Articles
Long-form writing on tech, culture, and the edges of the internet.
There is no free()
Claude Code's extended-thinking output is a summary, not the reasoning that drove the agent, so it cannot serve as an audit trail of agent logic.
This isn't a bug. It's the default.
OpenAI's Codex persisted TRACE-level logs to SQLite by default, writing tens of terabytes to local SSDs. The cause, the damage, and the fixes.
A model brute-forced Linear A
A self-taught engineer used Claude Code to build corpus tools behind his claimed decipherment of Linear A, now under review at Rutgers and Cambridge.
Google IPv6 crossed 50%, your IPv4 controls didn't follow
Google measures IPv6 at 50% of users, APNIC at 42%. Why they differ, and why controls scoped to IPv4 miss the v6 path on dual-stack hosts.
Linux kernel deleted strncpy across 360 patches
Linux 7.2 removed strncpy() from the kernel after six years and 362 commits. What the replacements are and how to port out-of-tree code.
The same-origin policy is not protecting your API
Zoom encoded a localhost server's responses in image dimensions to dodge CORS, exposing it to every website on the internet.
AMD's Memory Encryption Blind Spot
AMD removed TSME memory encryption from non-PRO Ryzen 9000 chips in a firmware update and will restore the BIOS option in July.
An AI engineer skipped the prediction test
A self-taught AI engineer used Claude Code to back his claim of deciphering Linear A, but the prediction test that confirms a decipherment is still pending.
Trust does not carry forward
Bigger LLMs hallucinate more, not less: why calibration numbers belong next to capability scores when you pick a model for production.
speed ships the flaw
Charity's essay on AI and engineering discipline: cheap regeneration turns code into a cache, so rigor has to move to production and validation.
10,000 cloned GitHub repositories are serving a Trojan
An engineer found 10,000 GitHub repositories that clone new projects and hide a Trojan in a zip linked from the readme, and GitHub only removes reported ones.
Firecracker contains the attack it never sees
Browser Use runs every cloud browser in its own Firecracker microVM nested inside regular EC2, with sub-400ms VM cold starts and 825ms p50 create latency.