Security on Danilo Falcão da Silva

The Kubernetes Operator's Batman Utility Belt: Day-2 Tools That Actually Earn Their Keep

Mon, 25 May 2026 14:35:00 -0300

kubectl is the Swiss Army knife. Nobody disputes this. But Swiss Army knives are terrible at most of the individual jobs they claim to do, and kubectl is no different: it can tail logs, but only one pod at a time. It can switch contexts, but with zero guardrails. It can describe resources, but in a wall of YAML that buries the thing you actually care about.

Day-2 operations — the part where the cluster is live, traffic is flowing, and someone pages you at 2 a.m. — need sharper instruments. What follows is the utility belt I’d recommend to any Kubernetes operator building their toolkit in 2026. Not everything here is new. Some of these tools have been around since 2018. The point is that they’re still maintained, still solve real problems, and still faster than the kubectl incantation you’d otherwise be typing.

AI Bug Reports: The Real Vulnerability Is That We Weren't Looking Hard Enough

Sat, 23 May 2026 10:00:00 -0300

On May 18, 2026, Linus Torvalds called the Linux kernel security mailing list “almost entirely unmanageable.” The reason: a flood of AI-generated bug reports. The reaction was predictable — ban AI, blame researchers, declare the tools aren’t ready.

I wrote about the maintenance crisis last week and I think that framing misses the deeper story. The problem is not that AI is generating too many reports. The problem is that the code was more broken than we thought, and for twenty years nobody had the tools to look at it properly.

Replacing Snyk with Open Source: SAST, DAST and SCA in 2026

Fri, 22 May 2026 10:00:00 -0300

I don’t pay for Snyk. Not because it’s bad — it’s a genuinely good product — but because there is a free stack that catches the vast majority of the same issues directly in CI, and the remaining gap hasn’t been worth roughly $600 per developer per year to close. On a team of fifteen engineers, that’s the price of a small EC2 fleet you actually need.

This post is about the open-source security tooling I actually wire into pipelines: Trivy for containers, dependencies and IaC, Semgrep for application code, Nuclei and OWASP ZAP for the live app, and a few honourable mentions. It’s not an exhaustive catalogue. It’s the stack I keep coming back to.

AI Bug Reports Are Drowning Open Source — And the Fix Isn't 'Stop Using AI'

Wed, 20 May 2026 10:00:00 -0300

On May 18, 2026, Linus Torvalds said the Linux kernel security mailing list had become “almost entirely unmanageable” because of duplicate AI-generated bug reports. Two months earlier, longtime stable maintainer Willy Tarreau had already shared the numbers: a list that received two to three reports per week in 2024 was getting five to ten reports per day by March 2026. In January, Daniel Stenberg shut down the curl bug bounty after the valid-report rate on HackerOne dropped from above 15% to below 5%, with twenty submissions in 21 days — seven of them in one 16-hour window — and zero real vulnerabilities among them.