RC RANDOM CHAOS

Articles

Long-form writing on tech, culture, and the edges of the internet.

The machine quoted an EFF staffer who never existed
systems driftai-generated content

The machine quoted an EFF staffer who never existed

A news system generated quotes from EFF staff who never existed because it resolves references without confirming that what they point to is real.

6 min read
Zluda 6 unpins CUDA from Nvidia hardware
zluda 6trust boundary

Zluda 6 unpins CUDA from Nvidia hardware

Zluda 6 runs unmodified CUDA code on non-Nvidia GPUs, breaking a hardware-software pairing that was never an enforced control. What that exposes.

6 min read
Age verification is identity verification
age verificationdigital identity

Age verification is identity verification

Age verification resolves identity once and answers every access by reference, relocating control over disclosure from the user to an attestation layer.

8 min read
Every kernel launch is an ioctl into ring 0
cuda-securitynvidia-driver

Every kernel launch is an ioctl into ring 0

Launching a CUDA kernel crosses into ring 0 via the NVIDIA kernel-mode driver - the real attack surface behind GPU compute, its CVE class, and detection gaps.

7 min read
Fast enough to lie
systems failure analysisnetwork latency

Fast enough to lie

Package managers hang for minutes because they execute on a returned value, never measuring the network latency their design assumed would stay constant.

7 min read
Flock's real attack surface was never the camera
surveillanceALPR

Flock's real attack surface was never the camera

Flock ALPR cameras are a national sensor grid - the security risk isn't recording, it's a queryable movement database reachable by thousands of weak accounts.

6 min read
#gerpar trended this week; PartitionAlloc already answers it
chromium-securityheap-overflow

#gerpar trended this week; PartitionAlloc already answers it

A. Shah (REDLINE) tests the trending #gerpar Chromium heap-overflow claim against PartitionAlloc, CFI, the V8 sandbox, and renderer isolation.

7 min read
Sandia's 8085 ran with the door unlocked
access controlidentity boundary

Sandia's 8085 ran with the door unlocked

Sandia's SA3000 8085 CPU granted access on reachability, not identity. An unenforced boundary on a high-value resource is an open resource.

5 min read
Server returns 200, Google returns nothing
de-indexingOSINT integrity

Server returns 200, Google returns nothing

De-indexing removes content from Google's index, not the web - a complaint-driven, trust-based pipeline that lets implicated parties suppress public records.

6 min read
The role tag is a label, not a lock
prompt injectionllm security

The role tag is a label, not a lock

Prompt injection is not a bypass. It is the transformer resolving the whole context window as one sequence, trusting a role label it never enforces.

7 min read
Your three memory vendors are one vendor
supply chain securitythird-party risk

Your three memory vendors are one vendor

A US lawsuit alleging memory price fixing by Samsung, SK Hynix, and Micron exposes an unverified control: supplier independence assumed, never validated.

7 min read
1.3 million IPs hit LWN in two hours
scraper attacklayer 7 ddos

1.3 million IPs hit LWN in two hours

LWN.net is absorbing a 1.3-million-IP Layer 7 scraper flood. Why per-IP defenses fail, what web telemetry shows, and what shifts the cost back to the client.

6 min read