Loading today’s stories
Build1 distinct publisher2 min readPublished
A developer scanned their own MacBook from a second machine on the same network. The parts macOS ships were invisible; the exposure that stayed open was the dev servers they had left running, wider than they thought.
The Engineer · Build desk
build
Three services you can delete: queue, cache and search in one Postgres1 distinct publisher
build
Four control planes, one Postgres: a team's case against polyglot persistence1 distinct publisher
build
The 680 MB database that was really a 17 GB disk: self-hosted support platforms fail at month six1 distinct publisher
security
A misconfigured GitHub Actions workflow handed TeamPCP the token that poisoned five ecosystems1 distinct publisher
Compiled by The EngineerSomething wrong?How this is made
Ninety-nine percent of the scanned surface came back filtered, which is the number that makes the result look healthy. [16] The exposure that survived came from two processes the developer had started for local work and never shut down, not from anything macOS ships. [3]
The reason "block all incoming" failed to hide them is that it does not close the port. Send a curl at 3012 and the TCP handshake completes; the reset arrives only when you send the first byte. [4] macOS lets the kernel finish the handshake for an unsigned binary like node before the application firewall drops the payload. [5] The reset itself does almost nothing, but by then the scanner has recorded that a process is listening on 3012. [6] This port answered before it declined, whereas a closed port stays silent.
So the bind address, not the firewall, is what keeps a dev server private. `python3 -m http.server 4444` with no `--bind 127.0.0.1` listens on 0.0.0.0, and from another machine the port simply opens. [8] The same missing flag is how an unauthenticated Redis, bound to 0.0.0.0 or published with Docker's `-p 6379:6379`, hands `KEYS *` and `CONFIG SET` to anyone who can route to it. [9] MongoDB on 27017, Elasticsearch on 9200, Memcached on 11211 and the Docker API on 2375 are the same class of exposure. [10]
The rules also rot. `socketfilterfw --listapps` returned about seven stacked block-incoming and allow-incoming entries for node alone, accumulated over ordinary development. [7] You cannot reason about a control whose rule set you no longer recognize.
Context that changes the reading: this scan ran against the Mac in its at-home state, where the author's own tool, RoamSwitch, keeps protection loose so AirDrop and file sharing work, and tightens to full lockdown only on unknown networks. [14] At home, then, the firewall is mostly not a shield at all. [15] That is a defensible trade. But it means the bind address and always-on detection carry the load the firewall has put down.
And the home LAN is not the trusted zone the loose setting assumes. From the ThinkPad, scapy sent forged ARP replies claiming the gateway's address, and the Mac's cache flipped to the attacker's MAC in about three seconds, enough for a transparent man-in-the-middle. [11] That took no exploit, because ARP carries no authentication. [12] The dev server you forgot to bind to localhost is sitting on exactly that network.
Ranked by verification strength, evidence, and original report placement.
Redis often ships with no authentication, so exposed via --bind 0.0.0.0 or Docker's -p 6379:6379 any LAN device can connect with redis-cli and run KEYS * or CONFIG SET.
From the ThinkPad, scapy sent forged ARP replies claiming the gateway's IP, and the Mac's ARP cache flipped to the attacker's MAC in about three seconds, enough to relay traffic as a transparent man-in-the-middle.
A developer simulated a compromised same-LAN IoT device by attacking their own MacBook from a next-desk ThinkPad running Arch Linux, with the attacker holding no special privileges and no malware present on the Mac.
An nmap scan of the top 200 ports reported 198 filtered, with SSH, SMB and screen sharing invisible from the attacking machine.
The ports that came back open were node on 3012 and python on 8012, both left running for development, plus macOS ControlCenter on 5000/7000.
A curl to port 3012 completed the TCP handshake but was reset the moment data was sent, returning 'Recv failure: Connection reset by peer'.
Distinct publishers with included, body-backed reporting in this cluster.
dev.to
1 article · August 29, 2026
Follow any of these and your For You feed starts watching them — no settings page required.
Evidence-backed comparisons of source perspectives and observed adoption signals. Read the methodology
Which Builder, Operator, and Investor concerns the observed source mix emphasized—not a truth score.
Evidence, demonstrated adoption, hype gap, incentives, and confidence are assessed independently, each on its own current evidence. How these are measured.
One desk, but it shows its terminal
Every technical detail traces to the same dev.to post, and yet it is unusually checkable: the nmap invocation is printed in full, the curl failure is quoted verbatim, and arp -n output appears before and after the spoof. That is stronger than the usual security anecdote. What holds the score down is that nobody re-ran any of it — MAC addresses are redacted, the three-second cache flip is eyeballed from a single run, and the author himself hedges the most interesting mechanism, writing only that macOS 'seems to' finish the handshake for an unsigned binary before throwing the data away.
Nothing to count
The story contains no uptake of any kind to measure: RoamSwitch appears only as the author's personal app with no release, install base, or user other than him, and the exposed services are described as categories rather than as a survey of machines anyone scanned. Estimating adoption from a single desk would be invention.
Headline earned, edges asserted
The title's promise is the part actually proven — the forgotten --bind really did hand a port to the next desk, and the author is straight about the unflattering half, that his own firewall profile is deliberately open at home. The overreach sits at the perimeter of the demo: the unauthenticated Redis, MongoDB, Elasticsearch, Memcached and Docker API roster is asserted by category, and the tool's detection logic is narrated rather than shown working. Tellingly, the one time it faced a live ARP spoof, the emergency cutoff lost a ruleset fight to the port blocker while telling the user the network was cut off.
He ran the attack and sells the defence
The attacker, the victim and the vendor are one person: the exercise doubles as a check on RoamSwitch and closes with a walkthrough of its three detection features. Two things pull the other way — the admission that at home the firewall mostly isn't a shield, and the disclosed bug where two pf rulesets collided during the live spoof — and neither is what a marketing post volunteers. But the port scan was still run against a profile the author configured, and the fix on offer is his.
Trust the transcript, not the generalisations
Confidence splits cleanly along the line between what was typed into a terminal and what was recalled from practice. The scan, the reset and the cache flip are about as reliable as single-operator reports get; the macOS firewall mechanism, the datastore exposure roster and the effectiveness of the author's detection layer are one person's reading, with no second publisher in our coverage to corroborate or contradict any of it.