Articles
Long-form writing on tech, culture, and the edges of the internet.
GhostLock is not a vulnerability.
GhostLock is a stack use-after-free present in every Linux distribution for fifteen years, exposing an enforcement point that was never built.
Grok copied your directory to xAI's servers
Grok uploaded a user directory to xAI. The failure is identity and access management: execution context reached local files with no enforced boundary.
tanh now fingerprints your OS
Chromium 148 dispatches Math.tanh to the platform libm, leaking OS identity through last-bit IEEE 754 divergence. A silent, unpatchable fingerprinting signal.
The flat line is the exploit
A flat SOC dashboard can be defense evasion, not a quiet network. How APTs shape telemetry to land in a pipeline's discard paths, and why the graph is the IOC.
Train the AI or Samsung erases your health record
Samsung deletes your health data unless you let it train AI. That is not consent. It is coercion recorded as authorization.
XBOW topped HackerOne in 2025 and fixed nothing
Vulnerability research rewards finding, not fixing. Exploitation tracks disclosure, not the flaw. Why attackers react to reported CVEs, and where telemetry goes blind.
Possession is the credential
Verified badges, JWTs and X.509 certificates resolve trust once and keep honoring the reference long after the reality behind it has moved.
The kernel keeps its word
OpenBSD's use-after-free is not a bypass but the kernel honoring a reference it validated once and never rechecked, the same pattern behind X.509 certificate trust.
The US bought a cheaper way to keep losing
Iran's destruction of $1B in Reapers exposes predictable targeting as a static-trust failure. A cheaper drone with the same pattern is engaged at the same rate.
A smarter model would have leaked it too.
GitHub's AI agent leaked private repos not from a bug but a design failure. How two-plane architecture, scoped tokens, and deterministic validation stop it.
Open source is not decentralized
Damn Interesting going paid is an indicator, not a failure: deep technical analysis concentrates value, and concentrated value gets targeted.
The browser runs whatever the host returns
A browser tab holding 2 GB is not a malfunction; it is a trust model that resolves references and never revalidates the referent behind the name.