Articles
Long-form writing on tech, culture, and the edges of the internet.
A model brute-forced Linear A
A Linear A decipherment claim exposes the lesson defenders miss: complexity is not security, and scaled pattern recognition defeats obscurity.
Google IPv6 crossed 50%, your IPv4 controls didn't follow
Google's IPv6 traffic crossed 50 percent. IPv4-era controls don't see IPv6 - the kernel, NDP, scanning, and telemetry reality for defenders.
Google killed io_uring fleet-wide in 2023
io_uring runs file and network operations off the syscall path, blinding seccomp, auditd, and EDR, while epoll stays observable to defenders.
Keep the hard part
AI doesn't erode your problem-solving skills-offloading the reasoning does. Any intelligence atrophies without use; the fix is design, not avoidance.
Linux kernel deleted strncpy across 360 patches
Linux removed strncpy across 360 patches over six years. The exposure: a bounded write primitive used as a safety control it never implemented.
Social engineering is a misconfiguration
Human error in identity workflows is a misconfiguration, not incompetence - how Scattered Spider, 0ktapus and MFA fatigue exploit the validation gap.
The channel trusted the sender
An unauthorized alert reached phones across Brazil. The confirmed finding is one control: sender authorization at the injection point did not hold.
The green check mark proves nothing
Accepting AI-generated code because it works extends your trust boundary to an unvetted source running under your identity. Function is not authorization.
The same-origin policy is not protecting your API
A permissive CORS header delegates the read decision to the requester, letting attacker script read authenticated responses through the victim's own browser.
2023 mistakes an IP address for a passport
Forcing real ID on all internet traffic relocates an unsolved identity problem to a layer that cannot verify the subject and creates a higher value target.
2026's AI failures aren't model failures
AI deployments fail at orchestration, not capability. Building validated pipelines around the model - not completing the task - is the real job.
A bypassed control is worse than no control
CSSQuake is a demonstrable bypass of web application protections through trust manipulation and control boundary erosion. A breakdown of what failed and why.