RC RANDOM CHAOS

Articles

Long-form writing on tech, culture, and the edges of the internet.

Chrome exempts Google's domains from user site-data controls
privacybrowser security

Chrome exempts Google's domains from user site-data controls

Chrome does not enforce user site data settings against Google-owned domains. What the exempt scope means and how to treat the control.

7 min read
LLMs turned fluency into a forged credential
social engineeringidentity verification

LLMs turned fluency into a forged credential

Perceived intelligence is a sender-controlled signal, not identity. Treating fluency as authorization is the exposure social engineers now produce on demand.

7 min read
qBittorrent escaped its sandbox and owned the host
sandbox escapecracked software

qBittorrent escaped its sandbox and owned the host

A sandbox controls what code can do, not what code is. When qBittorrent escaped confinement, provenance was the control that was never applied.

9 min read
An anonymity tool is not anonymity
Toranonymity

An anonymity tool is not anonymity

A Meta executive using Tor was unmasked as a torrent pirate by a private rights holder. A privacy tool is not anonymity; anonymity is an outcome.

7 min read
Chromium executes attacker code across every version
zero-daychromium

Chromium executes attacker code across every version

A zero-day sandbox RCE hits all Chromium versions under active exploitation, with no confirmed fixed build and a single containment control shown ineffective.

7 min read
Context is the whole bill
Claude CodeLLM engineering

Context is the whole bill

Portal by Spotify cut Claude Code token usage ~90% by serving scoped code slices instead of whole files, and why that matters for production AI systems.

9 min read
Same task, different bets
LLM engineeringAI agents

Same task, different bets

Claude, Codex and Cursor pick different tools across 17k runs - here is how to measure that revealed policy and wrap it in controls before it hits production.

10 min read
The best terminal assistant has no AI
deterministic automationLLM engineering

The best terminal assistant has no AI

TERMy runs without an LLM to show where deterministic retrieval beats AI-assisted terminal work: bounded inputs, known answers, instant offline lookups.

9 min read
The next commit captures the file you never named
git securitysecrets management

The next commit captures the file you never named

A .gitignore is a name-based deny-list on a capture-by-default store, so it cannot stop the unnamed secret that lands permanently in git history.

7 min read
The session that never expired
identity verificationKYC breach

The session that never expired

How attackers held a year-long live feed inside an ID verification vendor via exposed credentials and session persistence, and why telemetry missed it.

7 min read
The system ran one veteran 100 times
flock surveillanceaccess control

The system ran one veteran 100 times

One person was queried 100+ times in a Flock tracking system. When identity is the only enforced gate, abuse completes exactly like legitimate use.

6 min read
The torrent protocol shares your address by design
privacycybersecurity

The torrent protocol shares your address by design

How an adult studio unmasked a Meta exec's John Doe torrent handle, and what the IP-to-identity pipeline means for your privacy.

7 min read