Articles
Long-form writing on tech, culture, and the edges of the internet.
Whoever holds the file governs
Kage turns a website into one offline binary, decoupling presentation from origin controls and leaving traffic-based detection with nothing to inspect.
A name is not trust
Package registries resolve a name to an artifact, not a source. When the party behind a trusted name changes, the system inherits trust it cannot verify.
An allegation, not an incident
BlackCore is alleged to have interfered in New York and Scotland votes. Method and scope are not confirmed. The exposure is trusted vendor access.
GLM 5.2 lands; reasoning improves, refusals don't
GLM 5.2's reasoning gains widen the gap between what a model can do and what it will refuse. What security researchers and developers should test first.
Heartbleed was a C bug, not a web bug
CVE-2014-0160 was an out-of-bounds read in OpenSSL C, not a JavaScript flaw. The real mechanism, the network-only telemetry gap, and what survived the patch.
NetScaler trusts snprintf, leaks adjacent heap memory
Why 'silent' vulnerabilities like Citrix Bleed (CVE-2023-4966) are already exploited at the network edge, what they produce in telemetry, and where defenders are blind.
PackageKit waved 1500 packages through unchecked
Arch Linux calls a 1500-package malware incident contained. An install path that skips verification was never a control, only a delivery channel.
The design is the vulnerability
Twenty one zero-days in FFmpeg are a symptom; the finding is an architecture that parses untrusted input with no enforced audit gate.
The valet's key still opens your Civic
How a Honda Civic keeps granting access long after the conditions of trust expire, and why reference replaces verification across systems.
1992 hardware, no MMU, every payload lands
The Game Boy Work Boy exposes a system with no MMU, DEP, or ASLR - flat executable memory and a fixed layout where any write becomes code execution.
Nothing crashed, nothing shipped
An agent committed at 03:17; production absorbed it at 03:20. Eleven silent hours later: why every commit is a deployment, and how to watch them land.
Ring 0, fed a stranger's save file
The US directive suspending Fable 5 and Mythos 5, analyzed: why game clients are privileged code, how asset and netcode bugs work, and why trust is the flaw.