DDaniel Powley11h ago · 4 min readThe A-Z Weekly Wrap: 30th October 2026Welcome to this week’s atozazure weekly wrap for the 30th October 2026. Below are all the key platform changes, additions and retirements for the past week. AI & Machine Learning Microsoft Copilot Hablog.atozazure.com
SsoftverseAdmin3m ago · 10 min readAWS IAM Least Privilege in 2026: A Practical Guide for DevOps Engineers (Without Breaking Production)TL;DR Least privilege is a loop, not a policy you write once: grant what a workload demonstrably needs, watch what it actually uses (CloudTrail), remove the rest, repeat. Prefer roles and temporary cdevopsenginer.hashnode.dev
IInstaTunnel18m ago · 13 min readAfter the Quick Tunnels Moment: What Account-Less Tunnels Get Right, and Where They StopOn September 18, 2026, a link to Cloudflare’s Quick Tunnels page climbed to the top of Hacker News, collecting more than 800 points and 300 comments, according to Cloudflare’s own write-up. Two weeks instatunnel.hashnode.dev
CCharles Smith13h ago · 15 min readFive Security Lessons My Homelab Taught Me, and Why Enterprise Teams Should CareThere's a running joke in the homelab community: “I run more zero-trust controls at home than my employer does.” It's a good line. It's also not quite the right comparison. A homelab has none of thechuckworks.hashnode.dev
EElay osetrov56m ago · 4 min readYour vendor review asks where the data lives. It doesn't ask what the agent can do.Most vendor security reviews were written for tools that store data. AI agents also act: they read content nobody vetted, hold credentials, and call tools. A questionnaire that stops at "where is datasetrov.hashnode.dev
JJaden Vo1h ago · 8 min readHow Authenticator-App 2FA Codes Actually Work: Build a TOTP Generator in ~30 Lines (and Why It Beats SMS)TL;DR: An authenticator-app code is just HMAC-SHA1(secret, floor(unix_time / 30)), chopped down to 6 digits. The spec is RFC 4226 (HOTP) plus RFC 6238 (TOTP), and the whole algorithm fits in about 30 jadenvo259.hashnode.dev
EElay osetrov6h ago · 4 min readYour AI agent just did something it shouldn't. Here's the first hour.Picture the message in your team chat: "Why did the support bot email a customer's invoice to an address nobody recognizes?" If your agent can call tools, this will happen to you in some form. It mighsetrov.hashnode.dev
VVictor Borring7h ago · 12 min readDesigning Privacy-Preserving Employee SurveysA survey does not become anonymous because you remove the name field. That is probably the most important architectural lesson in this kind of system. An employee may submit a form containing no obviovictorbvieira.hashnode.dev
EElay osetrov3h ago · 3 min readCan user A's question pull user B's documents? A tenant-isolation checklist for RAGMost RAG data leaks don't need a clever attacker. They need one missing filter. A shared vector index, a retrieval call that forgot the tenant_id, a semantic cache keyed only by the question text, andsetrov.hashnode.dev
VVivek Chhediya4h ago · 8 min readThe Support Agent That Obeyed a Web PageMeet "Northwind Support," a fictional mid-size SaaS company with a lean support team and a growing ticket backlog. To cope, they built an AI agent with four capabilities: Read incoming tickets and cuvivekchhediya.hashnode.dev
