RC RANDOM CHAOS
RC RANDOM CHAOS

Tech · Culture · Fiction

A robot dog moves on command inside your network Article

A robot dog moves on command inside your network

The Creepy Crawlies robot dog is a networked device that moves on command. Its control channel and actuator define the risk, not its label.

MFA protects the login, not the session.
Article session hijacking

MFA protects the login, not the session.

Fastpotify mints unbound session cookies that survive MFA. Stolen via AiTM or infostealer, they replay as full sessions. The telemetry that catches it.

Pixel 11 drops hardware MTE
Article GrapheneOS

Pixel 11 drops hardware MTE

Pixel 11 has no hardware memory tagging. GrapheneOS inherits the gap. What the missing per-access MTE check removes from your threat model.

Private was never private
Article privacy

Private was never private

Messaging apps protect your chat from other users, not from the operator that holds the content, the metadata, and the terms you accepted at install.

Three filled lines in the HuggingFace postmortem
Article AI security

Three filled lines in the HuggingFace postmortem

A HuggingFace hack postmortem by METR and Redwood confirms only authorship, subject, and focus. Mechanism is not confirmed, so no control change is authorized.

Volume 5 lands on both desks at once
Article dual-use tooling

Volume 5 lands on both desks at once

Tmp.0ut Volume 5 is dual-use tooling. Its publication proves which of your controls enforced identity and which only concealed a now-public method.

Your browser tab runs as root on Omarchy
Article privilege escalation

Your browser tab runs as root on Omarchy

In Omarchy, any user process reaches root. The user-to-root boundary is gone, turning initial access into full host compromise and lateral movement.

The Wire — latest

All →

Stay in the loop

New writing delivered when it's ready. No schedule, no spam.