Articles
Long-form writing on tech, culture, and the edges of the internet.
MITRE already filed your detection bypass as AML.T0015
ML malware detection is a deterministic classifier with a mappable decision boundary. Attackers exploit its learned bias. That demands more engineering.
Certified is not secure
Volkswagen blocking GrapheneOS shows what it costs when one attestation flag replaces a real risk decision, and why orchestration beats a longer blocklist.
DeepSeek dodged the Entity List, not your pipeline
US regulators listed 100+ firms but held off on DeepSeek. The real exposure: third-party AI weights and inference as a trusted security supply chain.
demand is not a control
Stop Killing Games gathered 13 million signatures and produced no EU law. The proposed approach lacked granular data access control and identity verification.
Firecracker contains the attack it never sees
Firecracker microVMs on EC2 bare metal boot in under a second and tear down before any EDR, log flush, or forensic capture can observe them.
five dollars is the instrument
A five dollar demand to return images is a rights-framed extortion probe exploiting unenforced consent governance, not ransomware.
ScStoragePathFromUrl overflows the stack on PROPFIND
CVE-2017-7269 turns an unpatched IIS 6.0 WebDAV server into pre-auth RCE. The exploit primitive, the telemetry blind spot, and the residual exposure.
Stop Killing Games guarantees unpatched network-reachable code
Stop Killing Games is preservation law, not a security control. Statute governs publishers; it never patches the memory-corruption bugs attackers exploit.
The demo passed. Two weeks later, the queue filled.
Prompt engineering treats AI as magic. Reliable LLM systems come from validation, retries, fallbacks, and monitoring - not better wording.
What a tool does never made it safe
When ownership of an integrated, data-access tool changes, existing access persists under a new identity unless it is revoked and re-issued.
When Broadcom bought VMware, Tesco moved 40,000 workloads
Tesco moving 40,000 workloads off VMware shows how systems execute on reference, not validation, and why inherited trust does not survive a change of owner.
A valid JWT authenticates nothing
A JWT is a signed data structure, not authentication. The security lives in the verifier, not the token. Where validation is optional, the boundary is gone.