El blog de Workstation
Security
Publicaciones etiquetadas con Security.
OpenShell, Announced at GTC Berlin: Policy Outside the Agent
Huang's security film rejected 'please don't' as a control. OpenShell enforces a policy on syscalls, files and network, with Sentry on BlueField-4.
Balinder WaliaLeer 
Private AI for Law Firms: Choosing an Offline-First Workstation Your Clients Can Trust
How a law firm chooses a private-AI workstation that runs with no internet connection: who uses it, which model, how much GPU memory, how isolated it must be and who sets it up. With real prices from a real quote, where it was over-specified, and the Starter, Workforce and Enterprise builds we would actually ship.
Balinder WaliaLeer 
Agentic AI in banking: efficiency you can defend to a risk committee
Banking AI agents rarely fail on one bad reply; they fail across a session. How to scope tools, test whole conversations against mock systems and measure reliability with pass^k, so the time saved survives audit and production.
Wikipedia banned AI-written articles: what teams that reuse it should change
English Wikipedia now prohibits LLM-written article text, yet volunteers still flag a steady share of new drafts as AI-generated. If your search, chatbot or knowledge base reuses Wikipedia, here is how to pin revisions, watch edits, review changes and attribute correctly.
DynaCI and runtime-grounded CI: better GitHub Actions workflows
DynaCI, an October 2026 research preprint, drafts GitHub Actions workflows from traces of real local runs. What its results show, what they do not, and a playbook to lint, test, harden and review every workflow you ship.
Code as infrastructure: one reviewed path for every production change
Infrastructure as code made servers into files. Code as infrastructure goes further: desired state, policy, pipelines and AI agent access all live in Git, are checked by policy, applied by automation and watched for drift. A practical playbook.
Decoupling Network Policy in Kubernetes: One Owner per Rule
Network rules scattered across annotations, app config and stray NetworkPolicies slow every change. Here is how to split them into layers with one owner each, using ClusterNetworkPolicy, NetworkPolicy and Gateway API, plus a step-by-step migration playbook.
One Sign-In for Every App, Run on Our Own Cluster
Five demo apps in five languages never see a password and never talk to Google: they send users to a self-hosted OpsAPI, which signs them in and hands back a token the app checks with one API call. What it costs to add an app, why admin dashboards belong behind a VPN or zero-trust broker, and the honest limits.
Balinder WaliaLeer 
Keep Your Test Sites Private: VPN at the Edge, One Sign-In for Every App
Staging and test sites hold real-looking data, yet they're often protected by an IP allowlist alone. Here's how two layers keep them private: a VPN checked at the edge proves where a request came from, and one OpsAPI sign-in with MFA proves who sent it, across every app.
Balinder WaliaLeer 
Put Internal Apps Behind Your VPN, Without Rebuilding Them
Staging sites and admin panels are often 'private' because of an IP allowlist. Put them behind the wslvpn Zero Trust VPN, enforced at the WSLProxy edge: check the tunnel and the person, fail closed, and see why someone was blocked. One field per domain, no app changes, no reload.
Balinder WaliaLeer