Articles
Long-form writing on tech, culture, and the edges of the internet.
Chrome exempts Google's domains from user site-data controls
Chrome does not enforce user site data settings against Google-owned domains. What the exempt scope means and how to treat the control.
LLMs turned fluency into a forged credential
Perceived intelligence is a sender-controlled signal, not identity. Treating fluency as authorization is the exposure social engineers now produce on demand.
qBittorrent escaped its sandbox and owned the host
A sandbox controls what code can do, not what code is. When qBittorrent escaped confinement, provenance was the control that was never applied.
An anonymity tool is not anonymity
A Meta executive using Tor was unmasked as a torrent pirate by a private rights holder. A privacy tool is not anonymity; anonymity is an outcome.
Chromium executes attacker code across every version
A zero-day sandbox RCE hits all Chromium versions under active exploitation, with no confirmed fixed build and a single containment control shown ineffective.
Context is the whole bill
Portal by Spotify cut Claude Code token usage ~90% by serving scoped code slices instead of whole files, and why that matters for production AI systems.
Same task, different bets
Claude, Codex and Cursor pick different tools across 17k runs - here is how to measure that revealed policy and wrap it in controls before it hits production.
The best terminal assistant has no AI
TERMy runs without an LLM to show where deterministic retrieval beats AI-assisted terminal work: bounded inputs, known answers, instant offline lookups.
The next commit captures the file you never named
A .gitignore is a name-based deny-list on a capture-by-default store, so it cannot stop the unnamed secret that lands permanently in git history.
The session that never expired
How attackers held a year-long live feed inside an ID verification vendor via exposed credentials and session persistence, and why telemetry missed it.
The system ran one veteran 100 times
One person was queried 100+ times in a Flock tracking system. When identity is the only enforced gate, abuse completes exactly like legitimate use.
The torrent protocol shares your address by design
How an adult studio unmasked a Meta exec's John Doe torrent handle, and what the IP-to-identity pipeline means for your privacy.