Articles
Long-form writing on tech, culture, and the edges of the internet.
Asahi 7.1 maps the DMA layer under macOS
Asahi Linux 7.1 exposes Apple Silicon coprocessors, DART IOMMU boundaries, and a silent SMC firmware ABI change - the layer below every macOS EDR agent.
Bypassed controls are absent controls
Leanstral 1.5 bypassed CAPTCHA and rate limiting. Those controls score requests, not identity, the only boundary that refuses credential replay.
Bypassing the paywall is not a billing bug
Cloudflare's x402 monetization gateway collapses payment and access enforcement onto one bypassable point, turning a billing layer into a single failure domain.
CVE-2026-31840 blames the encoder, corrupts the decoder heap
CVE-2026-31840: FFmpeg's AAC path carries a heap out-of-bounds write and UAF. The bug is in the decoder, not the encoder - mechanism, exploitation surface, and telemetry.
Log4Shell executed exactly as written
Log4Shell, xz-utils, and Spring4Shell weren't isolated bugs. They were composition failures in systems too deep for anyone to fully read. The disease is complexity.
Read the mark hidden in your bot's requests
Steganographic request marking as a targeted reconnaissance primitive: how invisible-Unicode carriers survive into logs and why SIEM normalization goes blind.
Schrems II broke US data transfers, July 2020
Schrems II (CJEU C-311/18) makes US-hosted EDR telemetry on EU endpoints a restricted transfer. Why data residency now degrades detection fidelity.
Your subject can end your investigation
A US ambassador used Belgian police to halt reporting. The failure is an unscoped trust channel from subject to enforcement, not a press dispute.
A single rubber stamp guards the transatlantic data pipe
The EU-US Data Privacy Framework authorised transfers on an adequacy premise the Commission never controlled. That is a failed control, not a blowup.
In 2026 the memory discount quietly expired
Memory lifecycle plans keep resolving a price the market no longer charges. The gap is structural drift, not a failure of hardware or planning.
One million passports now sit in the open
One million passport records exposed online: a board-level view of identity-layer risk, control failure, and the conditions leadership must now enforce.
Security teams mislabeled the GPU bubble
The GPU bubble is not a hardware vulnerability. It is a demand spike against allocation systems that enforce no limit under scarcity.