Anything can talk to anything: the Kubernetes default quietly expanding your blast radiusPart of the Kernel-Native Kubernetes Security series. This one is not specifically about Nyx. It is about a security assumption hiding inside many Kubernetes clusters, and a free hands-on lab you can run on your laptop in about an hour.8 min read·blog.tracenyx.ai83ANJul 29
Getting a kernel driver through Microsoft certification as a bootstrapped startupPart of the Kernel-Native Kubernetes Security series. Friday's post explained why Nyx's Windows enforcement runs as a Windows Filtering Platform callout driver in the kernel. This one is about what it took to make that driver legitimate — the certification gauntlet Microsoft requires before a production Windows Server kernel will load your code. It's a story about walls, and about the tool we built and open-sourced when we hit the last one.8 min read·blog.tracenyx.aiJul 6
Why eBPF stops at the Windows node boundary — and what we built insteadDay two of Nyx being public. Yesterday was the announcement; today is the technical story behind the one claim in it that raises eyebrows: kernel-level network security with behavioural parity across Linux and Windows Server nodes. This post explains why that's rare, why it's hard, and how we approached it.7 min read·blog.tracenyx.aiJul 2
How Zero Trust Egress Policy Contains a Supply Chain Attack — The Axios npm CaseAn honest look at what zero trust egress policy stops in the Axios npm supply chain attack — and what it can't. With real NyxNetworkPolicy exmapless7 min read·blog.tracenyx.aiApr 10
