Articles
Long-form writing on tech, culture, and the edges of the internet.
crustc ports rustc to C and voids every safety proof
Translating rustc to C strips Rust's compile-time memory-safety guarantees and reopens out-of-bounds writes, UAF, and type confusion in the toolchain.
Locale decides the payload
The en-GB locale isn't a vulnerability - it's a selector. How attackers use Accept-Language and OS locale checks to filter delivery and gate detonation.
Spain rips Palantir out of its data pipelines
Spain's Palantir blacklist is a supply chain concentration risk - a privileged vendor data plane mapped to MITRE T1199, and why customer telemetry stays blind.
The trending panel counts the tag, never reads it
Mastodon's trending engine counts references to a hashtag, not what it means. #ChickenAnything shows how systems resolve by reference and inherit stale trust.
Cloudflare shipped an authorization boundary in 2025
How x402 charge gateways behind Cloudflare turn old CDN misconfigurations - origin IP exposure, cache deception, verify-settle races - into priced exploitation.
CVE-2024-43047 hit live targets in 2024
CVE-2024-3679 maps to no Qualcomm bug. The real 2024 Snapdragon zero-day is CVE-2024-43047 - a DSP/FastRPC use-after-free, CVSS 7.8, exploited in the wild.
Exposure you cannot see
A board-level assessment of why unverified detection against a public vulnerability campaign leaves exposure unconfirmed and control unproven.
LUKS suspend leaves your encryption key in memory
On Linux 6.9, LUKS suspend returns success but does not wipe disk encryption keys from memory. The success report no longer proves the state it claims.
PAN-OS remembers the verdict, forgets the reasoning
Firewall rules, AD groups, and JWTs keep executing stored references long after the reality they described has drifted. The system revalidates nothing.
Seizing the domains left the machine untouched
The FBI seizure of NetNut and the Popa botnet infrastructure exposes a structural fault in delegated trust: systems that resolve a reference but never revalidate what it points to.
The trust boundary already moved
Android telemetry from Google runs at the platform layer, below the owner's only enforcement surface. A trust-model condition, not a vulnerability.
You're already running code you never chose
Kimi K2.7 code is generally available in GitHub Copilot. Its origin is not bound to the suggestion at emission, so the provenance boundary is unenforced.