Field Notes
Real work. Documented.
Step-by-step guides from actual homelab builds, production incidents, and hands-on implementations. Not what's hot online. Not theory crafting. The work that happens in the lab, at work, or for a friend.
Learn AWS Without an AWS Account. Run the Official Emulator on Your Laptop
AWS now ships a free emulator of its own APIs. Point the normal AWS CLI at your laptop and practice S3, SQS and DynamoDB with no account and no bill. We ran it on our box and hit the four errors every beginner hits first. Each one tells you exactly what to check.
Your Smart Home Should Keep Working When the Internet Drops. Start With a Local MQTT Broker
A cloud smart home dies when the vendor's server does. A small MQTT broker in your house keeps devices talking locally. We ran one on our box with a fake garage sensor and a wall dashboard, then killed the sensor two ways. One way the dashboard found out in a fraction of a second. The other way it never did.
Check Your Chrome Version and Relaunch. CVE-2026-125350 Is Exploited in the Wild
Google patched a High use-after-free in Chrome's XML code and said an exploit exists in the wild. CISA added CVE-2026-125350 to the KEV catalog on Nov 10. Here is how to check your version, force the update and relaunch, and why that listing changes the triage.
Stringman Hangs a Gripper From Four Ceiling Lines. Run the Cable Math Before You Buy the Kit
Stringman is an open source room-scale gripper that hangs from four motors in the ceiling corners. Before spending $655 on the kit, we wrote the cable math in numpy, built a four-cable robot in MuJoCo from scratch, and ran both on our box. Here is where the lines go slack, why the top of the room is expensive, and the first command to try yourself.
Kimi K3.1 Pro Is Open Weights. Two Numbers Say It Won't Run on Your Box
Moonshot published the full Kimi K3.1 Pro weights. We pulled the Hugging Face API on our box and worked the numbers. The checkpoint is 1,561 GB, 104B parameters are active, and each token at batch 1 reads about 137 GB of weights. Here is how to size any model in two minutes before you download it.
WireGuard Site-to-Site in Three Network Namespaces, Then I Tried to Leak Around It
A working WireGuard tunnel tells you nothing about what happens when it stops working. I built a two-site lab on one Linux box, captured the wire in the middle, and tried five ways to get plaintext past the tunnel. Two of them worked until I wrote the right nftables rules.
When AI Handles the Easy Incidents, How Do You Keep Your Troubleshooting Skills Sharp?
When chat bots clear routine pages, the hard outage lands on a human who has had less stick time. Here is how an operator reasons through an incident by hand, why automation erodes that skill, and three drills you can run at zero cost.
WordPress upgrade-window RCE: check your version, then update safely
CVE-2026-119977 affects WordPress 4.7 through 7.1.3 for a few seconds while a full core update unpacks. Here is how to check your version, block the staging folder, update, and read your logs.
Your CPU Says 100%. It Might Be Waiting on RAM the Whole Time
A core at 100% can spend most of its time waiting on RAM. Here is how to tell the difference, the reasoning an operator uses to prove it, a 30-line benchmark you can build tonight, and the real output from our box.
Five Open Models Matched a Paid One at Hard Coding Problems. The Judge Was a Bash Script.
Five copies of an open-weight 27B model, working as a team, matched a paid frontier model on ten hard coding problems. What the result shows, what it doesn't, and the test I ran on the script that decides pass or fail.
git diff Says "Binary Files Differ." OmniDiff Tells You What Changed.
OmniDiff is a free, open-source diff tool that compares code by structure and opens PDFs, images, fonts and zips to show what changed inside. I installed v0.3.0, checked the checksum, and ran it on a real repo and on files I made. Here's the output, the gaps, and the license fine print.
CVE-2026-98432: A Remote Root Bug in the Linux TCP Handshake. Patch the Host, Not the App.
A Linux kernel race in the TCP handshake can become remote root. Who is exposed, how to check your kernel, and what to do while your distro catches up.
PHP2Shell: Two PHP Bugs Attackers Are Already Using, and How to Tell If Your Server Runs Them
Two PHP bugs, CVE-2026-109618 and CVE-2026-109619, let a stranger run code with no login. CISA lists both as exploited. How to check the PHP your server runs.
Your AI Coding Extension Ran Before You Clicked Anything
A fake Claude Code build on Cursor's marketplace planted an SSH key the moment it loaded. Here's the check, why uninstalling isn't enough, and how I vet and pin extensions now.
Agentic Claude Code: How Agents, Hooks, and Orchestration Actually Work
Most people use Claude Code like a chatbot. Real agentic workflows use specialized agents, an orchestrator that routes without coding, and hooks that guard every dangerous operation. Here is how all of it works and how to configure it yourself.
Proxmox VE Node Hardening: SSH Lockdown and Non-Root Admin Access
Default Proxmox hands root SSH to anyone who can reach port 22. Three targeted layers close that gap: a non-root admin with sudo, root SSH disabled, and iptables restricting SSH to your bastion only.
Building a Zero-Trust Homelab with YubiKey PIV
Hardware-backed authentication for your homelab using YubiKey PIV smart cards, a private CA, SSH hardening, digital signing, and a Bastion server. No cloud dependencies. No subscriptions. Full control.
How Do You Know That Download Is Safe? Checksums, GPG, and File Integrity Explained.
Downloading a file and running it is an act of trust. Checksums prove the file wasn't corrupted. GPG signatures prove who sent it. Here is how to verify both, from first principles.
167 Vulnerabilities, One Exploited Zero-Day, and a Secure Boot Clock: Microsoft April 2026 Patch Tuesday
Microsoft's April 14 update patches 167 flaws including an actively exploited SharePoint zero-day now on CISA's Known Exploited Vulnerabilities list. Federal agencies have until April 28 to patch. You should not wait either.
Operation Masquerade: FBI, NSA, and DOJ Dismantle Russian GRU Router Hijacking Network
Russian military intelligence compromised consumer routers across 23 states using a TP-Link zero-day. A joint FBI, NSA, and DOJ operation shut it down on April 7, 2026.
The 2026 Stanford AI Index: Power, Hiring, and Benchmarks
The 2026 AI Index is out. AI data centers draw enough power to run New York. Entry-level dev hiring is down 20%. Benchmarks are broken. Investment hit $581 billion. Here is what matters and what to do about it.
10 Tools. One Brain. The Stack That Actually Builds Things.
These are not ten separate things to learn. They are ten modules in one brain. Claude Code is the nervous system. Everything else is an organ. You start with Obsidian. The rest reveals itself.
Your Homelab Has a Brain Now. Here Is How to Wire It.
Your AI forgets everything between sessions. MCP fixes that. Here is how to wire Claude into your Obsidian vault, running on your own Proxmox hardware, with n8n handling the automation.
Prompt Engineering Is Not Magic. It Is Instruction Writing.
You learned how tokens and context windows work. Now learn how to exploit them. Prompt engineering is not a mystical art. It is structured communication with a machine that follows instructions literally. Here is the field manual, sourced from Anthropic, OpenAI, and Google.
How AI Actually Works: Tokens, Context Windows, and Why Your Chatbot Forgets Things
How LLMs actually work: tokens, transformers, context windows, attention, and output sampling. Plus proven techniques to optimize token usage in Claude and ChatGPT. Interactive demos included.
MCP Crossed 97 Million Monthly SDK Downloads
Anthropic's Model Context Protocol crossed 97 million monthly SDK downloads. Every major AI provider supports it. The Linux Foundation just took it under open governance. This is the standard now.
AI Agents Are Already Making Decisions for You. Here Is What That Means.
Agentic AI is not coming. It is here. It is approving loans, triaging your support tickets, and running attack campaigns. If you do not understand how it works, you are already behind.
Building a Proxmox Cluster on Beelink Mini PCs
Rack servers are loud, hot, and expensive. Two Beelink mini PCs running Proxmox VE give you a proper virtualization cluster for a fraction of the cost. Here is the full build.
Obsidian as a Knowledge Vault: The Field Manual
Most people use Obsidian like a glorified notepad. Here is how to build it into a real knowledge management system with structure, automation, a daily operating rhythm, and an LLM-maintained wiki that scales.
Claude Code Hooks: The Field Manual You Actually Need
A no-BS field manual for Claude Code hooks. What they are, when to use them, how to configure them, and practical cases that actually matter. Written for engineers who build, not tourists who browse.
Welcome to the Lab
First post from the BytesNation lab. What this space is about, what to expect, and why I build in the open.
Network Firewalls vs. Web Application Firewalls: What Each One Actually Defends
Network firewalls and WAFs both block traffic, but they operate at completely different layers and defend against completely different attacks. Here is what each one does, where each one fails, and how to deploy them together.
No notes in this category.