Articles
Long-form writing on tech, culture, and the edges of the internet.
One million passports now sit in the open
One million passport records exposed online: a board-level view of identity-layer risk, control failure, and the conditions leadership must now enforce.
Security teams mislabeled the GPU bubble
The GPU bubble is not a hardware vulnerability. It is a demand spike against allocation systems that enforce no limit under scarcity.
The machine quoted an EFF staffer who never existed
A news system generated quotes from EFF staff who never existed because it resolves references without confirming that what they point to is real.
Zluda 6 unpins CUDA from Nvidia hardware
Zluda 6 runs unmodified CUDA code on non-Nvidia GPUs, breaking a hardware-software pairing that was never an enforced control. What that exposes.
Age verification is identity verification
Age verification resolves identity once and answers every access by reference, relocating control over disclosure from the user to an attestation layer.
Every kernel launch is an ioctl into ring 0
Launching a CUDA kernel crosses into ring 0 via the NVIDIA kernel-mode driver - the real attack surface behind GPU compute, its CVE class, and detection gaps.
Fast enough to lie
Package managers hang for minutes because they execute on a returned value, never measuring the network latency their design assumed would stay constant.
Flock's real attack surface was never the camera
Flock ALPR cameras are a national sensor grid - the security risk isn't recording, it's a queryable movement database reachable by thousands of weak accounts.
#gerpar trended this week; PartitionAlloc already answers it
A. Shah (REDLINE) tests the trending #gerpar Chromium heap-overflow claim against PartitionAlloc, CFI, the V8 sandbox, and renderer isolation.
Sandia's 8085 ran with the door unlocked
Sandia's SA3000 8085 CPU granted access on reachability, not identity. An unenforced boundary on a high-value resource is an open resource.
Server returns 200, Google returns nothing
De-indexing removes content from Google's index, not the web - a complaint-driven, trust-based pipeline that lets implicated parties suppress public records.
The role tag is a label, not a lock
Prompt injection is not a bypass. It is the transformer resolving the whole context window as one sequence, trusting a role label it never enforces.