Articles
Writing on cloud infrastructure, digital sovereignty and open systems.
- Denmark warned about CPR guessing. 14 years later, 8.8M exposed Denmark warned about CPR-number guessing in 2012. Fourteen years later, automated lookups exposed data linked to 8.8 million living, dead and emigrated people.
- Nazi Songs, “I Am Gay” Emails and Nobody in Charge at BGP.Exchange BGP.Exchange’s website remains defaced. Member-linked contact data were used in authenticated campaigns, the domain was transferred between registrars, and its current DNS delegates email signing to a Microsoft 365 tenant whose original domain prefix is “furriesfun”. The service’s visible PeeringDB footprint includes about 510 participant networks, but the number of confirmed victims remains unknown.
- Why Europe still needs its own dynamic DNS infrastructure Dynamic DNS is old, quiet infrastructure—and much of it is still controlled outside Europe. Here is why we built Dynway as an open European alternative.
- Seksten timer før ordet «angrep» Digdir brukte seksten timer på å si «tjenestenektangrep». Statussiden publiserte i mellomtiden åtte meldinger uten årsak, fem av dem ordrett like. En gjennomgang av kommunikasjonen — og av et funn i trusseldata knyttet til ID-portens frontadresse.
- ID-porten nede: stengt ute fra resepter, trygd og egen helse ID-porten har vært nede siden klokken 00.50 natt til mandag. Digdir bekreftet etter seksten timer at årsaken er et tjenestenektangrep mot driftspartneren Vivicta. Innbyggerne er stengt ute fra resepter, nettapotek, NAV, Altinn, skatt og Helsenorge.
- Four Hundred Million Reports Is Not the Interesting Part The platform behind ip.wayscloud.services has passed 400 million analysed and classified reports. Storing them was the easy part; deciding what a single observation should mean is the engineering problem.
- Apple's Hide My Email Bug Was Likely a Boundary Failure, Not an Alias Apple's Hide My Email issue is not just a story about email aliases. Privacy aliases are boundary architecture — and the hidden mapping behind an alias must never become observable.
- Stopping Abuse Without Turning Users Into Surveillance Objects This morning we contained a coordinated registration-abuse attempt against meil.no — caught early, no accounts compromised. The harder question it surfaced: how do you stop modern, distributed fraud without turning every legitimate user into a surveillance object?
- When Cyber Capability Becomes Something You Have to Be Granted Anthropic withheld access to Mythos, its advanced cyber AI model, from the EU while sharing it with US institutions. The story is not about nationality — it is about structural dependency, and what sovereignty has to mean now that frontier cyber AI sits closer to strategic infrastructure than to productivity tooling.
- One bad signature took down major .de sites for three hours On 5 May 2026 a single malformed signature blacked out .de for hours. The same class of failure is structurally available to .no, .se and .dk.
- Telia's typo explanation raises bigger telecom-trust questions Telia now explains the location-data exposure as a configuration error: P-Access-Network-Info became P-Access-Network-Id. That may explain the mechanism. It does not explain why sensitive cell-level context was allowed to cross a telecom trust boundary.
- The incident that changed how I think about trust A personal reflection on a 2024 supplier data incident, and why transparency, accountability and follow-up matter more than the failure itself.
- Telecom signaling is still a location privacy problem Ofcom and Citizen Lab show how mobile-network signaling can still expose location-sensitive data. Telia Norway adds a separate SIP/IMS example.
- Cloud waste is not just a climate problem Hidden cloud waste does not just raise carbon footprint. It also increases cost, reduces visibility and can create security risk when infrastructure is forgotten.
- Finland’s state IT breach now raises espionage concerns Finland is investigating a breach at its state IT provider as suspected espionage after police said the stolen dataset may affect national security and cause harm.
- Why I chose to expose what most people hide I don’t trust perfect systems. This is why we built a Trust Center — to document what actually happens behind the scenes.
- Sovereignty is not something you claim — this is how we approach it Sovereignty is often treated as a claim. In practice, it’s about understanding control, dependencies and what actually happens when you’re the one running the system.