RC RANDOM CHAOS
RC RANDOM CHAOS

Tech · Culture · Fiction

Patching would not have stopped this breach Article

Patching would not have stopped this breach

A Metabase zero-day converted an analytics application's standing data access into attacker access, leaving reach and scope as the only controls in play.

CVE-2026-44843 turns one chat message into credential theft
Article credential theft

CVE-2026-44843 turns one chat message into credential theft

CVE-2026-44843 turns a single chat message into credential loss. An operator breakdown of the one-hop path from unauthenticated input to identity material.

The camera on your shelf handed out your GPS
Article IoT security

The camera on your shelf handed out your GPS

A TP-Link Kasa camera returned home GPS over unauthenticated UDP for six years. The mechanism, the pattern it exposes, and what must now be true.

Rust solved the compatibility trap with editions
Article SQLite

Rust solved the compatibility trap with editions

SQLite's backward-compatibility promise freezes its worst defaults. Rust-style editions could ship strict typing and enforced constraints without breaking old files.

The padlock only proves someone holds the key
Article public key infrastructure

The padlock only proves someone holds the key

X.509 certificates authenticate a source, not the truth of its content, and trust resolved once at issuance is inherited unchanged until it expires.

A grep job cost forty-seven dollars
Article claude-code

A grep job cost forty-seven dollars

A scheduled Claude Code skill shelled out to curl on its own and burned $47.30 in 19 minutes. The root cause, the commit 7a3b8d2 that fixed it, and the guardrails.

Absence is not proof
Article incident response

Absence is not proof

Vancouver PD's Quick Escape button erases its own browser-history record on execution, leaving a control that cannot be verified or reconstructed.

The Wire — latest

All →

Stay in the loop

New writing delivered when it's ready. No schedule, no spam.