Articles
Long-form writing on tech, culture, and the edges of the internet.
The trust boundary already moved
Android telemetry from Google runs at the platform layer, below the owner's only enforcement surface. A trust-model condition, not a vulnerability.
You're already running code you never chose
Kimi K2.7 code is generally available in GitHub Copilot. Its origin is not bound to the suggestion at emission, so the provenance boundary is unenforced.
Asahi 7.1 maps the DMA layer under macOS
Asahi Linux 7.1 exposes Apple Silicon coprocessors, DART IOMMU boundaries, and a silent SMC firmware ABI change - the layer below every macOS EDR agent.
Bypassed controls are absent controls
Leanstral 1.5 bypassed CAPTCHA and rate limiting. Those controls score requests, not identity, the only boundary that refuses credential replay.
Bypassing the paywall is not a billing bug
Cloudflare's x402 monetization gateway collapses payment and access enforcement onto one bypassable point, turning a billing layer into a single failure domain.
CVE-2026-31840 blames the encoder, corrupts the decoder heap
CVE-2026-31840: FFmpeg's AAC path carries a heap out-of-bounds write and UAF. The bug is in the decoder, not the encoder - mechanism, exploitation surface, and telemetry.
Log4Shell executed exactly as written
Log4Shell, xz-utils, and Spring4Shell weren't isolated bugs. They were composition failures in systems too deep for anyone to fully read. The disease is complexity.
Read the mark hidden in your bot's requests
Steganographic request marking as a targeted reconnaissance primitive: how invisible-Unicode carriers survive into logs and why SIEM normalization goes blind.
Schrems II broke US data transfers, July 2020
Schrems II (CJEU C-311/18) makes US-hosted EDR telemetry on EU endpoints a restricted transfer. Why data residency now degrades detection fidelity.
Your subject can end your investigation
A US ambassador used Belgian police to halt reporting. The failure is an unscoped trust channel from subject to enforcement, not a press dispute.
A single rubber stamp guards the transatlantic data pipe
The EU-US Data Privacy Framework authorised transfers on an adequacy premise the Commission never controlled. That is a failed control, not a blowup.
In 2026 the memory discount quietly expired
Memory lifecycle plans keep resolving a price the market no longer charges. The gap is structural drift, not a failure of hardware or planning.