Articles
Long-form writing on tech, culture, and the edges of the internet.
The surveillance doesn't have to be real
An author alleges Meta surveilled her for 12 months. The act is unconfirmed; the capability is structural and built into centralized identity.
A crafted sprite overflows the blitter's heap
Attack-surface analysis of OpenTTD 160beta1: integer overflow in sprite decoding, untrusted savegame and packet parsing, and why EDR stays blind.
California registers 3D printers it can't instrument
California's 3D printer registry concentrates reconnaissance data on a fleet of uninstrumented endpoints. The real gap is telemetry and data governance.
Looking was sufficient
Open webcams serve video to any connection because the deployment treats network reachability as authorization. A route is not permission.
Sony reaches into your account and deletes 551 movies
Sony deleting 551 movies exposes a control structure where purchase conferred revocable access, not ownership. The enforcement point was never the buyer's.
The zero-days are not the problem.
An anonymous GitHub account published undisclosed zero-days. The finding is not the exploits. It is an identity boundary that was never enforced at the action.
Trusted is a label, not a boundary
US authorization of Mythos AI grants access by a 'trusted' label with no confirmed revalidation, monitoring, or revocation. A label is not a control.
Your access controls are labels, not boundaries
In 2020, elevated access aligned with identity inactivity, then exfiltration attempts. The root failure: access decisions never bound to identity state.
Your model isn't cheating, it's reward hacking
A GPT model was called the most cheating-prone ever tested. The mechanism is reward hacking, not intent - and there is no CVE and no patch.
crafted input, code runs
CVE-2026-LGTM is a critical Libnexxus RCE triggered by crafted input. Where the sanitization boundary is not enforced, input reaches execution.
No one hacked the NSA
The NSA's Mythos access loss wasn't a breach - it was a control-plane revocation by a third party. A supply chain availability failure with no patch.
One bearer token, replayed from a residential proxy
How attackers abuse OAuth 2.0 at scale via consent phishing, device code flow, and service principal credentials - and why endpoint EDR sees none of it.