Articles
Long-form writing on tech, culture, and the edges of the internet.
A favicon is a code execution primitive.
How attackers hide skimmers and full payloads in favicon files, why MIME and CSP misconfiguration lets image bytes run as code, and what defenders miss.
A loupe over the data iOS never asked about
Loupe shows iOS gates a fixed sensor list and leaves contextual device data readable by default, with no prompt, no consent, and no record of access.
A model brute-forced Linear A
A Linear A decipherment claim exposes the lesson defenders miss: complexity is not security, and scaled pattern recognition defeats obscurity.
Google IPv6 crossed 50%, your IPv4 controls didn't follow
Google's IPv6 traffic crossed 50 percent. IPv4-era controls don't see IPv6 - the kernel, NDP, scanning, and telemetry reality for defenders.
Google killed io_uring fleet-wide in 2023
io_uring runs file and network operations off the syscall path, blinding seccomp, auditd, and EDR, while epoll stays observable to defenders.
Keep the hard part
AI doesn't erode your problem-solving skills-offloading the reasoning does. Any intelligence atrophies without use; the fix is design, not avoidance.
Linux kernel deleted strncpy across 360 patches
Linux removed strncpy across 360 patches over six years. The exposure: a bounded write primitive used as a safety control it never implemented.
Social engineering is a misconfiguration
Human error in identity workflows is a misconfiguration, not incompetence - how Scattered Spider, 0ktapus and MFA fatigue exploit the validation gap.
The channel trusted the sender
An unauthorized alert reached phones across Brazil. The confirmed finding is one control: sender authorization at the injection point did not hold.
The green check mark proves nothing
Accepting AI-generated code because it works extends your trust boundary to an unvetted source running under your identity. Function is not authorization.
The same-origin policy is not protecting your API
A permissive CORS header delegates the read decision to the requester, letting attacker script read authenticated responses through the victim's own browser.
2023 mistakes an IP address for a passport
Forcing real ID on all internet traffic relocates an unsolved identity problem to a layer that cannot verify the subject and creates a higher value target.