NIST SP 800-94.
Beginner7 min read
- IDS
- IPS
- NIST
- Suricata
- Snort
- Network Security
Network security
What you still own in the cloud: the shared responsibility model
How AWS, Microsoft and Google Cloud split security duties across IaaS, PaaS and SaaS, and why identity, data and configuration always stay with you.
Beginner9 min read
- cloud
- shared responsibility
- IaaS
- PaaS
- SaaS
- IAM
- logging
- misconfiguration
Building software
JWT or session cookies: which should you use?
A session cookie keeps state on the server; a JWT carries signed claims. Compared on revocation, browser storage, XSS, CSRF and the cookie attributes to set.
Intermediate7 min read
- JWT
- Cookies
- Sessions
- XSS
- CSRF
- Web Security
Thai livestock
How Thailand got lumpy skin disease under control after 2021
Lumpy skin disease sickened over 627,000 Thai cattle and buffalo in 2021. How biting insects spread it, how vaccination curbed it, and 5 habits for small farms.
Intermediate10 min read
- lumpy skin disease
- LSD
- beef cattle
- vaccination
- biosecurity
- DLD
Network security
Find a port scan and a password spray in firewall and auth logs
Practise on synthetic logs: read syslog and PAN-OS traffic fields, find a port scan and a password spray (event 4625), then link them by time and source.
Intermediate12 min read
- Logging
- Firewall Logs
- Windows Event 4625
- Port Scan
- Password Spraying
- MITRE ATT&CK
- NIST SP 800-92
Network security
How do you review firewall rules, and which ones should go?
A firewall rule review checklist: shadowed, redundant, any-any, unused, expired and ownerless rules, and how to remove them safely. Based on NIST SP 800-41.
Intermediate7 min read
- Firewall
- Firewall Rules
- Rule Review
- Hit Count
- Shadowed Rules
- NIST SP 800-41
- PAN-OS
- FortiGate
Network security
PAN-OS, Cisco FTD and FortiGate: how zones, NAT and HA differ
How PAN-OS, Cisco FTD and FortiGate handle zones, rule order, NAT versus policy, application identification and HA, with Huawei USG in brief.
Intermediate5 min read
- Firewalls
- Palo Alto
- Cisco
- Fortinet
Network security
6 password hashing myths, checked against OWASP and NIST
Store passwords with a slow, salted hash such as Argon2id, not SHA-256 or encryption. Six myths checked against OWASP, NIST SP 800-63B-4 and RFC 9106.
Advanced11 min read
- password hashing
- Argon2id
- bcrypt
- scrypt
- PBKDF2
- NIST
- OWASP
- salt
- pepper
Thai livestock
How cattle and buffalo movement permits work in Thailand
Taking cattle or buffalo to another Thai province needs a permit from the origin vet every time. What the law says, e-Movement, 48-hour validity, penalties.
Beginner10 min read
- movement permit
- e-Movement
- Animal Epidemics Act
- cattle
- buffalo
- DLD
Network security
What are 802.1X and NAC? What happens when you plug in a cable
802.1X keeps a switch port closed until a RADIUS server authenticates the device. EAPOL and RADIUS packet by packet, EAP-TLS vs PEAP, MAB and NAC posture.
Intermediate11 min read
- 802.1X
- NAC
- EAP
- EAPOL
- RADIUS
- EAP-TLS
- PEAP
- MAB
- Posture
Building software
How do offline-first apps keep working without a connection?
Offline-first apps write to a local database first and sync through a queue. One save step by step, plus retries and conflicts, from Android, Flutter and MDN.
Intermediate9 min read
- offline-first
- sync
- IndexedDB
- Service Worker
- WorkManager
- Flutter
- HTTP
Thai livestock
Thai native vs crossbred beef cattle: heat, feed and buyers
Thai native cattle handle heat and poor feed but grow slowly. European-blood crosses grow fast but eat far more concentrate. Size, feed and markets compared.
Intermediate10 min read
- beef cattle
- Thai native cattle
- crossbreds
- Brahman
- breed choice
- feed
Network security
Five network segmentation myths, checked against CISA and NIST
VLANs alone are not segmentation. Five common myths checked against CISA, NIST and MITRE guidance, plus a default-deny rollout and ways to test it.
Beginner10 min read
- network segmentation
- microsegmentation
- zero trust
- lateral movement
- MITRE ATT&CK
- CISA
- NIST
- firewalls
Thai livestock
How do you make urea-treated rice straw, and how much does it help?
The Thai DLD recipe for urea-treated rice straw (100 kg straw, 5 kg urea, 100 L water, 21 days), what it does to protein and digestibility, and the urea risks.
Beginner8 min read
- urea-treated straw
- rice straw
- roughage
- urea
- beef cattle
- buffalo
- dry season
Network security
Inside IKEv2: bringing up an IPsec tunnel one exchange at a time
Walk through IKE_SA_INIT, IKE_AUTH, Child SAs and ESP on a site-to-site IPsec tunnel, then a 7-step checklist for when the tunnel won't come up.
Advanced15 min read
- IPsec
- IKEv2
- VPN
- ESP
- Troubleshooting
- Firewalls
Thai livestock
Swamp buffalo breeding: catching quiet heats and planning calving
Swamp buffalo heats last about 20 hours and often show few signs. How to spot them, when to inseminate, and a 321-day calendar from mating to calving.
Intermediate11 min read
- swamp buffalo
- breeding
- heat detection
- artificial insemination
- gestation
- record keeping
Network security
How ransomware gets in: six entry routes and what stops each
Ransomware gets in through exposed services, stolen credentials, phishing, earlier malware and third parties. Each route with fixes from CISA's guide.
Beginner7 min read
- Ransomware
- Initial Access
- MITRE ATT&CK
- CISA
- Phishing
- RDP
- Backup
Network security
Spotting lateral movement in Windows logs and east-west traffic
Which Windows logon events (4624, 4625, 4648, 4672) and east-west traffic patterns reveal lateral movement, and how segmentation, LAPS and tiering contain it.
Advanced16 min read
- lateral movement
- MITRE ATT&CK
- Windows event logs
- detection engineering
- Windows LAPS
- tiered administration
- network segmentation
- SIEM
Network security
Scrub secrets from network configs before you share them
Where passwords, keys, SNMP communities and tokens hide in config backups and repos, how to redact them, and why you rotate before you clean up history.
Intermediate11 min read
- secrets management
- credentials
- sanitising
- config backups
- gitleaks
- GitHub secret scanning
- OWASP
- MITRE ATT&CK
- CWE-798
Network security
How STIX 2.1 and TAXII 2.1 make threat intel machine-readable
Build a STIX 2.1 bundle step by step, see how TAXII 2.1 moves it, and why the Pyramid of Pain says behaviour-level intel costs attackers more than IPs.
Advanced11 min read
- Threat intelligence
- STIX
- TAXII
- Pyramid of Pain
- MISP
- SIEM
- Firewalls
Building software
How do HTTP/1.1, HTTP/2 and HTTP/3 differ?
All three share the semantics in RFC 9110. HTTP/1.1 sends text over TCP, HTTP/2 sends binary frames over one TCP connection, HTTP/3 runs on QUIC over UDP.
Intermediate9 min read
- HTTP
- HTTP/2
- HTTP/3
- QUIC
- TCP
- TLS
- Firewalls
Thai livestock
How to calculate THI and read heat stress in cattle
THI turns temperature and humidity into one heat-stress number for cattle: a worked example, Thai weather data and the drop in beef pregnancy rates.
Advanced12 min read
- heat stress
- THI
- beef cattle
- reproduction
- timed AI
- weather
Network security
Log4Shell in hindsight: what firewalls could and couldn't stop
How CVE-2021-44228 spread in December 2021, why egress filtering could stop its second stage, and where IPS signatures and network controls fell short.
Advanced5 min read
- Vulnerabilities
- Log4Shell
- CISA