Everything here is something I actually run, actually use, or actually work to. No affiliate links, no sponsored placements, nothing that pays me for the click. If a link stops being worth your time, tell me and I will take it down.
Check your own exposure
Before you buy anything or install anything, find out what is already exposed. All of these are free, and none of them want your email address.
- Have I Been Pwned — Is your address in a breach? Check it, then change the password you reused. If that password is still in use somewhere, it is today’s job, not next week’s.
- EFF Cover Your Tracks — What your browser leaks without asking. Run it twice — once in your normal browser, once in a hardened one. The gap is the lesson.
- SSL Labs Server Test — Grades any site’s TLS, including your own. I run it after every certificate change, because the padlock appearing is not the same as the configuration being right.
- dmarcian DMARC Inspector — Checks whether someone else can send email as your domain. Most small businesses fail this, and find out only when an invoice arrives from their own address.
- CISA StopRansomware Guide — A plain checklist for backups and recovery. Not exciting. It is the difference between an incident and a disaster.
Run it yourself
The software I actually run at home, in the order I would learn it. The build is in HomeLab 101, and the local AI stack in The Private Local AI Server Install. All of it is free and self-hosted, and none of it phones home with your data.
- Proxmox VE documentation — The hypervisor everything else sits on. Genuinely good documentation, which is rarer than it should be.
- TrueNAS SCALE documentation — Storage that does not argue with you. Read the ZFS and snapshot sections before you put anything precious on it, not after.
- Headscale — A self-hosted control server for Tailscale clients. Your devices, your mesh, your coordination server — and your private network stops depending on someone else’s login page.
- Authelia — Single sign-on and two-factor for the things you self-host. Eight separate logins become one door with a real lock on it.
- Pi-hole documentation — Network-wide DNS filtering, which is where ad-blocking and a lot of tracking actually die. Cheap to run, hard to live without.
- llama.cpp — Local language models on ordinary hardware. If you have read the local-AI posts here, this is the engine underneath most of them.
What else runs here
Not learning material — these are the services doing real work in this house, named for what they do and why they earn their place. I do not publish where they live, how to reach them, or which version runs. That is not secrecy; it is simply not an invitation.
- Nginx Proxy Manager — The front door for everything I self-host. Certificates and routes managed in one place, so TLS stops being a per-service adventure.
- Odoo — Open-source ERP: billing, inventory, CRM. The business-applications half of my career, running on hardware I own rather than someone’s subscription.
- GitLab (self-managed) — My own code forge — repositories, issues and pipelines, on my disk. A self-hosted GitLab means the work is mine even when a vendor changes its mind.
- SearXNG — A metasearch front end. It queries the engines on your behalf and hands you the results without handing them your profile.
- Vane, my own answer engine — Retrieval first, model second: it searches my own notes and documents before it asks anything of a language model, so the source material never leaves the house.
The standards I work to
This shelf is for clients and employers rather than hobbyists. These are the frameworks I use to decide what secure enough means, because we take security seriously is a sentence, not a control.
- NIST Cybersecurity Framework — Identify, protect, detect, respond, recover. The most useful one-page mental model in the trade.
- CIS Critical Security Controls — Eighteen controls with implementation groups, so a small company can start somewhere sensible instead of failing an enterprise checklist.
- OWASP Top Ten — The web application risks that keep reappearing, in order. Worth re-reading annually even if you do not write code.
- Singapore PDPC — Data protection obligations under the PDPA, in the jurisdiction I actually work in.
- Cyber Security Agency of Singapore — Local guidance and advisories. If you are an SME here, start with this shelf’s last two items.
Who I read
No SEO blogs and no growth-hacked top-ten lists. These are people who publish because they have something to say.
- Troy Hunt — Breach analysis written by someone who has handled the data. Have I Been Pwned is his.
- Krebs on Security — Investigative reporting that follows the money. Occasionally grim, always sourced.
- Simon Willison — Publishes what he actually built and what broke while building it. The phrase “lethal trifecta”, which the security writing on this site leans on, is his.
- Bruce Schneier — The original security sceptic. Still publishing after 20 years, and he writes the newsletter himself rather than farming it out.
- Ethan Mollick, One Useful Thing — AI explained for people who do not work in AI, with experiments rather than predictions. The closest thing online to the audience this site now writes for.
- Self-Hosted — A podcast about running your own services, including the parts that break. Good company for a weekend of repairs.
- r/selfhosted — The crowd rather than the experts. Useful because it shows what ordinary people are deploying, and what they regret.
Two things I would ask in return. If a link here is broken, tell me. If you have something on your own list that belongs here and is not selling anything, send it — the details are in the footer.