Articles
Long-form writing on tech, culture, and the edges of the internet.
Compiling Python to metal deletes your security boundary
Compiling Python 3.14 to native code removes the interpreter that revalidated logic on every run, collapsing continuous trust into a single build-time event.
Your hypervisor was never a wall
CVE-2026-53359 Januscape is a KVM/x86 guest-to-host escape: granted guest access reached the host, proving isolation trusted by placement is not a control.
Kalshi ships an unauthenticated oracle
Kalshi resolves contracts against unauthenticated public news feeds - an oracle-manipulation flaw that lets crafted narratives move regulated markets.
Not a pricing problem
Why security automation like Splunk SOAR and ML triage costs more than the engineer it replaced: systems execute on referenced trust, not verification.
Vectra lifted bearer tokens off Teams disk
Why Microsoft Teams session tokens leak between workspace and consumer accounts, how bearer-token replay bypasses MFA, and what fires - and doesn't - in telemetry.
dd writes raw sectors below the filesystem
Why the Unix dd command is a real security primitive: raw block writes below the filesystem, wiper TTPs, exfiltration, and the telemetry gap defenders miss.
Alibaba moves to ban Claude Code over backdoor risk
A reported ban on a widely-used AI development tool reframes third-party AI access as a board-level exposure most organizations have not measured.
Bearer tokens vouch for nobody
Alibaba's restriction of Claude Code exposes how OAuth 2.0 bearer tokens resolve a past verification instead of validating the entity acting now.
htop is a reconnaissance surface
How htop and top expose Linux resource contention - OOM-killer steering, D-state telemetry gaps, niced miners, and PID exhaustion mapped to MITRE T1562 and T1499.
OAuth converts consent into standing permission
OAuth 2.0 issues a token, not an identity. It verifies authority once at consent and honours the reference thereafter, without ever revalidating the grant.
Palantir was blacklisted for working exactly as designed
Spain's Palantir blacklist is not about capability. It is what happens when a system executes trust granted once and never revalidates its lawful basis.
The unread binary every compiler still trusts
Translating rustc to C changes the compiler's substrate, not its logic of trust: build pipelines execute on resolved references, never verified content.