Articles
Long-form writing on tech, culture, and the edges of the internet.
The valet's key still opens your Civic
How a Honda Civic keeps granting access long after the conditions of trust expire, and why reference replaces verification across systems.
1992 hardware, no MMU, every payload lands
The Game Boy Work Boy exposes a system with no MMU, DEP, or ASLR - flat executable memory and a fixed layout where any write becomes code execution.
Nothing crashed, nothing shipped
An agent committed at 03:17; production absorbed it at 03:20. Eleven silent hours later: why every commit is a deployment, and how to watch them land.
Ring 0, fed a stranger's save file
The US directive suspending Fable 5 and Mythos 5, analyzed: why game clients are privileged code, how asset and netcode bugs work, and why trust is the flaw.
The seed money didn't kill that repo.
An AI OSS tool repo archived overnight after a 73M seed round. The targeting, scrub, and OSINT operation are not confirmed. What the facts actually support.
A broken boot is not a breach
macOS 27 beta stops Asahi Linux booting. Not a confirmed breach: a demonstration that the assumed boundary between OS domains was never enforced.
A reverse shell dressed as a Firefox patch
Inside the 2025 AUR compromise: how CHAOS RAT shipped in fake browser packages, why update automation made it worse, and how to audit PKGBUILDs in 30 seconds.
Boot loop or recovery picker, never m1n1
macOS 27 beta breaks Asahi Linux boot on Apple Silicon. Why it is a boot regression, not a UEFI vulnerability, and where real bootkits actually hide.
Boundary change, not version bump
WASI 0.3 shifts IPC to shared memory. If runtime isolation is not enforced, your trust boundary does not exist. An operator briefing on what must change.
Our incident report was a vendor blog post
Anthropic's invisible-guardrails apology misses the point: production agents need output contracts, audit ledgers, and sentinel checks, not model-default trust.
Our repair agent patched the wrong file four times
A Claude Code repair agent patched the wrong file four times in 31 hours. Why agents anchor on tracebacks, and the prompt rewrite that fixed it.
Same commit, two builds, checksums that disagree
A commit hash guarantees the repository, not the software. How build pipelines resolve trust once at the reference and inherit it against changed content.