Something did not arrive.

A smart bulb can’t run an antivirus. Neither can a camera or a sensor — too little compute, almost never patched. Get one recruited into a botnet and it carries on glowing as if nothing happened. The only place it gives itself away is on the wire.

So the defence lives on the gateway. Zeek turns every device’s traffic into flows, and three models compete to call each one normal or malicious: a Random Forest trained on labelled attacks, an Isolation Forest that needs no labels at all, and an Autoencoder that only ever sees normal traffic and flags whatever it can’t reconstruct. When a device is judged compromised, nftables responds in steps — alert, throttle, quarantine — so a false positive costs a warning, not a dead camera.

Trained on IoT-23, real malware captures labelled by the same Zeek that runs on the gateway, so the models meet in production exactly the features they learned on. It picks up where Noetzold, Leithardt et al. (2026) stopped: automatic response and running at the edge were their future work. Tested in Docker with an attacker replaying IoT-23 captures — no live malware — and judged on precision, recall, F1, false positives and the number that matters most: how long from the first malicious packet to the device being cut off.

Yes, this one. A single hand-written HTML file — no framework, no bundler, no build step. The dragonfly at the top is a real 3D model rendered with three.js and redrawn as text characters by a custom shader, every frame.

It runs on Cloudflare Pages, served from Cloudflare’s global edge with HTTPS out of the box. The domain is free too: is-a.dev gives developers a subdomain through a pull request on GitHub — open it, get it reviewed, get it merged. Running cost: zero.

Under the hood: a strict Content-Security-Policy and HSTS set at the edge, Draco-compressed models decoded in WebAssembly, cookieless analytics so there’s no consent banner in your way, and a contact form that works without a backend.

Every room had a wall socket nobody had touched since the landline days. Same RJ45 shape, though — so why not turn the old phone wiring into Ethernet? First test: 100 Mbps. It linked, but only two pairs were doing any work. Wired for a telephone, not for a network.

Opened the sockets: Cat 5e behind the wall, perfectly capable of gigabit — but the keystones were punched down in the wrong colour order. Re-terminated them properly. Tested again. Still 100 Mbps.

So, the ATI box. The DCC was sitting in the path, crippling every run, and there was no way to reconfigure it. I took it out of the equation: pulled the runs, crimped them myself and plugged them into a switch. Result — gigabit in every room, lower latency, and a home network that finally behaves like one.

A design study for a course: 155 Mbit/s and 64 TV channels between two digital terrestrial television stations — from Mafra to Monsanto, in Lisbon — with no cable in between. Just antennas, a lot of terrain, and the ITU-R watching every decibel.

The straight line was the first casualty: plotted over a flat and then a curved Earth, the hills cut into the first Fresnel ellipsoid and the direct link was dead on paper. So the path bends through a repeater, placed where the terrain allows it — and from there it’s link budgets, the optimum frequency and modulation, fade margins, diversity, reliability against ITU-R objectives, and the geometry to aim it all.

Then the part most engineering projects skip: what it actually costs. Every mast, shelter, antenna and waveguide specified and priced, ANACOM licence forms filled in, and 25 years of operation modelled down to the average daily cost of a single video channel — plus a look at energy and environmental impact, because a link that runs for 25 years should earn its footprint.

The brief: Xpto, Lda, a made-up company with three offices — Lisbon, Porto and Ponta Delgada, in the middle of the Atlantic — and a single /23 to share between them. Designed from the address plan up: a VLAN per department per site, Wi-Fi on its own segment, a four-switch mesh in Lisbon kept loop-free by Spanning Tree, and routers tying it together over 802.1Q sub-interfaces.

Lisbon and Porto talk over fibre with DSL as backup; the Azores hang off DSL. Routing started static — aggregated, smallest tables possible — then moved to RIPv2. The best test: cut the fibre and watch traffic reroute over DSL on its own. One DHCP server addresses every site through relay agents, an internal web server answers from anywhere in the company, and every layer was then taken apart frame by frame — ARP, VLAN tags, 802.11, DHCP, RIP — to prove it did what the diagram promised.