Articles
Long-form writing on tech, culture, and the edges of the internet.
Cooldown does not fix the resolver
Bundler 2.6 cooldown defers new gem versions to interrupt published-and-pulled supply chain attacks. The resolver's trust model is the systemic exposure.
Editorial independence is a failed control
UK media failed to disclose defence sector ties in nearly 60 percent of cases. The disclosure gap is an information supply chain vulnerability - and it is exploitable.
Europe maps GNSS jammers mid-attack
Powerful GNSS interference over Europe exposes location-based controls as ineffective. Unauthenticated positional data is not a security boundary.
Korea's KCSC mandates server-side image parsers
Korea's mandatory AI image scanning forces every forum into a multi-layer parser and ML pipeline. The CVE surface and exploitation paths that result.
memcpy walks off the end of the receiver
rsync shipped six CVEs in January 2025. LLMs did not write new bugs - they compressed variant discovery, harness generation, and vulnerable deployment.
Meta enabled ADB on deprecated Portals
Meta enabled ADB on deprecated Portal devices. Lifecycle status was decoupled from access surface. The mechanism, the pattern, and the operator position.
Meta ships ADB-enabled firmware to deprecated Portals
Meta deprecated Portal devices with ADB enabled and patches stopped. Unpatched Android cameras and microphones now sit as permanent network exposure.
Meta's chatbot handed out accounts
Meta confirmed thousands of Instagram accounts compromised via AI chatbot abuse. The chatbot was treated as a boundary it could not hold.
Netherlands restricts DigiD to European operator
Dutch government restricts DigiD operation to a European vendor. Jurisdiction changes. The single-vendor identity concentration risk does not.
One vendor, one subpoena, one reach
Cloudflare's VoidZero acquisition collapses the vendor boundary between build tooling and edge runtime. Attestation reduces to self-reporting.
Spanish police flagged GrapheneOS as suspicion
Authorities treating GrapheneOS as a targeting signal inverts threat intel logic and exposes the wrong population to scrutiny. The mechanism breakdown.
Switching payment processors is a security event
Gov.uk replaced Stripe with Adyen. The processor moved. The trust boundary moved. What that means for identity, access, and control enforcement.