Articles
Long-form writing on tech, culture, and the edges of the internet.
Context is the whole bill
Portal by Spotify cut Claude Code token usage ~90% by serving scoped code slices instead of whole files, and why that matters for production AI systems.
Same task, different bets
Claude, Codex and Cursor pick different tools across 17k runs - here is how to measure that revealed policy and wrap it in controls before it hits production.
The best terminal assistant has no AI
TERMy runs without an LLM to show where deterministic retrieval beats AI-assisted terminal work: bounded inputs, known answers, instant offline lookups.
The next commit captures the file you never named
A .gitignore is a name-based deny-list on a capture-by-default store, so it cannot stop the unnamed secret that lands permanently in git history.
The session that never expired
How attackers held a year-long live feed inside an ID verification vendor via exposed credentials and session persistence, and why telemetry missed it.
The system ran one veteran 100 times
One person was queried 100+ times in a Flock tracking system. When identity is the only enforced gate, abuse completes exactly like legitimate use.
The torrent protocol shares your address by design
How an adult studio unmasked a Meta exec's John Doe torrent handle, and what the IP-to-identity pipeline means for your privacy.
Cerebras runs Qwen 27B at 1,500 tokens a second
Qwen 3.8 27B on Cerebras at 1,500 tokens/s adds no new capability - it changes the economics of attack and defense. What the raw speed means for security.
Make the binary say yes
Why a stripped binary is not a security control, how reverse engineering recovers its logic, and where access decisions must actually execute.
The sand was never boxed
A sandbox is a set of filters on named dimensions, not a boundary of execution. It matches references and never revalidates the capability they compose.
Verification became the leak
An unauthorized live feed of every ID verification let attackers bypass MFA for over a year. Why readable verification output stops being proof.
Gemini 3.8 Flash captures your evaluation inputs
Evaluating Gemini 3.8 Flash and Flash Cyber transfers your input to infrastructure you cannot inspect. What failed, the pattern, and what must now be true.