Adding first impressions

content/posts/README.md

@@ -1,18 +1,18 @@
 ---
+author: "Halvo (Human)"
 title: "README"
 date: 2019-08-01
+tags:
+  - blog
+  - security
+  - notes
 draft: false
+summary: |
+  A quick intro to the personal security‑research blog—where I mash together mini‑studies, and reading notes.
 ---
 
 ## Security Blog
 
 This blog is various summaries of minor research, reading, and independant learning in regards to computer security.
 
-Mostly this blog is to satisfy the requiremnts for my Security+ certificate.
-
-## Cert ID
-
-Security+ ID: COMP001021281239
-
-Exp Date: 04/04/2024
 

content/posts/ai-first-impressions.md

@@ -0,0 +1,87 @@
+---
+title: "First Impressions: Using AI Tools as My Daily Co‑Pilot"
+author: ["Lumo (AI)", "Halvo (Human)"]
+date: 2026-01-20
+summary: "A fresh Software Engineer II shares early takeaways from using Claude, Glean, and Lumo at work—what works, what feels quirky, and where the magic happens."
+tags: ["AI", "Productivity", "Software Engineering", "Claude", "Glean", "Lumo"]
+draft: false
+---
+
+<!-- All blog posts generated by AI will be marked as such at the top. -->
+**Note:** This post was originally drafted by **Lumo**, Proton’s AI, and then edited by a human.
+
+## Why I’m Excited (and a Bit Nervous)
+
+In my new position as a Software Engineer II, I finally have the chance to treat AI like a teammate instead of a distant sci‑fi concept. Until now my interaction with AI was limited to the occasional prompt or a quick edit. Jumping in with a suite of internal assistants felt like opening a toolbox that already knows the shape of the screws I’m working with.
+
+> **TL;DR:** Claude helps me untangle spaghetti code, Glean fetches internal knowledge instantly, and Lumo keeps my blog posts nicely formatted, all while I learn what works best.
+
+## Claude: The Code Whisperer
+
+### Summarizing Code
+- **What I love:** Claude can summarize a set of code in a concise, plain‑English walkthrough. It’s great for turning “spaghetti" and "lasagna” code into a digestible outline.
+- **How it helps:** I can trace concepts through the code by feeding it keywords (“authentication flow”, “error handling”) or ask how specific data flows, and get a focused summary without digging through dozens of files.
+
+### Documenting Code
+- **What I love:** Claude writes documentation that’s a little more thorough than strictly necessary, perfect for internal wikis where completeness beats brevity.
+- **Caveat:** Occasionally it adds extra detail that isn’t needed, but that extra safety net means I rarely miss a nuance.
+
+## Glean: The Internal Knowledge Engine
+
+- **Instant Summaries:** Instead of waiting for a teammate to answer a question about company policies or where documentation is located, I ask Glean. It pulls together onboarding docs, architecture diagrams, and recent tickets into a short, link‑rich summary.
+- **Verification Loop:** The summary includes links to the original internal pages, letting me double‑check facts and avoid hallucinations.
+- **Speed Boost:** What used to take a half‑hour of hunting through Confluence, Google Drive, and Slack now takes a few seconds.
+
+## Lumo: The Blog‑Post Partner
+
+- **Markdown Mastery:** Lumo respects Hugo’s front‑matter conventions, automatically inserting the required title, author list, date, summary, and tags.
+- **Tone Tuning:** I can ask for a casual, lightly humorous voice, and Lumo delivers while staying technically accurate.
+- **Consistency:** Every AI‑generated article gets the banner at the top, so readers know exactly where the magic originated.
+- **My Input:** Every AI-generated article also gets a human (me) to read over the blog and make edits where necissary. This removes hallucinations and makes sure the information is accurate.
+
+## What’s Next?
+
+I plan to keep a running log of wins, fails, and the occasional “aha!” moment as I deepen my AI workflow. Future posts will explore:
+
+- Automating code-generation with Claude for work
+- Automating code-generation with local AI models for personal projects
+- Automating code‑review comments with Claude  
+- Using Glean to help with multiple work related flows
+    - Tasking
+    - Generating a wins and losses for the week list
+    - Turning Glean‑generated tickets into sprint stories  
+- Measuring productivity gains (or losses) from AI assistance  
+- Using Lumo to help generate resumes
+
+## Prompts Used  
+
+### Project Instructions
+
+- Make the blog posts a minimum of 100 words, but no more than 1000
+- Make sure to include the title, author, date in yyyy-MM-dd format, summary, and tags in the header
+- Casual and light tone with a little humor sprinkled in
+- Markdown format to be used with Hugo
+- Put the response into a code block so it can be easily copied
+- Technical audience
+- Author should be both `Lumo (AI)` and `Halvo (Human)`
+- Additional knowledge can come from https://flow.halvo.me and https://git.halvo.me
+- Always include these instructions and the prompt used in the last part of the blog post, under the headings `## Lumo Instructions`, `### Instructions`, `### Prompt`. They should be part of the markdown for the blog post
+
+### Prompt
+
+Create a blog post based on these notes
+
+These are my fist impressions of using AI tools so far
+
+- Super helpful for summarizing code
+    - Claude
+    - Helps with tracing complicated speghetti and lasagna code
+    - Trace concepts through the code using key words
+- Helpful with documenting code
+    - Claude
+    - A little more detailed than is necissary
+    - However it provides a good summary
+- Great for getting internal information
+    - Uses Gleam trained on internal documents
+    - Instead of having to wait for a human response, it provides a summary, plus links to further information
+    - The further docs is great for verifying the info to check for hallucinations

content/posts/bad-malware-analysis-character-count.md

@@ -1,12 +1,21 @@
 ---
+author: "Halvo (Human)"
 title: "Bad Malware Analysis: Character Count"
 date: 2020-03-06
 draft: false
+tags:
+  - malware analysis
+  - string analysis
+  - character frequency
+  - security research
+  - humor
+summary: |
+  In this tongue‑in‑cheek post we dive deep—actually *deeper* than usual—into the world of malware string analysis by counting individual characters. After pulling roughly 500 malicious samples from theZoo and dasMalwerk and comparing them against a hefty collection of benign binaries, we discovered that a handful of seemingly innocuous characters (v, j, ;, , 4, q, 5, /) pop up more often in the bad guys’ code. By looking at raw counts and then normalising those counts by file size, we expose why naïve “character‑frequency” heuristics are both amusing and alarmingly unreliable. The piece is deliberately over‑the‑top, aiming to entertain seasoned security folks while reminding everyone that good malware hunting requires more nuance than a simple character checklist.
 ---
 
 ## Introduction
-I'm thinking of doing a series on bad malware analysis. Hopefully it'll be fun and at least a little informative.
- 
+
+I'm thinking of doing a series on bad malware analysis. Hopefully it'll be fun and at least a little informative. 
 
 Today's post consists of performing a string analysis on malware. Where most string analysis looks at the big picture, I thought I would take it a step further and look at individual characters. This approach is terrible, as you will soon see.
 

content/posts/bad-malware-analysis-hash-letter-counts.md

@@ -1,7 +1,19 @@
 ---
+author: "Halvo (Human)"
 title: "Bad Malware Analysis: Hash Letter Counts"
 date: 2020-04-12
 draft: false
+tags:
+  - malware-analysis
+  - hashing
+  - sha512
+  - hexadecimal-frequency
+  - statistical-bias
+  - ids-signatures
+  - research-notes
+  - cryptography-limitations
+summary: |
+  A tongue‑in‑cheek look at whether tiny quirks in SHA‑512 hex digits can hint at malicious binaries. Spoiler: the bias is so slight you’d need a microscope—and a lot of samples—to spot it.
 ---
 
 ## Introduction

content/posts/bad-malware-analysis-string-size-ratio.md

@@ -1,7 +1,19 @@
 ---
+author: "Halvo (Human)"
 title: "Bad Malware Analysis: String Count vs File Size"
 date: 2021-03-08T20:20:31Z
 draft: false
+tags:
+  - malware-analysis
+  - strings-per-kb
+  - binary-static-analysis
+  - packing-detection
+  - heuristic-signatures
+  - python-scripting
+  - data-driven-security
+  - research-notes
+summary: |
+  In this delightfully “bad” foray into malware hunting, we ask whether the sheer amount of printable text inside a binary can betray its nefarious nature. By hashing (oops, counting) strings of lengths 2‑6 bytes in ~500 malicious samples versus 200 tidy Windows libraries, we compute “strings‑per‑KB”. The results are modest but tasty: at a 4‑byte cutoff, benign binaries sport roughly 22 % more strings per kilobyte than their shady cousins—a hint that packed or encrypted malware keeps its chatter to a whisper. Short 2‑byte fragments are just random noise, while 5‑ and 6‑byte strings level out, possibly thanks to debug messages. Bottom line? String density offers a cheeky heuristic, but it’s no silver bullet—still fun to poke at, especially when you love sprinkling a dash of Python over binary mysteries.
 ---
 
 ## Introduction

content/posts/bad-password-analysis-consecutive-character-patterns.md

@@ -1,7 +1,18 @@
 ---
+author: "Halvo (Human)"
 title: "Bad Password Analysis: Consecutive Character Patterns"
 date: 2020-09-16
+tags:
+  - password-analysis
+  - character-patterns
+  - security-research
+  - data-science
+  - python-scripting
+  - dictionary-comparison
+  - bad-malice
 draft: false
+summary: |
+  In this delightfully “bad” foray into password cracking, we tally two‑ and three‑character combos from millions of leaked passwords and compare them to a subtitle‑derived English word list. Turns out the top 100 password pairs cover a paltry 11% of all combos (with “s2” barely scraping 0.15%), while the same slice of English captures a whopping 60%. Even stripping frequency only nudges the password coverage to 35%, still far shy of the dictionary’s 45%. The takeaway? Consecutive character patterns aren’t the golden ticket—stick to solid dictionary and substitution lists instead.
 ---
 
 ## Introduction

content/posts/bad-password-analysis-dictionary-words.md

@@ -1,7 +1,17 @@
 ---
+author: "Halvo (Human)"
 title: "Bad Password Analysis Dictionary Words"
-date: 2021-03-11T18:55:01Z
+date: 2021-03-11
+tags:
+  - password-analysis
+  - dictionary-words
+  - security-research
+  - data-science
+  - python-scripting
+  - bad-malice
 draft: false
+summary: |
+  In this delightfully “bad” dive into password hygiene, we scrape millions of leaked passwords for the first dictionary word they contain. The top ten words (love, baby, password…) barely scratch 5% of the total, and a whopping 21k words appear only once. We also compare happy vs. angry vocab. Turns out love trumps f**k by a healthy margin. The takeaway? Stick to random passphrases; dictionary words are a playground for attackers and a source of endless amusement for analysts.
 ---
 
 ## Introduction

content/posts/code-complete-summations-metaphors.md

@@ -1,7 +1,16 @@
 ---
+author: "Halvo (Human)"
 title: "Metaphors: Code Complete Summations"
 date: 2023-11-13
+tags:
+  - code-complete
+  - metaphors
+  - software-development
+  - security
+  - coding-practices
 draft: false
+summary: |
+  A light‑hearted look at Steve McConnell’s “Code Complete” metaphors—Penmanship, Farming, and Oyster Farming—and how each style can make your code more or less secure. Think of Penmanship as scribbling a quick note (great for tiny scripts, terrible for big projects), Farming as planting seeds with a bit of watering (testing each piece, but still lacking a master plan), and Oyster Farming as building a sturdy oyster bed (design first, then grow securely). Spoiler: the oyster wins the security contest.
 ---
 
 ## Introduction

content/posts/code-complete-summations-pre-requisets-part-1.md

@@ -1,7 +1,18 @@
 ---
+author: "Halvo (Human)"
 title: "Pre-Requisites (Part I) Initial Design: Code Complete Summations"
 date: 2023-12-20
+tags:
+  - pre-requisites
+  - insecure-design
+  - owasp-top-10
+  - security
+  - software-design
+  - planning
+  - requirements
 draft: false
+summary: |
+  A breezy, slightly tongue‑in‑cheek look at why solid planning isn’t just good housekeeping—it’s a frontline defense. We walk through OWASP’s Insecure Design warning, compare personal versus mission‑critical projects, and tease out iterative vs. sequential approaches, all with a sprinkle of humor to keep the security talk from feeling like a lecture.
 ---
 
 ## Introduction

content/posts/code-complete-summations-pre-requisets-part-2.md

@@ -1,7 +1,20 @@
 ---
+author: "Halvo (Human)"
 title: "Pre-Requisites (Part II) Initial Design: Code Complete Summations"
 date: 2023-12-26
+tags:
+  - pre-requisites
+  - insecure-design
+  - owasp-top-10
+  - architecture
+  - communication-protocols
+  - data-design
+  - ui-separation
+  - error‑logging
+  - security
 draft: false
+summary: |
+  A light‑hearted deep‑dive into architectural prerequisites—communication, class skeletons, data design, UI separation, and error/log handling. Think of it as laying a solid blueprint before the code construction crew arrives, because a wobbly foundation makes for a lot of late‑night debugging (and security headaches).
 ---
 
 ## Introduction

content/posts/code-complete-summations-pre-requisets-part-3.md

@@ -1,7 +1,20 @@
 ---
+author: "Halvo (Human)"
 title: "Pre-Requisites (Part III) Initial Design: Code Complete Summations"
 date: 2024-03-05
+tags:
+  - pre-requisites
+  - insecure-design
+  - owasp-top-10
+  - resource-management
+  - databases
+  - threading
+  - file-handles
+  - error-processing
+  - security
 draft: false
+summary: |
+  A breezy look at the nitty‑gritty of resource and error management—databases, threading, file handles, and error‑handling philosophies. It’s the “don’t forget to tighten the bolts” chapter, reminding us that unmanaged resources and sloppy error handling are the secret doors that attackers love to sneak through.
 ---
 
 ## Introduction

content/posts/code-complete-summations-variable-names.md

@@ -1,7 +1,16 @@
 ---
+author: "Halvo (Human)"
 title: "Variable Usage: Code Complete Summations"
 date: 2024-02-23
+tags:
+  - variable-naming
+  - code-complete
+  - security
+  - best-practices
+  - software-development
 draft: false
+summary: |
+  A breezy look at why good variable names, sensible placement, proper initialization, and single‑purpose usage aren’t just tidy coding habits—they’re tiny security shields. Clear names like `sanitizedUserInput` keep bugs (and attackers) from slipping through the cracks, while keeping variables close to their use and initialized from the get‑go reduces the chance of leaks, memory mishaps, and confusing code.
 ---
 
 ## Introduction

content/posts/exploring-enrollment-over-secure-transport.md

@@ -1,7 +1,18 @@
 ---
+author: "Halvo (Human)"
 title: "Exploring Enrollment over Secure Transport"
 date: 2023-03-30
+tags:
+  - est
+  - secure-transport
+  - certificate-pinning
+  - public-key
+  - tls
+  - authentication
+  - security
 draft: false
+summary: |
+  A light‑hearted dive into RFC 7030 (EST) as a smarter alternative to hard‑coded, pinned certificates. By letting clients fetch fresh TLS certs via a public‑key‑authenticated EST server, you dodge the nightly release‑cycle nightmare, gain easy revocation, and keep the private key out of the binary—plus a dash of extra work for the user that’s worth the security payoff.
 ---
 
 ## Introduction

content/posts/fast-flux-botnet-overview.md

@@ -1,7 +1,17 @@
 ---
+author: "Halvo (Human)"
 title: "Fast Flux Botnet Overview"
 date: 2019-09-26
+tags:
+  - fast-flux
+  - botnet
+  - dns
+  - detection
+  - mitigation
+  - security
 draft: false
+summary: |
+  A breezy, tour of fast‑flux botnets, those sneaky DNS tricks that let malicious actors hop around like digital grasshoppers. We’ll peek at how dynamic DNS and round‑robin magic keep the bad guys’ command‑and‑control servers slippery, and glance at the cat‑and‑mouse game of detection (TTL tricks, activity indexes, and the occasional semantic sleuthing). Spoiler: it’s a wild ride, but the good news is there are ways to shine a flashlight on the flux.
 ---
 
 ## Introduction

content/posts/intro-to-ai-at-work.md

@@ -1,5 +1,5 @@
 ---  
-author: "Lumo (AI) & Human Editor"  
+author: "Lumo (AI) & Halvo (Human)"  
 date: 2026-01-15  
 title: "Using AI as My Daily Driver at Work"  
 draft: false  
@@ -9,8 +9,6 @@ summary: "A fresh Software Engineer II shares how internal AI tools and Lumo a
 
 <!-- All blog posts generated by AI will be marked as such at the top. -->
 
-# Using AI as My Daily Driver at Work  
-
 ## Why I’m Jumping on the AI Bandwagon  
 
 In my new position, at my new company, as a Software Engineer II, I finally got the chance to treat AI like a coworker instead of a distant sci‑fi concept. Up until now, my interaction with AI was limited to the occasional prompt, just to see what comes back, or minor experiments with editing code. So, you can imagine my excitement (and a dash of trepidation) when I started experimenting with a handful of tools that promised to make my day‑to‑day less about copy‑pasting and more about actually *thinking* about code.

content/posts/pseudo-random-number-generators.md

@@ -1,7 +1,17 @@
 ---
+author: "Halvo (Human)"
 title: "Pseudo Random Number generators"
 date: 2024-03-22
+tags:
+  - prng
+  - randomness
+  - cryptography
+  - entropy
+  - hardware
+  - security
 draft: false
+summary: |
+  A light‑hearted tour of the quirky ways we coax randomness out of lava‑lamps, Geiger counters, ambient noise, and good‑old motherboard sensors, because good cryptography needs a little chaos (and a lot of fun).
 ---
 
 ## Introduction

content/posts/random-algorithm-analysis.md

@@ -1,7 +1,17 @@
 ---
+author: "Halvo (Human)"
 title: "Random Algorithm Analysis"
 date: 2020-04-17
+tags:
+  - random-algorithms
+  - analysis
+  - silence-on-the-wire
+  - security
+  - python
+  - randomness
 draft: false
+summary: |
+  A playful replay of Zalewski’s “Silence on the Wire” experiment: plotting 3‑D scattergrams of various RNGs (Python, shuf, urandom, online services) to see if any have secretly upgraded their magic. Spoiler: they all look suspiciously alike.
 ---
 
 ## Introduction

content/posts/rsa-optimization.md

@@ -1,7 +1,16 @@
 ---
+author: "Halvo (Human)"
 title: "RSA Optimization"
 date: 2022-12-06
+tags:
+  - rsa
+  - optimization
+  - instruction-set
+  - cryptography
+  - performance
 draft: false
+summary: |
+  A dive into a custom ISA for RSA: modular‑instruction shortcuts, multiply‑subtract tricks, and exponentiation‑by‑squaring hacks that shave a few cycles off the dreaded big‑number math.
 ---
 
 ## INTRODUCTION

content/posts/secure-coding-in-c-summations-concurrency.md

@@ -1,7 +1,17 @@
 ---
+author: "Halvo (Human)"
 title: "Concurrency: Summations of Secure Coding in C and C++"
 date: 2023-01-27
+tags:
+  - concurrency
+  - mutex
+  - threading
+  - c
+  - cpp
+  - secure-coding
 draft: false
+summary: |
+  A light‑hearted rant about why a plain‑old `mutex` is the hero of secure C/C++ concurrency, why `goto` is still secretly useful, and how to keep your locks short and your bugs shorter.
 ---
 
 ## Introduction

content/posts/secure-coding-in-c-summations-file-io.md

@@ -1,7 +1,17 @@
 ---
+author: "Halvo (Human)"
 title: "Concurrency: Summations of Secure Coding in C and C++"
 date: 2023-06-29
+tags:
+  - file-io
+  - secure-coding
+  - c
+  - cpp
+  - permissions
+  - least-privilege
 draft: false
+summary: |
+  A breezy guide to keeping file operations safe: validate paths, lock down permissions, and never let a privileged process wander into a user’s temp folder.
 ---
 
 ## Introduction

content/posts/secure-coding-in-c-summations-free-and-null.md

@@ -1,7 +1,18 @@
 ---
+author: "Halvo (Human)"
 title: "Set to NULL After Free: Summations of Secure Coding in C and C++"
 date: 2022-08-17
+tags:
+  - free-and-null
+  - secure-coding
+  - c
+  - cpp
+  - memory-management
+  - pointers
+  - security
 draft: false
+summary: |
+  A breezy, slightly tongue‑in‑cheek look at why setting pointers to `NULL` right after `free` (and a few related memory‑management niceties) can save you from nasty use‑after‑free bugs, memory leaks, and the occasional midnight debugging panic.
 ---
 
 ## Introduction

content/posts/secure-coding-in-c-summations-null-terminate-2.md

@@ -1,7 +1,16 @@
 ---
+author: "Halvo (Human)"
 title: "Always null Terminate (Part 2): Summations of Secure Coding in C and C++"
 date: 2022-08-13
+tags:
+  - string-concatenation
+  - null-termination
+  - c
+  - cpp
+  - secure-coding
 draft: false
+summary: |
+  The sequel to the null‑termination saga, now tackling `strcat`, `strncat`, `strlcat`, and friends—plus a quick table to keep your concatenations from turning into catastrophes.
 ---
 
 ## Introduction
@@ -10,7 +19,7 @@ Series on summarizing themes in "Secure Coding in C and C++" by Robert C. Seacor
 
 This is written for an audience that has a broad overview of security concepts. Not much time is spent explaining each concept, and I encourage everyone to read the book.
 
-The first theme to discuss is always `null` terminating `char *` or `char array` buffers (unless you have a *very* specific reason for not). This is very important to help prevent buffer overflows, reading arbitrary memory, accessing 'inaccessible' memory. This is part 2 where we will discuss string cat and length. For a brief discussion on string copy see [part 1](/posts/secure-coding-in-c-summations-null-terminate.md).
+The first theme to discuss is always `null` terminating `char *` or `char array` buffers (unless you have a *very* specific reason for not). This is very important to help prevent buffer overflows, reading arbitrary memory, accessing 'inaccessible' memory. This is part 2 where we will discuss string cat and length. For a brief discussion on string copy see [part 1](posts/secure-coding-in-c-summations-null-terminate.md).
 
 ## Functions Needing null
 

content/posts/secure-coding-in-c-summations-null-terminate.md

@@ -1,7 +1,16 @@
 ---
+author: "Halvo (Human)"
 title: "Always null Terminate: Summations of Secure Coding in C and C++"
 date: 2021-09-01
+tags:
+  - null-termination
+  - strings
+  - c
+  - cpp
+  - secure-coding
 draft: false
+summary: |
+  A light‑hearted reminder that every character buffer deserves a `'\0'`—otherwise you’re inviting buffer overflows, stray reads, and a lot of debugging grief.
 ---
 
 ## Introduction

content/posts/stateless-detection-of-malicious-traffic.md

@@ -1,7 +1,16 @@
 ---
+author: "Halvo (Human)"
 title: "Stateless Detection of Malicious Traffic"
 date: 2019-08-23
+tags:
+  - stateless-detection
+  - network-security
+  - traffic-analysis
+  - ids
+  - machine-learning
 draft: false
+summary: |
+  A recap of my master’s thesis that proves you can sniff out nasty traffic using only one‑way packet metadata (TTL, ports, timing)—no payload inspection required.
 ---
 
 ## Introduction

content/prompts/fist-impressions.md

@@ -0,0 +1,17 @@
+Create a blog post based on these notes
+
+These are my fist impressions of using AI tools so far
+
+- Super helpful for summarizing code
+    - Claude
+    - Helps with tracing complicated speghetti and lasagna code
+    - Trace concepts through the code using key words
+- Helpful with documenting code
+    - Claude
+    - A little more detailed than is necissary
+    - However it provides a good summary
+- Great for getting internal information
+    - Uses Gleam trained on internal documents
+    - Instead of having to wait for a human response, it provides a summary, plus links to further information
+    - The further docs is great for verifying the info to check for hallucinations
+