https://debkosh.com/blogs Long-form on enterprise browsers, proxies, and enforcement. How it actually works, what the tradeoffs really cost. en https://debkosh.com/blogs/introducing-memd https://debkosh.com/blogs/introducing-memd Thu, 16 Jul 2026 00:00:00 GMT Every AI coding tool ships its own memory, and none of them talk. memd makes memory a folder of Markdown files you own, served to every agent over MCP. https://debkosh.com/blogs/why-rdp-cant-authenticate-like-ssh https://debkosh.com/blogs/why-rdp-cant-authenticate-like-ssh Fri, 03 Jul 2026 00:00:00 GMT SSH made passwordless, short-lived, identity-attributed access a one-line server config. RDP can get there too, through a chain of Active Directory machinery that explains why brokered access is winning instead. https://debkosh.com/blogs/extension-ceiling-4-dlp-page-vs-wire https://debkosh.com/blogs/extension-ceiling-4-dlp-page-vs-wire Sat, 20 Jun 2026 00:00:00 GMT Extension DLP inspects the page. Exfiltration happens in the request. Those are different objects, and the gap between them is where data actually leaves. https://debkosh.com/blogs/enterprise-browser-pam-collision https://debkosh.com/blogs/enterprise-browser-pam-collision Thu, 18 Jun 2026 00:00:00 GMT The extension versus full browser argument misses where the deals actually go. Privileged access lives at a broker, and the browser and PAM categories are converging on it from opposite sides. https://debkosh.com/blogs/extension-ceiling-3-the-incognito-bypass https://debkosh.com/blogs/extension-ceiling-3-the-incognito-bypass Thu, 28 May 2026 00:00:00 GMT Every extension-based DLP I tested loses sight of the user the moment an incognito window opens. The mechanism, and why policy can't fully close it. https://debkosh.com/blogs/extension-ceiling-2-chrome-sync-and-mdm-scoping https://debkosh.com/blogs/extension-ceiling-2-chrome-sync-and-mdm-scoping Thu, 09 Apr 2026 00:00:00 GMT Chrome sync will happily carry corporate state into personal profiles. What the MDM scoping rules actually cover, item by item. https://debkosh.com/blogs/extension-ceiling-1-mandatory-screen-recording https://debkosh.com/blogs/extension-ceiling-1-mandatory-screen-recording Tue, 17 Feb 2026 00:00:00 GMT If your security tool needs to watch the screen to do its job, you have already left the extension model. The mechanics of why. https://debkosh.com/blogs/what-enterprise-browser-productivity-numbers-really-mean https://debkosh.com/blogs/what-enterprise-browser-productivity-numbers-really-mean Wed, 03 Dec 2025 00:00:00 GMT Vendors quote hours saved per user per week. How those numbers get made, and which ones survive contact with a real deployment. https://debkosh.com/blogs/go-vs-rust-for-proxy-workloads https://debkosh.com/blogs/go-vs-rust-for-proxy-workloads Wed, 24 Sep 2025 00:00:00 GMT We pushed serious TLS traffic through both. The decision came down to GC pauses you can budget for versus lifetimes you pay for daily. https://debkosh.com/blogs/merging-the-browser-and-the-sase-stack https://debkosh.com/blogs/merging-the-browser-and-the-sase-stack Wed, 18 Jun 2025 00:00:00 GMT Consolidation slideware says one agent, one policy. The enforcement plumbing underneath says otherwise. What merging actually requires. https://debkosh.com/blogs/prompt-injection-from-the-enforcement-side https://debkosh.com/blogs/prompt-injection-from-the-enforcement-side Wed, 05 Mar 2025 00:00:00 GMT What a gateway can and cannot do about prompt injection, written for people who have to sign off on AI tools this quarter.