Articles
Long-form writing on tech, culture, and the edges of the internet.
No mitigations, full code execution
Memory corruption in shared embedded firmware components grants attacker code execution at firmware privilege, replicated across hundreds of vendor devices.
Removing curl and wget stops nothing
Bash /dev/tcp opens TCP sockets and sends HTTP with no curl or wget, evading process-name detection while leaving cleartext on the wire.
The door was unlocked, not picked
Federal concern over fable 5 was a trust boundary failure, not a jailbreak. Fix this code targets content, not access enforcement.
1994's eight fallacies hit AI agents harder
The eight fallacies of distributed computing turn 21, and autonomous AI agents make every one of those architectural assumptions more dangerous.
Contagious Interview ends at npm install
How DPRK actors turn LinkedIn job offers into code execution via npm postinstall hooks, what BeaverTail steals, and why developer endpoints stay blind.
DELETE leaves the body
DROP TABLE and DELETE in Postgres destroy nothing: MVCC dead tuples, unlinked relfilenodes, and WAL keep the data recoverable, and replicas diverge.
Forum sellers timestamp breaches before victims notice
A cybercriminal's first forum sales thread is often a fresh breach - a timeline anchor, an attribution leak, and the earliest warning most orgs ignore.
One login screen now guards your entire machine
Windows 11's forced Microsoft account moves the identity boundary to one access point. Compromise the account and you assume the control, not bypass it.
The 34x price hike isn't the problem
Hetzner raised dedicated server prices 34x. The cost is the symptom. The exposure is single-vendor control over a boundary the customer cannot enforce.
The contract you pasted is now giving orders
Large AI context windows turn conversations into unsecured databases, breaking DLP assumptions and opening prompt injection paths. Here's how to reassess the risk.
Whoever holds the file governs
Kage turns a website into one offline binary, decoupling presentation from origin controls and leaving traffic-based detection with nothing to inspect.
A name is not trust
Package registries resolve a name to an artifact, not a source. When the party behind a trusted name changes, the system inherits trust it cannot verify.