Articles
Long-form writing on tech, culture, and the edges of the internet.
CORS misconfiguration is consent, not an exploit
CORS misconfiguration explained at the mechanism level: origin reflection, null origin, broken allowlist matching, the credentialed-read exploit path, and why it stays invisible in telemetry.
Half of LG TV apps are exit nodes
Residential proxy SDKs sit in nearly half of LG webOS apps, turning smart TVs into rentable exit nodes LG neither blocks nor detects. The mechanism and telemetry gap.
Kees Cook deleted strncpy from the Linux kernel
Linux removed strncpy after six years and 360+ patches. The mechanism: missing NUL termination, out-of-bounds reads, kernel info leaks, and why strscpy replaces it.
Sanctioned keylogger, unlocked back end
Meta's exposed employee keystroke telemetry is not an AI story. It is a third-party data-handling failure: T1056.001 collection, an unauthenticated store, T1530 read.
Sandi Metz's 2016 essay is a bug-class taxonomy
The 2016 'wrong abstraction' rule read as a memory-corruption bug class: use-after-free, type confusion, double-free, from DirtyCOW to Dirty Pipe and DirtyCred.
The guard checks the badge, never the room
Prompt injection is role confusion: systems that derive content authority from channel trust execute attacker input as instruction.
The log that killed your SSD was working perfectly
A Codex logging bug can write terabytes to a local SSD because the system resolves a configured reference repeatedly and never revalidates the trust behind it.
There is no free()
Claude Code's extended thinking is not a use-after-free. The real exposure is indirect prompt injection into a tool-holding agent - OWASP LLM01, ATLAS T0051.
They knocked on his door, not his firewall
Danish police raided privacy activist Lars Andersen with no technical breach. The boundary moved to physical custody, where remote controls were never positioned.
This isn't a bug. It's the default.
Codex writes unbounded session logs to local SSDs. Mapped correctly to MITRE T1499, not T1071 - a disk-exhaustion DoS primitive EDR baselines miss.
A favicon is a code execution primitive.
How attackers hide skimmers and full payloads in favicon files, why MIME and CSP misconfiguration lets image bytes run as code, and what defenders miss.
A loupe over the data iOS never asked about
Loupe shows iOS gates a fixed sensor list and leaves contextual device data readable by default, with no prompt, no consent, and no record of access.