For years I have meant to start this. The blocker was never having nothing to say; it was that every attempt turned into a project about the blog instead of a project that produced posts. Theme repos, build pipelines, the works. This time the rules are different: the site is a folder of Markdown files, the theme is somebody else’s problem, and hosting costs nothing. If that holds, posts will actually happen.
What goes here
Two halves of my life that mostly run in parallel. The security half is red teaming, adversarial simulation, cyber deception, detection validation, and the newer problem of AI agents on both sides of the wire. The games half is tabletop RPG design, zines, skirmish wargames, and terrain building.
The reason they share a site is that they keep leaking into each other. Designing a honeypot and designing a dungeon trap ask the same question: what does the target expect to find, and what will they do when they find it? Running a purple team exercise and running a table both come down to reading the people in front of you and adjusting the encounter. I’d rather write about that overlap in one place than pretend the two are unrelated.
What to expect
No schedule. Posts when there’s something worth the time to write and the time to read. There’s an RSS feed if you want to be told when that happens, and a tags page if you only care about one half.
Nothing here speaks for my employer.