About on Fabian van Steen

Trying out Omarchy — a .NET developer on Linux

Sat, 12 Sep 2026 00:00:00 +0000

It started with a laptop nobody wanted anymore. A 2017 MacBook Air, Intel, 8 GB of RAM, sitting in my office running an old version of macOS. My son had been using it, and had mostly stopped — because it had become the kind of slow where you think twice before opening a browser tab.

So I wiped it and put Omarchy on it: “Beautiful, fun & agentic Linux by DHH.”

The 6 levels of Claude Code — where do you stand?

Tue, 07 Apr 2026 00:00:00 +0000

Most people hit a wall with Claude Code not because they’re doing something wrong, but because they have no map for what progress looks like. Six levels separate the beginners from the orchestrators — here’s how to find yourself on that map.

Level 1 — The prompt engineer

This used to be a job title. Now it’s table stakes.

You treat Claude like a vending machine: input a command, collect the output. The result is AI slop — every website the same purple gradient, same icons, same forgettable fonts. That’s what happens when you leave the gaps for Claude to fill. It fills them with average.

Securing an Azure Storage Account

Mon, 16 Jun 2025 00:00:00 +0000

A secure Azure Storage Account setup involves applying best practices for access control, networking, encryption, and monitoring. Below is a comprehensive checklist.

🔑 1. Identity & Access Management

Use Azure RBAC (Role-Based Access Control):
- Assign the least privileged roles to users, groups, and services.
- Prefer Storage Blob Data Reader/Contributor over general Storage Account Contributor.
Use Azure AD for Authentication:
- Enable Azure AD authentication for Blob and Queue services.
- Avoid using account keys where possible.
Disable Shared Key Access:
- If possible, disable Shared Key Authorization under the Configuration tab.
Use Shared Access Signatures (SAS) cautiously:
- Prefer user delegation SAS over account SAS.
- Limit expiry, permissions, and IP address range.

🌐 2. Networking

Restrict access with firewalls and VNets:
- Enable the firewall and configure trusted IP ranges or VNets.
Disable public access:
- Set AllowBlobPublicAccess = false at the storage account level.
Use Private Endpoints:
- Create Azure Private Endpoints to eliminate exposure to the public internet.

🔐 3. Encryption

Data-at-Rest Encryption:
- Enabled by default with Microsoft-managed keys.
- Optionally use Customer-managed keys (CMK) in Azure Key Vault.
Data-in-Transit Encryption:
- Enforce HTTPS-only traffic (Secure transfer required setting).

📊 4. Monitoring & Alerts

Enable Azure Monitor & Storage Diagnostics:
- Configure Azure Monitor Logs and metrics.
- Enable Storage Analytics Logging for Blob, Queue, Table.
Log all access with Azure Activity Logs:
- Monitor operations like key changes, firewall updates, etc.
Enable Defender for Storage:
- Detect threats like data exfiltration, malware uploads, unusual access patterns.

🛡️ 5. Data Protection & Recovery

Enable Soft Delete:
- Protect against accidental deletions (Blob, File, Container).
Enable Point-in-Time Restore (Blob Storage):
- Recover from corruption or accidental deletion.
Replication Options:
- Choose Geo-Redundant Storage (GRS) or Zone-Redundant Storage (ZRS) for durability.

✅ 6. Regular Reviews & Compliance

Rotate keys and secrets regularly.
Use Azure Policy to enforce compliance (e.g., disallow public access).
Audit access control assignments and review logs routinely.

Azure Key Vault - Best Practices

Fri, 06 Jun 2025 00:00:00 +0000

Azure Key Vault is essential for secure management of secrets, keys, and certificates. Below are key security-focused best practices to design a robust, compliant, and resilient implementation.

1. Use Separate Vaults per Environment

Create dedicated vaults for Development, Testing, and Production.
Apply environment-specific access controls.
Reduce the blast radius and avoid accidental sharing or overwriting across environments.

2. Set Expiration & Automate Rotation

Configure expiration dates for all secrets, keys, and certificates.
Automate rotation with Azure Logic Apps or Azure Functions.
Use Key Vault references in Azure App Services to consume updated secrets without redeploying code.

3. Enable Logging & Monitoring

Send activity logs to Azure Monitor, Log Analytics, or Storage Accounts.
Track who accessed what, when, and from where.
Integrate with Azure Sentinel to enable threat detection and automated alerting.

4. Restrict Network Access

Use Private Endpoints to limit access to resources within your Virtual Network.
Configure IP firewall rules to allow only trusted sources.
Enable only necessary Microsoft trusted services access.

5. Use Azure RBAC Instead of Access Policies

Prefer Azure RBAC for fine-grained, manageable access control.
Assign roles like Key Vault Secrets User with least privilege.
Avoid using the built-in Contributor role, as it grants excessive permissions.
Create a custom role that excludes sensitive actions (e.g., vault deletion).

6. Enable Soft Delete & Purge Protection

Protect secrets, keys, and certificates from accidental or malicious deletion.
Enable Soft Delete and Purge Protection to ensure recovery is always possible.

7. Lock the Key Vault Resource

Apply resource locks (e.g., “CanNotDelete”) to prevent accidental or unauthorized deletion of the vault itself.
Especially important in Production environments.

RSS feeds for your Github releases, tags and activity

Sun, 25 Oct 2020 00:00:00 +0000

I like to be up to date on new releases of the software I am using. Github has a number of ways to track user or project activity.

Repo releases

https://github.com/:owner/:repo/releases.atom

Repo commits

https://github.com/:owner/:repo/commits.atom

Private feed (You can find “Subscribe to your news feed” in dashboard page after login)

https://github.com/:user.private.atom?token=:secret

Repo tags

https://github.com/:user/:repo/tags.atom

User activity

https://github.com/:user.atom

How to Flush DNS Cache in MacOS Catalina & Big Sur

Sat, 24 Oct 2020 00:00:00 +0000

Use the following commands to flush your DNS cache in MacOS. The commands are slightly different depending on your version of MacOS. First, make sure you’ve opened up your terminal on your computer.

sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder

How to install homebrew on MacOS

Sat, 29 Jun 2019 00:00:00 +0000

What is HomeBrew

Homebrew is the missing package manager for macOS. You can use Homebrew to install command line packages on a Mac, provided someone has written a formulae, which is a simple Ruby script that walks through the process for installing all the little bits required for a piece of software.

Installing HomeBrew

/usr/bin/ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)"

Once the installation has finished, execute the following command to check your HomeBrew version.

Renaming the hostname of your Raspberry Pi (Raspbian)

Mon, 05 Mar 2018 00:00:00 +0000

One of the first things you want to do if you’ve just installed Raspbian on your Pi is to change the hostname. You can change your hostname by following these steps.

Steps

You can use the hostnamectl set-hostname [name] command, but that does not update /etc/hosts and causes issues with Docker and other networking services. I prefer to update /etc/hostname and /etc/hosts manually.

1. Change hostname

sudo nano /etc/hostname

Change raspberrypi to your desired hostname. Hit CTRL+O and then ENTER to save. Hit CTRL+X to exit.

How to install Docker on your Raspberry Pi

Tue, 27 Feb 2018 00:00:00 +0000

What is Docker?

Docker is an open-source project for automating the deployment of applications as portable, self-sufficient containers that can run on the cloud or on-premises. Docker works in collaboration with cloud, Linux, and Windows vendors, including Microsoft.

How to install Docker

With one of the latest releases of Docker, they added official support for Raspbian. You can now easily install Docker on your Raspberry Pi with one simple command.