https://nick.detello.com/tags/security/Recent content in Security on Nick DeTello - Nicholas DeTelloHugoen-usSun, 20 Sep 2026 00:00:00 +0000https://nick.detello.com/blog/isolating-nix-remote-builder-microvm-shared-host/Sun, 20 Sep 2026 00:00:00 +0000https://nick.detello.com/blog/isolating-nix-remote-builder-microvm-shared-host/Distributed builds lend spare capacity to CI, but build scripts execute untrusted code. I isolate them in a builder VM with its own kernel, restricted access and resources the host can reclaim.https://nick.detello.com/blog/kernel-privesc-nix-derivation/Tue, 11 Aug 2026 00:00:00 +0000https://nick.detello.com/blog/kernel-privesc-nix-derivation/A kernel exploit targeted a program that NixOS keeps at a different path. Rebuilding dirtyfrag with Nix meant finding and pinning the exact executable, while exposing a kernel bug the build sandbox cannot contain.https://nick.detello.com/blog/page-cache-bug-nix-sandbox/Mon, 10 Aug 2026 00:00:00 +0000https://nick.detello.com/blog/page-cache-bug-nix-sandbox/A decryption can fail and still leave the file it read changed. The move that lands root isn’t reading the dropped binary - it’s reading what the recipe retargets.