Security-driven automation, whatever it runs on.

Let me be clear: I’m not lazy. I’m really lazy. There’s a difference. A lazy person skips the work. A really lazy person spends a whole Saturday building a machine so they never have to do that work again. It suits the name. Bufon means jester, and the jester was the one person at court who never carried anything. He juggled, told the king the truth and let the servants do the rest. My servants are a GitHub workflow and a cron job. They don’t get paid either. In Get on the bike! I wrote that you should do something by hand once, script it the second time and automate it when it annoys you again. Publishing posts had reached step three.

People sometimes ask where the name Bufon comes from. Short answer: it’s a jester. The fool # In Spanish (and a few other languages), bufón means jester, the court fool. Historically the jester was the one person allowed to tell the king uncomfortable truths without losing his head. Pointing out that the emperor’s firewall has no clothes felt like a fitting job description for someone working in security.

Ten years ago I moved from Windows to Linux, and later to the cloud. Recently I picked up Active Directory again, to migrate an environment to Windows Server 2025. I expected to spend weeks relearning. Instead, it felt like I’d never left.

Recently I ran into this on a fresh Windows Server 2025 instance on EC2: “The Secure Boot update failed to update KEK 2023 with error Secure Boot is not enabled on this machine.” The instance was UEFI, it was Windows Server 2025, and it came from an official Amazon AMI. So why wasn’t Secure Boot on?

You probably know a team like this. Servers get built by hand. Settings get clicked through one machine at a time. Changes on critical systems are done in an RDP session, and GPOs, templates and Ansible are nowhere to be seen. Every server is a little different, and only the person who built it knows why. It’s ClickOps, and it’s still everywhere, especially in teams that have “always done it this way.” To me it looks like a team running beside their bike, sweating and out of breath, when they could just get on it.

Why cramming metadata into one JSON blob tag breaks filtering, and why flat key:value tags scale better.