Ransomware on the NAS, before the first family arrived
I had spent months designing who may speak to a child and nothing at all on the network edge. Mallox found the edge in April 2026.
What happened
- A management port stayed open. Root Telnet on the NAS, reachable from the internet through a port the DMZ had left open.
- Someone was using it from 22 January. Root access, from at least three addresses. Nothing in my week was watching, and nothing announced itself.
- April 2026: Mallox encrypted the NAS. The machine that holds identity, records, files and billing for the whole service. The encryption is also how I found out. I read that January date off the logs in April.
- No family lost anything. Not because of anything I had built. Because there were no families yet: the launch came after the rebuild.
I had designed the service and not the ground
Every decision I am proud of in this platform is a service decision, and I can defend each one. Not one of them is about the edge of the network.
| what I had decided | what I had never asked |
|---|---|
| the teacher gate, which keeps the AI from reaching a student without a teacher approving it | Which management protocols are reachable from outside the house? |
| two languages, because parents read the platform in the language they worry in | What is listening on that machine, and who put it there? |
| a lifecycle, one path from the welcome message to the day everything is erased | How would I find out that someone was already inside? |
| self-hosting for privacy, so a child's voice never travels to a third-party API | What does self-hosting make me responsible for that a vendor was carrying? |
The last row is the one that stings. I chose self-hosting deliberately, and privacy was the reason: a child's voice should not become a lesson note inside somebody else's API. That choice is still right, and it moved a category of work onto me that I had not costed. A vendor's security team is part of what a per-seat fee buys. Declining the fee declines the team.
What survived, and why it is not a plan
- timingThe only thing that protected a family was the calendar. Real records would have been on that machine two months later.
- a small blast radiusEach job runs as its own stack, so failures stay local. That is a design decision and it helped, and it is not a security control.
- the code, because it lived somewhere elseThe application was in version control, so what the encrypted volume held was runtime state I could stand back up. There was no backup to restore and no restore to attempt: the nightly pipeline was specified, never wired, and the key it would have needed had never been generated.
- the rebuild happened before launchWhich is the sentence I get to write instead of a disclosure letter.
The rebuild started on 30 April and ran in six phases. The DMZ is gone and the router forwards nothing inbound; every administrative surface is reachable only over a private mesh, and the single public path is one outbound tunnel with one sign-on in front of it. Configuration lives in version control, so a machine that gets wiped comes back from a clone rather than from an image somebody trusted. Backups exist now, in three places, and the last of them is a disk that stays powered off more than twenty-three hours a day. The Human platform carries that as architecture. Here it is a consequence.
Infrastructure first, next time
The order I worked in was: design the service, build the service, put it somewhere. The order I would work in now inverts the last two.
- before the first stackWrite down what is reachable from outside, and from where.
- before the first recordProve a restore, not a backup. Mine got as far as a written specification, which is the thing that let me stop thinking about it.
- before launchHave one way of finding out that something has been inside for three months.
None of that is expertise. It is the list a person writes after being handed the cheapest possible version of a lesson that is usually expensive.
Still figuring out
- I do not know what was readEncryption is the part that announces itself. Three months of root access is time enough to copy anything, and the machine held no family records yet, which is an argument about what existed rather than about what I can prove.
- whether one person should operate this at allThe honest case for self-hosting here is privacy and thirty dollars a month. The honest case against it is that the security team is me, on a Tuesday night, after teaching. I have not resolved that, and running the service is how I keep testing it.
- where the line sits for a clientI would not put a client's students on infrastructure I operate alone without saying this out loud first. What I do not yet know is what a client would reasonably ask me to show them instead.