How Real-time Blacklists (RBLs) have evolved well beyond simple IP reputation: domain-based RBLs flagging malicious links, email address RBLs tracking rotating scam senders, cryptocurrency wallet lists identifying ransomware payment addresses, ESP account monitoring catching abuse of mail-sending platforms, and phone number blocklists flagging disposable numbers used in fraud. The talk also covers Fuzzy Hash RBLs, a newer technique that detects template-based spam through similarity matching - producing a compact signature usable in ordinary DNS queries, with a false positive rate around 9 × 10^-10 at a 100% similarity threshold. Much of this work is what powers BTC Black.

Presented at the Deliverability Summit 2026, Casa Milà – La Pedrera, Barcelona.

Download the slides (PDF)

A look at how spam and the techniques used to fight it have evolved over the years, from simple keyword filters to today's layered defenses, and where the arms race between attackers and defenders stands now.

Download the slides (PDF)

An introduction to "The Apache Way": the governance model, meritocracy, and consensus-driven community principles that the Apache Software Foundation uses to run its 300+ projects, and why they matter for the long-term health of an open source project.

Download the slides (PDF)

A tour of what's new in Apache SpamAssassin 4.0: rule engine and Bayes improvements, new plugins, and changes worth knowing about when upgrading from the 3.4.x series.

Presented at ApacheCon Asia 2022.

Download the slides (PDF)

How the ACME protocol and Apache httpd's mod_md module work together to make obtaining and renewing TLS certificates fully automatic, removing one of the most common sources of outages: expired certificates.

Presented at ApacheCon Asia 2021 - see the session page.

Download the slides (PDF)

How to use Puppet to manage large, consistent deployments of SpamAssassin and MIMEDefang across many mail servers: configuration drift, rule distribution, and keeping antispam infrastructure reproducible at scale.

Presented at PuppetCamp 2020, Netherlands.

Download the slides (PDF)

An overview of what it takes to fight spam in production: rule tuning, Bayes training, reputation systems, and the trade-offs between false positives and false negatives when filtering mail at scale.

Presented at Open Source Summit Europe 2018, Edinburgh.

Download the slides (PDF)

A comparison of two system call restriction mechanisms: Linux's seccomp(2) and OpenBSD's pledge(2). Covers how each is designed, how they're used in practice to reduce a process's attack surface, and where their design philosophies diverge.

Presented at Open Source Summit Europe 2017, Prague.

Download the slides (PDF)

How pledge(2) works under the hood, and the process of adopting it across OpenBSD's base system utilities to restrict each program to only the system calls it actually needs.

Presented at pkgsrcCon 2017, London (main conference day, July 1, 2017).

Download the slides (PDF)

Using the ELK stack (Elasticsearch, Logstash, Kibana) to centralize logs from a fleet of servers and mail filtering appliances, and turn them into searchable, visualized data instead of scattered flat files.

Presented at LinuxCon Europe 2016, Berlin.

Download the slides (PDF)

An introduction and overview of LibreSSL, covering the motivations behind the OpenSSL fork — including CVE-2014-0160 (Heartbleed), which affected roughly 17% of https web servers running OpenSSL with the heartbeat extension enabled, along with products from vendors like Cisco, Fortinet, Oracle, and Siemens.

Presented at the International Cryptographic Module Conference (ICMC) 2016, Ottawa, Canada.

Download the slides (PDF)

Practical guidance on hardening and correctly using OpenSSH: key management, authentication methods, and configuration choices that keep remote access secure without getting in the way.

Presented at Open Source Day 2015, Università degli Studi di Udine.

Download the slides (PDF)

An introduction to OpenSMTPD: design goals, configuration syntax, and how it compares to more traditional mail transfer agents in terms of simplicity and security.

Presented at LinuxCon Europe 2015, Dublin.

Download the slides (PDF)

A status update on LibreSSL about a year after the fork from OpenSSL: what had been cleaned up, what portability work had landed, and how the project was tracking against its original security-focused goals.

Presented at CeBIT 2015, Hannover.

Download the slides (PDF)

An introduction to LibreSSL shortly after the OpenBSD project forked it from OpenSSL: the motivations behind the fork, the initial code cleanup effort, and the security issues it aimed to address.

Presented at the Università degli Studi di Udine.

Download the slides (PDF)

An introduction to npppd, the PPP and tunneling daemon included in OpenBSD since 5.3, supporting PPTP, L2TP, and PPPoE with authentication against a local file or a remote RADIUS server. Covers configuration file syntax, local and RADIUS-backed authentication (including IPsec-secured setups), monitoring active sessions with npppctl and ifconfig, integration with OpenBSD's packet filter, and Windows client compatibility considerations (DNS, Kerberos, MTU, NAT-T).

Presented at BSD Day, Institute of Biostructures and Bioimaging, Napoli, Italy.

Download the slides (PDF)

An introduction to relayd, OpenBSD's load-balancing daemon: reverse proxying, SSL-accelerated reverse proxying, transparent proxying with filtering, application redirection, load balancing, and WAN link balancing. Covers the three-part architecture — the Host Check Engine (ICMP/TCP/SSL/HTTP checks), the PF Engine (dynamic firewall rule management), and the Relay Engine — along with practical configurations for reverse proxying, transparent proxying, MySQL redirection, and DNS load balancing.

Presented at BSD Day, University of Applied Sciences, Vienna, Austria.

Download the slides (PDF)