RC RANDOM CHAOS

Articles

Long-form writing on tech, culture, and the edges of the internet.

ZuckOff detects the camera outside your access model
privacybluetooth

ZuckOff detects the camera outside your access model

ZuckOff flags Ray-Ban Meta, Oakley Meta and Snap Spectacles by their Bluetooth signature, a signature-based detector for the recording devices your access model never sees.

2 min read
ChatGPT already knows your other browsing.
ChatGPTprivacy

ChatGPT already knows your other browsing.

OpenAI's __obi cookie ties your ChatGPT account to browsing on advertiser sites, and it fires even if you grant analytics but refuse marketing.

4 min read
Most automation doesn't need a smart model
on-device AItool calling

Most automation doesn't need a smart model

Cactus Needle 3 is an 8-29 MB offline model for tool calls, extraction and embeddings, with triggers and confidence gating you have to wire carefully.

3 min read
One write past the chunk, read-write on the repo
securityexploitation

One write past the chunk, read-write on the repo

How Hacktron chained a libheif heap overflow and an OpenAI SSO misconfiguration to reach OpenAI's internal repo in under 72 hours, with AI doing the exploit work.

4 min read
Microsoft called it theft; the crawler maps your attack surface
AI scrapingcopyright

Microsoft called it theft; the crawler maps your attack surface

Unsealed NYT v. OpenAI/Microsoft filings show a 93% click-through drop, internal "theft" admissions, and the scraping paths that already hold your content.

3 min read
OpenJev benchmarks against a value it never explains
local-llmlogits

OpenJev benchmarks against a value it never explains

OpenJev times two ways of reading a local model's option probabilities in-browser, but never explains the Jev value its accuracy table scores against.

2 min read
Parameter count is the wrong number to watch
model compressionlocal inference

Parameter count is the wrong number to watch

PrismML's Ternary Bonsai 2 27B fits a 27B multimodal model into 5.9GB, and its footprint and energy numbers matter more than parameter count.

2 min read
Passkeys don't stop account takeover
passkeysauthentication

Passkeys don't stop account takeover

Passkeys stop login-flow phishing but leave SMS and email recovery intact, so account takeover and lockout stay the real risks for most users.

2 min read
The hallucination was not the failure.
military AIAI hallucination

The hallucination was not the failure.

An AI-generated report nearly sent US forces to board a Chinese ship. The failure was how the hallucination was packaged as trusted intelligence.

3 min read
The host dials out, the internet walks in
cloudflare-tunnelegress-security

The host dials out, the internet walks in

Cloudflare Quick Tunnels expose a localhost service to the public internet over an outbound connection, with no account and no inbound port opened.

2 min read
Your Git history is already in the cloud
AI coding toolsdata exfiltration

Your Git history is already in the cloud

Zhipu's ZCode desktop app silently packaged entire Git histories, encrypted them with a server-held key, and uploaded them to Aliyun OSS.

5 min read
A 4B model outplans Postgres
postgresquery optimization

A 4B model outplans Postgres

A 4B open-weights model, post-trained with SFT and RL, cut Postgres query latency 44.7% across 113 join-heavy benchmark queries using pg_hint_plan.

4 min read