Security & Systems Correspondent
Nicholas Tong
Houston security engineer who reviews the gear his own network runs on, and what happens to it when the power goes out.
- Beat
- Cybersecurity, infrastructure, hardware, developer tooling
- From
- Houston, Texas
- On the list
- 46 items
The checklist
-
01
YubiKey 5 NFC
YubiKey 5 NFC: boring on purpose
Somewhere in a ticketing system I no longer have access to, there is a ticket from March 2016 that says, in full: "user locked out, forgot password, forgot security answers, please...
-
02
Bitwarden
Bitwarden: the free tier is the product
In December 2022, LastPass disclosed that an attacker had copied encrypted customer vault backups, along with some fields that were not encrypted, like site URLs. I was three...
-
03
1Password
1Password and the second secret
I got 1Password wrong for about two years. I had it filed in my head as the expensive closed-source one, a subscription tax for people who liked rounded corners, and I said as much...
-
04
KeePassXC
KeePassXC: a file, and everything that implies
There was a USB stick taped under a desk at the MSP, in an office that smelled like burnt coffee and toner, with a label in silver Sharpie that said AMBER DO NOT FORMAT. Amber was...
-
05
Mullvad VPN
Mullvad: a sixteen digit number is the whole account
The best identity model I have ever paid money for arrived as a sixteen digit number and nothing else. No email address, no password, no name, no recovery question about my first...
-
06
Proton VPN
Proton VPN: the free tier is the actual product
You install the free tier on your mom's phone because she clicks things. It takes four minutes, there's no card involved, and she will never notice it running. That is the whole...
-
07
ExpressVPN
ExpressVPN: the thing behind the ads
This company's name showed up eleven times in one week of my podcast queue, and I only commute down Bellaire twice a day. Same read, different shows, sometimes followed by a...
-
08
Proton Mail
Proton Mail: what encrypted email actually encrypts
The notification arrived at 6:12pm on a Tuesday: someone had signed into my father's email from a country he has never visited. His password was our old street number plus the year...
-
09
Tailscale
Tailscale: the tool that deleted my port forwards
For six years my jump box was a $4 a month VPS in a Dallas datacenter, hostname bayou-1, port 22 open to the entire internet and guarded by fail2ban, a 32-character password, and...
-
10
Synology DS224+
Synology DS224+: two bays is a math problem
Two bays is a math problem before it's a product. Bay one holds your data. Bay two mirrors it, so you can survive one dead drive and zero dead files. I ran the DS224+ as my...
-
11
QNAP TS-464
QNAP TS-464: the box with a reputation
The QNAP I inherited had been exposed to the internet for three years before I saw it. A sign shop off Telephone Rd, the NAS living on top of a filing cabinet next to a laminated...
-
12
WD Red Plus 8TB NAS drive
WD Red Plus 8TB: what a NAS drive actually promises
The alert line that ended a Saturday, verbatim from the mail I got at 23:47: 197 Current_Pending_Sector 4. Disk 3, of four red drives in the office NAS. Four pending sectors is...
-
13
Backblaze Computer Backup
Backblaze Computer Backup: the product is the restore
The report email lands at 3:06am every night, subject line announcing that my computer is backed up, and I have read it most mornings for four years, because the night it stops...
-
14
Raspberry Pi 5
Raspberry Pi 5: the hobby board grew a datacenter problem
The thermal warning appeared forty seconds into the first boot, in a codebase I didn't write, on a board sitting on my desk in a room the air conditioner considers optional. Forty...
-
15
Samsung 990 Pro SSD
Samsung 990 Pro: the flagship drive and the firmware problem
In January 2023, owners of a drive that had been on the market for three months started posting the same thing: SMART health dropping years early. Not the usual consumer SSD stuff...
-
16
Samsung T9 portable SSD
Samsung T9: the portable drive and the port problem
Every June the offsite drive rotates into a fire safe at my parents' house on the west side, because hurricane season starts whether your backups are ready or not, and the drive...
-
17
Framework Laptop 13
Framework Laptop 13: the repair path is the product
Twenty-two screws, one stripped, and the whole thing lay open on my kitchen table at 9pm on a Tuesday: the old mainboard out, the new one in, a cooler of the exact same dimensions...
-
18
used Lenovo ThinkPad T480
The used ThinkPad T480: buying someone else's write-off
The laptop I'm typing this on cost less than the chair it sits on. Lenovo ThinkPad T480, bought off eBay in 2024 from a refurbisher in Dallas for under $200, i5, 16GB I added...
-
19
Minisforum UM790 Pro mini PC
Minisforum UM790 Pro: the desktop in a paperback's body
The box idles at 9 watts with a fan I can hear only when the house is silent, and my house is never silent, so effectively never. That idle number is the entire reason this...
-
20
ZimaBoard 832 single-board server
ZimaBoard 832: it wants to be your firewall, and it shouldn't be
There's a white LED on the edge of this board that shines on the wall behind my desk, all night, every night, and I only found out at 2am during a thunderstorm, when the power...
-
21
Protectli VP2420 firewall appliance
the fanless box that stands between my house and everything else
The SSD in my old firewall died on a Tuesday at 1:15am. I know the time because that is when the ping monitor gave up and my phone lit up with six alerts that all said the same...
-
22
HP EliteDesk 800 G4 mini as an OPNsense firewall box
the second computer hiding inside your firewall
The machine was off. I know it was off because I had held the power button down until the fan stopped, and I was standing in front of it watching the light go dark. Then I ran nmap...
-
23
Ubiquiti UniFi Dream Machine SE
one box, four jobs, one power supply
The little screen on the front of my firewall was showing me a cartoon of my own network. Ports, arrows, a little camera icon, all drawn on a 1.3 inch touchscreen, in a closet, at...
-
24
Ubiquiti UniFi U6 Pro access point
the wire inside your wifi
For three Tuesdays in a row, my access point dropped off channel 100 at almost the same hour, mid-afternoon, for a few minutes at a time. Nothing else on the network noticed...
-
25
Ubiquiti UniFi Protect camera system
where the footage lives
A police officer knocked on my door at 7pm on a Tuesday and asked for footage from the camera above my garage. Something had happened across the street around 4am and he needed...
-
26
GL.iNet Flint 2 (GL-MT6000) router
the router that asked permission
During setup, the Flint 2 asked whether I wanted to bind it to a cloud management account. I said no. It finished setup anyway, gave me a working network, and never mentioned the...
-
27
ASUS RT-AX86U Pro router
the gaming router problem
In May 2025, CISA and MS-ISAC put out an advisory about attackers working over ASUS routers, and the part that stayed with me was not the exploit. It was the persistence. The...
-
28
TP-Link Deco XE75 mesh
the dead zone behind the rice cookers
My aunt's shop on Bellaire had a dead zone exactly where they stacked the rice cookers, and the register sat inside it. Wi-Fi died at the stockroom door. Every few weeks somebody...
-
29
Amazon eero Pro 6E
the router that never stops talking
I put a managed switch with a span port in front of my eero for one evening, mirrored the traffic to a laptop, and watched it with a packet analyzer. Here is what I saw. The eero...
-
30
Netgear Nighthawk RAX80
the end of support list
In April 2021, Netgear published a list of routers it was not going to patch anymore, and a friend called me that week because his model was on it. He had bought that router on my...
-
31
APC Back-UPS Pro BR1500MS2 UPS
the battery was dead the whole time
When Beryl came through Houston in July 2024, my block went dark at 4am and the UPS under my desk started beeping every thirty seconds, which is exactly what it is supposed to do...
-
32
Anker 555 USB-C Hub (8-in-1)
Anker 555 USB-C hub: the dongle is a small computer
The first time I plugged this hub into a client's MacBook, macOS popped a dialog asking whether I wanted to join a new network. Not the hotel wifi. A new network, created by a $80...
-
33
TESmart dual-monitor KVM switch (2-port HDMI class)
TESmart dual-monitor KVM: six cables and one trust boundary
There are six HDMI cables behind my desk right now, and every one of them is labeled with tape I cut from a garbage bag. That's not an accident and it's not me being precious...
-
34
Logitech MX Master 3S wireless mouse
Logitech MX Master 3S: the mouse that wants to be middleware
At 3:07am during a patching window last year, I fixed a stuck deployment by pasting a curl command from my personal laptop onto the work one, and the paste worked because my mouse...
-
35
Keychron Q3 mechanical keyboard
Keychron Q3: the keyboard that doesn't phone home
Three months into owning this keyboard, a coworker zoomed in on my screen during a demo and photographed my backspace key, because it doesn't say backspace. It says "backs pace,"...
-
36
Audio-Technica ATR2100x-USB microphone
Audio-Technica ATR2100x-USB: the mute switch is a guess
The switch on the bottom of this microphone goes clack, an actual audible mechanical clack, and that clack is the only indication of anything, because the little light on the...
-
37
Ring Video Doorbell (battery)
Ring Video Doorbell: the footage doesn't live at your house
In 2017, an employee of Ring spent about three months watching videos from customers' cameras, and the FTC's complaint documents what he searched for: cameras named "Master...
-
38
Eufy S330 eufyCam 3 (with HomeBase 3)
Eufy S330 (eufyCam 3): what local actually means
The clip I care about most from this camera is eleven seconds of a possum climbing into the bird box the previous owners left on my fence, and I have watched it maybe six times...
-
39
Wyze Cam v4
Wyze Cam v4: the camera is $36, the cloud is the product
On February 16, 2024, Wyze's servers went down, and every camera they sold went blind with them. The outage itself was a normal Tuesday in this industry. What came after wasn't: as...
-
40
August Wi-Fi Smart Lock (4th generation)
August Wi-Fi Smart Lock: your deadbolt, motorized, with opinions
It's 11:20 on a weeknight and I'm standing in the garage in socks, holding a phone, watching the app say "connecting" in the font that has never once delivered good news. The wifi...
-
41
Odroid H4
the backup box that became the main box
The swap happened at 2am on a Tuesday in March, which is when all of mine happen. The little Intel box that runs my VPN endpoint and my DNS had been sitting on a shelf as a cold...
-
42
Netgate 1100 pfSense+ appliance
the firewall my parents run is smarter than the one I run
The ISP modem at my parents' house died on a Sunday in April, right before a storm cell came through, and my dad called me the way he calls me about anything electrical: as a fact...
-
43
TP-Link TL-SG108E managed switch
the forty dollar switch that taught me VLANs are a habit, not a product
The first VLAN I ever built at home was built because a smart plug from a clearance bin at a store on Bellaire started talking to an IP range I could not explain at 3am, on a night...
-
44
WireGuard
the crypto was never the hard part
For two years at the MSP I carried a pager that was, functionally, a subscription to one IPsec tunnel. It linked a client's warehouse to their office across town, and every second...
-
45
Cryptomator
encrypt the files, not the disk
The vault that mattered was a folder of my parents' scanned paperwork. Passports, tax records, the deed, all photographed on a Sunday afternoon with a phone and a lamp, because my...
-
46
Flipper Zero
the toy that makes the front page, the tools that make the breach
The demo that sold me was not the TV rebooting. It was the door. A colleague held a chunky white plastic thing with a dolphin on the screen up to our office badge reader, pressed a...