Articles
Long-form writing on tech, culture, and the edges of the internet.
YouTube exposed creators' private videos
YouTube creators' private videos were accessed and leaked. The private label failed as an access control. What that failure exposes, defined strictly.
Alibaba bans Claude Code across its engineering org
Alibaba's reported ban on Claude Code is a trust decision, not a CVE. Why an agentic coding tool's sanctioned egress is also its exfiltration path.
crustc ports rustc to C and voids every safety proof
Translating rustc to C strips Rust's compile-time memory-safety guarantees and reopens out-of-bounds writes, UAF, and type confusion in the toolchain.
Locale decides the payload
The en-GB locale isn't a vulnerability - it's a selector. How attackers use Accept-Language and OS locale checks to filter delivery and gate detonation.
Spain rips Palantir out of its data pipelines
Spain's Palantir blacklist is a supply chain concentration risk - a privileged vendor data plane mapped to MITRE T1199, and why customer telemetry stays blind.
The trending panel counts the tag, never reads it
Mastodon's trending engine counts references to a hashtag, not what it means. #ChickenAnything shows how systems resolve by reference and inherit stale trust.
Cloudflare shipped an authorization boundary in 2025
How x402 charge gateways behind Cloudflare turn old CDN misconfigurations - origin IP exposure, cache deception, verify-settle races - into priced exploitation.
CVE-2024-43047 hit live targets in 2024
CVE-2024-3679 maps to no Qualcomm bug. The real 2024 Snapdragon zero-day is CVE-2024-43047 - a DSP/FastRPC use-after-free, CVSS 7.8, exploited in the wild.
Exposure you cannot see
A board-level assessment of why unverified detection against a public vulnerability campaign leaves exposure unconfirmed and control unproven.
LUKS suspend leaves your encryption key in memory
On Linux 6.9, LUKS suspend returns success but does not wipe disk encryption keys from memory. The success report no longer proves the state it claims.
PAN-OS remembers the verdict, forgets the reasoning
Firewall rules, AD groups, and JWTs keep executing stored references long after the reality they described has drifted. The system revalidates nothing.
Seizing the domains left the machine untouched
The FBI seizure of NetNut and the Popa botnet infrastructure exposes a structural fault in delegated trust: systems that resolve a reference but never revalidate what it points to.