Articles
Long-form writing on tech, culture, and the edges of the internet.
The host dials out, the internet walks in
Cloudflare Quick Tunnels grant internet reachability to internal hosts over trusted outbound sessions, bypassing the inbound firewall by direction, not by flaw.
Two failures are not one attack.
A heap overflow and SSO misconfiguration compromised OpenAI internal repos. Two controls named as present, neither enforced in effect.
Your Git history is already in the cloud
ZCode transmits local Git history to the cloud with no consent prompt and no notification. A post-incident breakdown of the boundary that was never enforced.
AWS confirms unrecoverable data loss after Iran strike
AWS cannot restore some data from Iran-struck Mideast facilities. A recovery copy that shares a failure domain with the primary is not recovery.
May 2024's Bend is no proof assistant
Bend is a parallel language, not a proof assistant. What proof-based programming actually does for AI safety, and the errors it can't touch.
Permanent by default
A temporary PHP fix reached 20M installs because a label is not a control. The mechanism, the pattern, and what must now be true in production.
Rust for CUDA won't make your models faster
Nvidia's native Rust support for GPU programming is a reliability shift at the systems layer, not a speedup - it matters only if you write custom device code.
Zhipu built its own inference stack for GLM
GLM built its own inference infrastructure to serve LLMs cheaply on constrained, mixed hardware. Here's what breaks in generic stacks and what to copy.
A 4B model outplans Postgres
A 4B model proposes faster Postgres query plans, but the validation gate and fallback - not the model - are what make the 81% speedup safe to run.
A patch waits eleven days at the gate
Google Play reviews now take a week or more. The real risk isn't malware slipping the gate - it's droppers that mutate after approval and slowed security patches.
Gemini 3.8 Live broke two security assumptions
Gemini 3.8 Live and Extended Thinking make ambient audio and video an untrusted AI input, reshaping prompt injection, logging, and privacy risk.
Rubble where the records used to be
A cloud provider states some Middle East data cannot be restored after a strike - what permanent loss means for board-level accountability and recoverability.