Security on Margrop Blog

Why Your Smart Home Devices Deserve a Guest Room

Wed, 29 Jul 2026 09:00:00 +0800

The short version

Your bulbs, cameras, robot vacuum, TV, and smart speakers should not permanently share the same local network with your laptops, phones, and NAS. The practical answer is not to disconnect them from the Internet. Give them a separate “guest room”: a separate Wi-Fi name, a separate VLAN, a separate address range, and a firewall that opens only the doors they actually need.

This gives you a useful boundary. If an IoT device misbehaves, the problem is less likely to spread to your main network. If an account or firmware is compromised, an attacker does not automatically receive a master key to the whole house.

How Did AI Learn to Use Its Hands? From Chatting to Checking, Writing, and Acting

Sun, 19 Jul 2026 22:00:00 +0800

The short answer

AI did not suddenly grow hands. It learned a very practical loop: decide which tool is needed, request that tool with structured arguments, wait for a real result, and then explain the result in human language.

This is usually called Tool Calling. You may also see Function Calling or a Tools API. MCP, the Model Context Protocol, is closer to a universal socket: different AI applications can discover and call files, databases, search engines, ticket systems, browsers, and other capabilities through a common protocol.

This article opens the loop and examines every moving part: what the model does, who actually performs the action, why MCP matters, where permissions belong, and why “can call a tool” does not mean “should receive the keys to everything.” Screenshots come from official OpenAI and MCP pages; the terminal-style evidence images are generated from the real invocation flow. No real private network address or hostname is included.

You Bought an Overseas VPS and a Domain. Now What? 12 Things That Make a Public IP Worth Owning

Sat, 11 Jul 2026 13:30:00 +0800

The short answer

An overseas VPS by itself is a powered, connected room without a memorable street address. A top-level domain by itself is only a sign. Put the domain on Cloudflare DNS and point carefully chosen records at the VPS, and you finally own the sign, the map, the storefront, and a standards-based public entrance.

The result is much more useful than “a place to host a blog.” It is a small, always-on piece of Internet infrastructure where you control the code and the migration path: websites, APIs, webhooks, status pages, monitoring, controlled file sharing, password management, remote-access relays, automation jobs, and a personal AI gateway can all grow from the same foundation.

A public IP is also a door facing a busy street. Automated scanners may try the handle shortly after the server appears. This guide therefore covers both the useful projects and the services that should never be exposed directly.

Don't Let Your Mac mini Gather Dust: Run Agents 24/7 from Windows

Sat, 11 Jul 2026 04:00:00 +0800

The short answer

If Windows is your everyday platform but a low-power Mac mini stays on to run OpenClaw, HermesAgent, or macOS-only automation, you do not need to dedicate another monitor, keyboard, and mouse to it. Treat the Mac mini as a quiet Agent server. macOS already includes Screen Sharing, and RealVNC Viewer on Windows can take over the desktop whenever configuration, upgrades, or troubleshooting require a GUI.

This is especially useful in a Windows-first home or studio where the Mac mini runs continuously at relatively low power while the Windows machines remain the daily workstations. The installation is rarely the difficult part. Most failures come from Screen Sharing, user authorization, VNC credentials, network reachability, sleep behavior, or services that do not recover after a restart.

One rule matters more than every convenience tweak in this guide: do not expose TCP port 5900 directly to the public Internet. A same-LAN connection is the simplest starting point. For access across networks, first join a self-hosted VPN or another controlled private network, and only then connect to the Mac.

Stop Clicking Through VMs: A Hands-On Guide to Connecting Proxmox VE to an AI Agent Safely

Sat, 11 Jul 2026 02:30:00 +0800

Connecting an AI agent to Proxmox VE sounds like giving a robot administrator the keys to your datacenter. That is exactly what you should not do. The safe starting point is a dedicated, revocable, read-only API token, a locally running MCP server, and a clear approval boundary for every write operation. This guide explains the architecture, shows manual and agent-assisted setup, and provides one-click installers for Windows 11, Ubuntu 26.

Should QingLong Panel Still Face the Public Internet? After the 2026 Bypass, I Would Start With BaiHu

Thu, 09 Jul 2026 10:00:00 +0800

Bottom line first

QingLong Panel used to be the default answer for many self-hosted scheduled-script setups. It can run scripts, manage environment variables, show logs, synchronize repositories, and wrap crontab-like workflows in a friendly web UI. But the critical QingLong issues publicly discussed in early 2026 changed the risk calculation: a task scheduler panel is not just another web admin page. It often holds scripts, secrets, notification tokens, and execution privileges. If authentication can be bypassed, the attacker is not merely viewing a dashboard; they may be standing in front of a machine that can run jobs.

For new lightweight deployments, I would now evaluate BaiHu Panel first. BaiHu is a Go + Vue3 automation task scheduling platform focused on low overhead and high performance. Its public README describes Docker / Docker Compose deployment, Mise-based runtime management, repository task synchronization, logs, notifications, and secret handling. It is not a perfect one-to-one replacement for every QingLong workflow, but it is a better starting point for many personal script-hosting cases.

If you must keep using QingLong temporarily because of old jobs, migration cost, or compatibility constraints, do not expose it directly to the public Internet. Put a protection layer in front of it: VPN, zero-trust access, reverse-proxy Basic Auth, an allowlist, WAF rules, or equivalent access control. This article includes one-click scripts for Windows 11, Ubuntu 26.04, and macOS 26. They deploy BaiHu by default, require an explicit switch to deploy QingLong, and put either panel behind Caddy Basic Auth.

Your Mac App Is Not Broken: Gatekeeper May Just Distrust an Unsigned Tool

Mon, 01 Jun 2026 07:35:00 +0800

The short version

When a macOS utility refuses to launch after being downloaded, the first conclusion should not be “the app is broken.” A very common cause is a combination of two facts: the app still has the com.apple.quarantine extended attribute that marks it as downloaded from the internet, and the app bundle does not have a usable signature that Gatekeeper can trust. For first launch, “downloaded from the web + no usable signature” is enough for macOS to block it.

For a tool whose source you understand and trust, the smallest local repair is straightforward: inspect the quarantine attribute, verify the signing state, apply a local ad-hoc signature to that one app bundle, remove quarantine from that one app, and then verify the result. The point is not to turn off macOS security globally. The point is to fix one known local tool while keeping the safety boundary clear.

This post is based on a real local troubleshooting session, but all private details have been removed. There are no real internal addresses, usernames, tokens, private download locations, hostnames, or machine-specific paths. The examples use placeholders such as /Applications/<App>.app and <App>. The goal is to share a repeatable diagnostic method, not to expose an environment.

You Can SSH Out, but Not Back In: A Fail2Ban False Positive That Broke Reverse Access

Sat, 30 May 2026 15:45:00 +0800

Bottom line

The symptom looked simple: I could SSH from the local machine into a remote internal host, but the reverse SSH path failed when the remote host tried to connect back. sshd was listening, the route table looked fine, and the failure still happened.

The real root cause was not a broken SSH daemon. Fail2Ban had banned the VPN gateway address that represented the return path. From the local machine’s point of view, the incoming SSH session did not appear to come directly from the remote host. It appeared to come from the gateway, so the ban cut off the whole reverse path.

Avoiding the Trap: Why Fail2Ban Fails on Ubuntu 26.04 & PVE 9.2 (And How to Fix It)

Tue, 26 May 2026 22:20:00 +0800

The Bottom Line

With the releases of Ubuntu 26.04 LTS and Proxmox VE (PVE) 9.2, many system administrators, DevOps engineers, and self-hosting enthusiasts have eagerly upgraded or clean-installed these latest systems. However, during the post-installation security hardening phase, you may encounter a highly frustrating scenario: simply copying over your legacy Fail2Ban configuration files from older versions (such as Ubuntu 20.04/22.04 or PVE 7.x/8.x) will either cause the Fail2Ban service to crash during startup or, worse, run silently in the background while completely failing to block external brute-force attacks!

This issue is not caused by a bug in Fail2Ban itself. Instead, it is the result of three “invisible bombs” hidden beneath the surface of these modern Linux distributions, namely changes in the logging architecture, service activation mechanisms, and firewall backends. This article provides an in-depth analysis of these three architectural shifts and introduces a modern, bulletproof Fail2Ban configuration guide fully integrated with systemd-journald and nftables.

The past and present life of SSH key algorithm Ed25519 and RSA, and how to use it today

Mon, 02 Mar 2026 09:00:00 +0800

Many people’s first contact with SSH starts with a line of commands: There is nothing wrong with this command, but there is an often overlooked issue behind it: Are we talking about “RSA key type” or ssh-rsa “signature algorithm”? These two concepts are used interchangeably in many old tutorials, leading many people to think that they are “still using old and unsafe solutions” and at the same time don’t know how to migrate, and even repeatedly step into pitfalls between new systems and old devices.