The blog
We write about what we practise: hosting in France, running servers in production, taking over old code, bringing in AI where it helps. Every article is dated and signed.
56 articles · since 2023
On 10 September 2026 Anthropic published the most detailed of its threat reports: seven kinds of misuse, December 2025 to August 2026, from Yemeni missiles to fake dating profiles. One case with figures for each kind, the autonomy spectrum, the guardrails that give way, and what the document leaves out.
Cédric Santiago12 of 56 shown
Over ninety days, 855 commits reached the main branch without going through a merge request, against 63 that did. And that branch triggers the release to production. Measurement, decision, and the four pitfalls we hit while closing the door.
Cédric Santiago
Dependency lock files are the source of truth for security scans. When a build pipeline quietly rewrites them instead of failing, the scan reads the wrong versions and returns a reassuring verdict. How we found out, and what we changed.
Cédric Santiago
Each machine scanned its own images, and nobody could see the fleet. By centralising the analysis on the real inventory (111 unique images instead of 25 local databases), the counter went from 446 to 0 in one evening. The story of a measurement project, not a fixing one.
Cédric Santiago
A theme bought and thrown away twice, migrations reset four times, a framework upgrade that never recovered, a library that went paid, a database replaced, a front end entirely rewritten. On BuyStep, almost everything changed in two years, except the core. Here is what held, and why.
Cédric Santiago
The revolution is not that AI writes code faster. It is that the cost of change has collapsed, and that a project can now change its framework, its database and its front end in three weeks, provided it has paid in advance in guardrails. A dated demonstration on the BuyStep platform.
Cédric Santiago
Rebuilding a 2024 commit today, getting it to start and photographing it: this is not nostalgia, it is documentation that does not lie. The six-stage pipeline we wrote for BuyStep, the pitfalls we had to solve, and why counting remains Git's job.
Cédric Santiago
Bastion, SIEM, immutable backups, deliberate patching, ANSSI self-audit: for six months this blog has documented an infrastructure that a company of our size has no legal obligation to build. The reason fits in four characters. What NIS2 really requires, the state of French transposition in autumn 2026, and how our building blocks line up against the 20 objectives of the ANSSI framework.
Cédric Santiago
1,706 commits, three technology stacks, two databases: on the BuyStep platform, AI assistance went from autocomplete to agents that orchestrate other agents. Four paradigm shifts, dated and measured, and what we take away from them.
Cédric Santiago
A log that stays on the compromised machine is worthless. We deployed Wazuh across the whole fleet in two days: a dedicated VM, twelve-month retention, 38 agents in three waves, and above all tuning that brought the noise down from 1,250 alerts per machine to 8 for the entire fleet. The installer pitfalls, compliance checks in containers, and the home-made detections that really matter.
Cédric Santiago
Panels, batteries, inverters: professional buyers are buried in supplier brochures and short of comparable data. BuyStep answers with an audit structured in 9 dimensions and 200+ criteria, a reliability score and AI-assisted analysis. An overview of the platform, and of what lies underneath.
Cédric Santiago
A Yemeni cell had its guidance software written, launched, failed, and came back to analyse the fault within hours. A Russian team coded a drone swarm able to designate a “person” target and act without a human. A relay platform sent the requests Claude refused on to a more permissive model. The final instalment, with the checklist from the ten days.
Cédric Santiago
Three tool keys on every server, up to six copies on one hypervisor, and no central record of who did what. In one day, we put all fleet administration behind Warpgate, an open-source bastion that records every session. The principle, the architecture, the key consolidation, and the pitfalls that each cost us a round trip.
Cédric Santiago
A French advertising agency ran around seventy fake media outlets and 8,913 articles in twenty languages. A Chinese studio had 4,700 artificial personas chatting with 25,000 real people. An Iranian activist saw his account cloned and his friends approached by a machine that wrote like him. What is left as proof when everything can be manufactured.
Cédric Santiago
A national interception platform written by a lone consultant, the court warrant requirement removed at the client's request, and an account ban that stopped nothing because the software now runs locally. The surveillance chapter of the Anthropic report is the most disturbing, and it says something very concrete about the data you hold.
Cédric Santiago
For years, our server inventory, keys and credentials lived in the cloud of an SSH client vendor. We replaced that rented comfort with a self-hosted web console, connected to our SSO and populated through the API from the cluster. What it changes, what it costs, and the Termix pitfalls the documentation does not mention.
Cédric Santiago
Two Chinese AI vendors had Claude answer their own customers, without the customers knowing. Through that stream passed live credentials for a database linked to the Russian Ministry of Defence, camera footage from Chengdu, and an ordinary developer's API tokens. Seven labs, 151 million exchanges for the largest, networks of thousands of fake accounts. What the distillation chapter of the Anthropic report really says, and what it means for an SME.
Cédric Santiago
Two undergraduates in Changsha ran an automated pipeline that decrypts firmware, decompiles it through thousands of calls, forms hypotheses about vulnerabilities, writes the exploit and tests it in a lab, in a loop, day and night. More than a dozen unknown vulnerabilities in a month on network devices, some fifty organisations targeted, thirteen collection agents on a scheduled task. What this means for an SME's inventory.
Cédric Santiago
A CI pipeline failing intermittently, two different error messages, an obvious suspect that had nothing to do with it, and an invisible cause: a DNSSEC record still published at the parent while the zone was no longer signed. Post-mortem of a nasty DNS failure, with the method that finally settled it.
Cédric Santiago
One French-speaking individual, 42 organisations targeted, 14 networks breached: political parties, media outlets, think tanks and their suppliers. A home-made API key scanner, an agent framework that checks its own work, a WordPress reinstallation flaw, an invisible plugin that encrypts stolen credentials, a webshell hidden among the fonts, booby-trapped backups, a profiling platform with tens of millions of rows.
Cédric Santiago
Agents watched whether antivirus products spotted the implants; when they did, the agents modified and recompiled them on their own until they slipped back under the radar. Other payloads froze the machine's security updates. The Anthropic report calls this inverting the cost back onto defenders. Why signature-based detection is no longer enough, and what an SME adds to it.
Cédric Santiago
One stolen developer token, three hours, and the attacker is administrator of the entire cloud environment. 2,100 sets of tokens harvested from 40 customer organisations in 34 hours. One software vendor compromised, 200 of its customers plundered as a knock-on effect. The Anthropic report breaks down the full cycle of an intrusion, from reconnaissance to resale. Here is what it contains, and the questions to put to your suppliers.
Cédric Santiago
The IT hygiene guide from ANSSI, the French national cybersecurity agency, comes down to 42 free and concrete measures. We ran the exercise on our own infrastructure, without going easy on ourselves: method, scoring grid, and the most instructive result: our gaps were not where we expected them.
Cédric Santiago
Resellable loot, free compute and cover: a stolen API key provides all three at once. 1.8 million Android apps decompiled to find them, fake “cheap Claude” resellers who install a credential stealer, a hijacked evaluation sandbox, then some thirty AI companies attacked in four days. What this means for an SME that uses an assistant.
Cédric Santiago
26% of French small businesses and SMEs protect their remote access with a second factor, 16% have a detection system, 31% an incident procedure. In Alsace, the Region, the European Collectivity of Alsace and a Strasbourg hospital group have already been hit. The market standard for hosting and managed services does not match the threat of 2026. Here is what we do on top, why, and what it really costs.
Cédric SantiagoOn 10 September 2026 Anthropic published the most detailed of its threat reports: seven kinds of misuse, December 2025 to August 2026, from Yemeni missiles to fake dating profiles. One case with figures for each kind, the autonomy spectrum, the guardrails that give way, and what the document leaves out.
Cédric Santiago
There are three doctrines: do nothing, automate everything blindly, or look first and then decide. We removed unattended-upgrades from the whole fleet and dismantled our own automatic patching with Ansible, in favour of a “visibility first” doctrine backed by PatchMon. Why, how, and the routine that goes with it.
Cédric Santiago
On 17 March 2026, ANSSI published the Référentiel Cyber France (French cyber framework): 20 security objectives, four pillars, an operational translation of NIS2 before the law even exists. Many companies wonder whether they are concerned, and what they risk. A clear answer in three questions, a jargon-free reading of the 20 objectives, and the five to start with even when nothing obliges you to.
Cédric Santiago
“How many critical vulnerabilities are running in your systems right now?” For a long time, we could not answer. Today, every Monday: a Trivy scan of the ~97 images actually in production, noise triage, the count of critical findings in the e-mail subject line and a PDF audit report. The complete architecture, which you can replicate.
Cédric Santiago
A 27-year-old bug in OpenBSD, a 16-year-old one in FFmpeg, 23,019 issues found in a few weeks across a thousand open-source projects. Frontier models now find flaws faster than anyone can fix them, and two vendors have just acknowledged it officially. What Project Glasswing, GPT-5.6-Cyber and GPT-6 Astra really say, and what an SME server should conclude from it as of Monday.
Cédric Santiago
An audit of our own fleet showed it: machines with the firewall “enabled” on their interface were in fact open to the world. The Proxmox firewall requires two conditions, not one, and datacenter rules never protect guests. Anatomy of the trap, a one-command check, and the complete recipe.
Cédric Santiago
August 2025: a single operator extorts 17 organisations with a coding agent. September: an espionage campaign in which AI does 80 to 90% of the work. November: malware that queries a model while it runs. And this week, two models officially cross the “critical” threshold in cybersecurity. What the reports say, with sources, and what it changes for an SME.
Cédric Santiago
One night, fourteen confirmation e-mails went out from a site we host to addresses that had asked for nothing. The captcha was solved, the per-recipient cap bypassed, rate limiting useless, CrowdSec blind. A full reconstruction from the logs: what the bot was doing, how we recognised it, and why the only real countermeasure was to take its weapon away.
Cédric Santiago
Circular of 5 February, decree of 14 April, interministerial seminar on 8 April, ministry plans due before the autumn: in a few months, the French state has turned tech sovereignty into an enforceable purchasing doctrine. An analysis of what is really at stake, and of what it changes for an SME or a municipality.
Cédric Santiago
Every form needs spam protection, but the reCAPTCHA reflex sends your visitors to Google, and Turnstile sends them to Cloudflare. ALTCHA does the same job self-hosted: proof of work, no cookies, no third party, GDPR compliant by design. Lessons learned, with figures, from our own forms.
Cédric Santiago
For two and a half months, a hypervisor piled up replication timeouts without any disk being “dead”. The culprit: the Power Loss Protection capacitors of an NVMe drive, which had failed silently. A full post-mortem: from the symptom to smartctl, from the OVH replacement to the resilver that uncovered 20,000 latent errors.
Cédric Santiago
Enabling Proxmox high availability takes five minutes. Understanding it cost us outages: containers that never live-migrate, failback without which machines never come back, priorities read the wrong way round, and the qm stop that stops nothing. Lessons from a production cluster with 31 HA resources.
Cédric Santiago
Three of our production applications (a CRM, a back office, a lead qualification tool) run on an LLM we host ourselves. The architecture, the real pitfalls (grammars that loop, temperature that matters more than the prompt) and what “sovereign AI” means when you practise it instead of talking about it.
Cédric Santiago
When your ISP has given you a 100.64.0.0/10 address and you can no longer open a single port. Five workarounds compared, why Cloudflare Tunnel is not a sovereign option, and a step-by-step guide to the VPS + WireGuard + socat setup with end-to-end encryption.
Cédric Santiago
Installing fail2ban takes five minutes; making it work properly in production is another story. The journald backend, progressive banning, HTTP jails behind a reverse proxy, and the pitfalls we have lived through: the real client IP, the corporate proxy you must never ban, the nftables restart that wipes everything.
Cédric Santiago
Everyone has “backups”. Almost nobody knows how long it would take to restart, in what order, or who decides. RTO, RPO, written procedures, drills: the real content of a disaster recovery plan at SME scale, without consultancy jargon, with what we run in production.
Cédric Santiago
A decision guide to stop guessing. Isolation differences, the security consequences of a shared kernel, the Docker-in-LXC trap, AppArmor profiles and privileges, memory footprint compared and a five-question decision grid.
Cédric Santiago
On 12 June 2026, Washington forces Anthropic to cut off Claude Fable 5 and Mythos 5 for the whole world. The view of a developer who hosts in France: why building your business on an American AI is a dependency, and how to take back control.
Cédric Santiago
A practical guide to building an enterprise-grade backup policy with Proxmox Backup Server. zstd compression, a multi-level retention grid, deletion protection and an automatic audit of forgotten VMs through the pvesh API.
Cédric Santiago
On 4 June 2026, the European Parliament replaces Google with Qwant on its workstations. A strong gesture for tech sovereignty, except that Qwant remains largely a layer on top of Microsoft Bing. The view of a developer who hosts in France.
Cédric Santiago
A technical comparison of the three leading self-hosting platforms: Proxmox as a compute hypervisor, TrueNAS as a ZFS NAS and Unraid as a consumer-friendly disk array. Architecture, virtualisation, storage, licensing and a decision tree to choose the right base.
Cédric Santiago
A ZFS pool is only reliable if its scrubs run, and on a minimal install the cron package may be missing: tasks placed in /etc/cron.d then never run, silently. How to check in thirty seconds, and the clean fix with systemd timers, scrub and TRIM included.
Cédric Santiago
On 27 May 2026, Brussels presents the Tech Sovereignty Package to restrict the use of AWS, Azure and Google for sensitive public data. An analysis of the CADA and Chips Act 2.0 measures, their scope, and what they change for your IT projects.
Cédric Santiago
Three copies, two media, one offsite, and above all one copy that nobody can modify, not even you. Why ransomware has changed the rules of backup, what the 3-2-1 rule is really worth in 2026, and the architecture we run, tested restores included.
Cédric Santiago
Transcribed meetings, auto-written e-mails, generated designs: behind the pressure to go all-AI lies a facade of productivity. The view of a freelancer tired of the prevailing FOMO.
Cédric Santiago
A cookie banner is not a legal duty, it is the result of a tracking choice. A five-question self-audit, HTTP hardening headers, self-hosted Matomo with Docker Compose, a comparison of Plausible, Umami and GoatCounter, recent fines from the CNIL (the French data protection authority) and the GDPR obligations that remain.
Cédric Santiago
Taxi Ghis case study: how I replaced a bloated American SaaS with a self-hosted Next.js stack, 100% European, with zero tracking cookies and zero databases.
Cédric Santiago
The Cloud Act comes up in every hosting discussion, often distorted. What the US law really allows, why a data centre in Paris offers no protection if the parent company is American, what the GDPR says in response, and how to get out of its reach in practice.
Cédric Santiago
Uptime, RTO, RPO, a 99.9% service level, monitoring, tested backups, disaster recovery, guaranteed response and restoration times: what “reliable” means in practice, in figures and written commitments.
Cédric Santiago
Why data location really matters: what the US Cloud Act is, why “hosted in Europe” by an American company is not enough, and how Sanfytech hosts under European jurisdiction, in France, with GDPR, backups and measured availability published on the managed services page.
Cédric Santiago
Moving an OVH Proxmox template from LVM to ZFS to enable replication between nodes. Critical pitfalls to avoid (data destruction, ARC memory, zstd compression), pool monitoring, automatic monthly scrubs and an asynchronous replication strategy.
Cédric Santiago
A complete tutorial for installing Proxmox VE 8 on a Hetzner dedicated server without an official template. Debian 11 to 12 upgrade, PVE repositories, IP and hostname configuration, pve-kernel and clean-up.
Cédric SantiagoWhat next
Describe what you need in a few lines. We will tell you what is feasible, with a timeline and a price range.
Reply within 24 working hours, from one of the two founders. Or by phone: +33 7 59 96 14 99.
