Articles
Long-form writing on tech, culture, and the edges of the internet.
Two thousand keys against one lock
A coordinated brute-force of 2,000 attempts against one AI assistant's credential path shows weak identity validation is a systemic boundary failure.
Visibility, not vulnerability
A disclosure pipeline issued its first CVE only after public release, because the system resolves visibility, not whether the flaw was ever fixed.
Cloudflare's self-managed OAuth secures nothing by default
Cloudflare's self-managed OAuth moves the enforcement point from provider to user. An unconfigured access control is an open path, not a safe default.
CVE-2009-1897 is back, now under every @bitCast
How Zig's @bitCast lowering and LLVM's optimizer can synthesize exploitable use-after-free bugs that no source review or EDR will ever see.
Every model behind an API is already leaking
Anthropic's Alibaba extraction claim isn't a model failure, it's architecture. The API boundary was never a security guarantee, and designing it is your job.
Governments collect populations, not threats
Mass surveillance is default-on collection plus retention. The unwatched baseline is gone. Operate as already collected and limit what the record resolves.
LuaJIT proposal exposes a guard-elision primitive
LuaJIT's proposed relaxed type checking elides JIT trace guards, creating a type-confusion primitive reachable wherever embedded Lua handles untrusted input.
Telemetry is the breach
Meta paused an employee-tracking telemetry program after a data leak. The real finding is embedded in-process instrumentation as a structural attack surface.
The device is the inventory
Smart TV apps embed residential proxy SDKs that turn devices into exit nodes. The trust failure lives in the build pipeline, not the hardware.
They walked out with the blueprints, not answers
Anthropic alleges Alibaba extracted Claude capabilities. The confirmed issue is structural: authenticated access governs entry, not what a party accumulates.
Victim types the password, attacker keeps the token
CVE-2023-4714 session fixation (CWE-384) explained: how attackers plant a session ID, bypass MFA, what fires in telemetry, and why rotation alone is not enough.
Compiling a Rust crate runs the author's code.
crates.io federates all publish identity to GitHub, turning one account takeover into build-time code execution across every downstream Cargo project.