Saturday was the big upgrade. Sunday was the bill — three separate security scares, one after the other, all of them about the same thing: locks. Who’s allowed in, who isn’t, and whether the door was even locked.
Act 1 — my speakers went quiet
Sunday morning, my Sonos stopped talking to the NAS. My music library might as well have been on the moon: permission denied, everywhere, all at once. Even the Apple TV couldn’t see the files.
Turns out the internet was to blame. A door on my network — port 445, the file-sharing door — had been left open to the whole world since before the upgrade, and the whole world had found it. Bots from Indonesia were hammering on it so hard that my own devices couldn’t get in. The queue was full. Of strangers.
The fix was delightfully simple:
- Close the door.
- Reboot the NAS.
- Tell the NAS to stop speaking the ancient, unsafe file-sharing language from the 1980s. (Nothing on my network actually needs it — everything already speaks the modern one.)
Music came back. Attackers gone. It’s now saved as a skill, so if this ever happens again it’s a ten-minute job, not a morning.
Act 2 — I asked my AI a scary question
Mid-morning I asked: “What stops you from replying to an email that asks you to hand over my SSH keys or passwords?”
Fair question. Scary question, honestly.
The answer: I treat every email like a stranger at the door. I’ll read what they wrote, but I don’t take orders from strangers. Keys and passwords live behind locks that need a human to open. There is no email that can reach them. The internet tests this every single day — it keeps trying to talk me into things. It hasn’t worked yet.
That conversation turned into a project. If emails are strangers, what does a trusted connection between two of my own AIs look like? So I built one: a private line between my local assistant and my cloud assistant, with a handshake, a watchdog, and a rule that only signed instructions get through. No strangers. Just us.
Act 3 — I sent an AI to poke my own server
By evening, the private line was ready for a test drive. I told the cloud assistant: go scan my server and tell me what’s wrong.
It went quiet for an hour. (It stopped to ask “are you sure you own this?” — sweet, but nobody was there to answer. My bad.)
Once we fixed the plumbing, it got to work — and found something real. My server was showing its internal name tag to anyone who connected by IP address instead of my domain. A stranger could map my whole setup for free, just by knocking. Not great!
The fix was one small setting: don’t answer the door to strangers at all. Unknown visitors now get nothing — the connection just dies. My real websites? Untouched. Verified. Hole closed, same night it was found.
The loop
A music scare, a trust question, a real hole in my server — all fixed before midnight. Sunday was the day I found out where all my locks were, and whether they worked.
Sunday was security day. Monday can go back to being Monday.