Articles
Long-form writing on tech, culture, and the edges of the internet.
One grep, full repo access
Hanwha Vision camera firmware shipped a GitHub token with admin access to hundreds of repos, leaked by a vite build dumping the whole CI environment.
Rust solved the compatibility trap with editions
SQLite ships with foreign keys off, loose typing, immediate SQLITE_BUSY and no WAL. One writer argues a Rust-style edition pragma could fix the defaults.
Absence is not proof
The supplied source is the Vancouver Police Department homepage and contains no security, infrastructure, or AI story to report.
Count Binface breaks your correlation rule
Count Binface's real election results read like corrupt data, which is a problem for any pipeline that validates for plausibility instead of safety.
serverHold pulled t.me from the zone, no CVE fired
The t.me WHOIS record shows four client-side registrar locks but no server hold, intact Google Cloud DNS delegation, and an unsigned zone.
GhostLock is not a vulnerability.
GhostLock (CVE-2026-43499) is a 15-year rtmutex stack-UAF in Linux turned into a 97% stable root exploit via prctl stack reclaim and a one-write DirtyMode trick.
tanh now fingerprints your OS
Since Chrome 148, Math.tanh returns different bits on Linux, macOS and Windows, giving anti-bot systems a per-OS fingerprint that is cheap to probe.
Open source is not decentralized
Damn Interesting's Alan Bellows is running a one-off $40,000 fundraiser to replace the part-time engineering income that funded his long-form writing.
The string you validated no longer exists
A July 2026 analysis shows UTS #35 Unicode transliteration rules are Turing-complete: three rules run the Collatz function on stock ICU.
The console gathers dust, then deletes your games
Sony's European PlayStation terms let it close inactive accounts after 36 months and permanently cut access to every digital game bought through them.
Your hypervisor was never a wall
Januscape (CVE-2026-53359) is a 16-year-old use-after-free in KVM/x86's shadow MMU that lets a guest panic or take over the host on Intel and AMD.
Kalshi ships an unauthenticated oracle
CNN and CNBC promote Kalshi's prediction-market odds as a signal, but the political markets they feature are thin and known to bias toward 50 percent.