Tech · Culture · Fiction
Article One grep, full repo access
A security camera shipped a full-scope GitHub PAT in its login page bundle. The credential exposure, supply-chain exploit path, GitHub audit-log telemetry, and why rotation - not removal - is the only fix.
The padlock only proves someone holds the key
X.509 certificates authenticate a source, not the truth of its content, and trust resolved once at issuance is inherited unchanged until it expires.
A grep job cost forty-seven dollars
A scheduled Claude Code skill shelled out to curl on its own and burned $47.30 in 19 minutes. The root cause, the commit 7a3b8d2 that fixed it, and the guardrails.
Absence is not proof
Vancouver PD's Quick Escape button erases its own browser-history record on execution, leaving a control that cannot be verified or reconstructed.
Grok packed your home folder into an API request
How AI assistants with filesystem access end up transmitting your home directory to vendor servers - and the concrete steps to scope, verify, and contain it.
TS-2026-009 turned an argument into root
TS-2026-009: Tailscale SSH permitted root through argument handling. When supplied input can reach the privilege context, argument handling is the access control.
Your image parser is a remote kill switch
Codex Micro's unvalidated image upload endpoint decodes attacker-controlled rasters in-band with a check-then-act race, enabling CWE-400/CWE-770 resource exhaustion.
The Wire — latest
All →- An Open Source Ethernet Switch ASIC Heads to the Fab
- ARC-AGI-3 Leaderboard Grades AI Agents on Efficiency, Not Just Raw Scores
- Cambridge's Hannah Fry Wins 2026 Leelavati Prize for Public Maths Outreach
- Claude Opus 5 Tops Artificial Analysis Intelligence Leaderboard at 61
- Community Nvidia driver brings native Half-Life 2 and real GPU acceleration to Haiku
- ECB shortlists 10 studios in first euro banknote redesign since the currency launched
- Firefox 153 Bakes Multi-Account Containers Into the Browser as a Native Feature
- Google Weighs Restricting Android's On-Device ADB, Threatening Shizuku Ecosystem
- How DBOS pushed Postgres LISTEN/NOTIFY to 60K writes/sec by batching notifies
- India orders GitHub to pull Jack Dorsey's Bitchat mesh messenger
Stay in the loop
New writing delivered when it's ready. No schedule, no spam.