Infrastructure · Security · Engineering
The interesting problems are rarely the ones with obvious answers.
Writing about infrastructure, security, and the engineering assumptions underneath the systems we build.
Featured
The Castle Was Never the Problem
Why thinking about cybersecurity as a castle can make us misunderstand modern infrastructure.
Hope Akpabio · 10 min read · Security
Read articleRead
Latest thinking
Multi-Layered Hardening for Kubernetes: Why Each Layer Has to Be Tested on Its Own Terms
A hardened Kubernetes cluster is not the sum of six checklists completed once. It is six layers that each need to be tested on their own terms, because none of them defends the others.
17 Sep 2026 · 13 min read
Observability Isn't the Same Thing as Logging
Logging tells you what a system said about itself. Observability is being able to ask a question you didn't anticipate and still get an answer.
8 Sep 2026 · 10 min read
The Security Control That Worked Too Well
Effectiveness and accountability are not the same property. A control can have both, or either, or neither, and the failure mode of 'either' is easy to miss.
24 Aug 2026 · 9 min read
Cloud Firewall Logs Everything, Except What It Drops
Closing out ten months of testing Alibaba Cloud with the same question the series opened on: a control that stops something is not automatically a control that tells you about it.
11 Aug 2026 · 10 min read
When Prevention Isn't Detection
Most security stacks conflate 'we stopped it' with 'we understood it.' The gap between those two claims is where the expensive incidents live.
20 Jul 2026 · 10 min read
Series
Security, Reconsidered
Things I thought I understood about infrastructure security until I started testing them.
- 01I Thought Security Meant Blocking the Attack
- 02The Castle Was Never the Problem
- 03When Prevention Isn't Detection
- 04The Security Control That Worked Too Well
Build
The Lab
Experiments, tests, and practical investigations behind the ideas.
When a validating admission webhook blocks a request, does the cluster retain enough evidence to reconstruct what was attempted, by whom, and how many times?
Short form
Ideas
Short thoughts I’m still working through.
About Hope
How do we know our systems are actually doing what we think they’re doing?
I’m Hope, a DevOps and cloud engineer working across infrastructure, security, and reliability. UNRESOLVED is where I write up what I test.
More about HopeOne idea worth thinking about.
Occasional essays on infrastructure, security, and engineering. No generic news roundup. Just ideas worth your attention.