Articles
Long-form writing on tech, culture, and the edges of the internet.
The padlock only proves someone holds the key
X.509 certificates authenticate a source, not the truth of its content, and trust resolved once at issuance is inherited unchanged until it expires.
A grep job cost forty-seven dollars
A scheduled Claude Code skill shelled out to curl on its own and burned $47.30 in 19 minutes. The root cause, the commit 7a3b8d2 that fixed it, and the guardrails.
Absence is not proof
Vancouver PD's Quick Escape button erases its own browser-history record on execution, leaving a control that cannot be verified or reconstructed.
Grok packed your home folder into an API request
How AI assistants with filesystem access end up transmitting your home directory to vendor servers - and the concrete steps to scope, verify, and contain it.
TS-2026-009 turned an argument into root
TS-2026-009: Tailscale SSH permitted root through argument handling. When supplied input can reach the privilege context, argument handling is the access control.
Your image parser is a remote kill switch
Codex Micro's unvalidated image upload endpoint decodes attacker-controlled rasters in-band with a check-then-act race, enabling CWE-400/CWE-770 resource exhaustion.
Count Binface breaks your correlation rule
Count Binface names a detection-pipeline attack: targeted noise injection exploits data-aggregation bias to bury true positives and poison UEBA baselines.
serverHold pulled t.me from the zone, no CVE fired
Telegram's t.me suspension was an EPP registry status code, not an exploit - a look at ccTLD delegation, serverHold mechanics, and the telemetry defenders miss.
GhostLock is not a vulnerability.
GhostLock is a stack use-after-free present in every Linux distribution for fifteen years, exposing an enforcement point that was never built.
Grok copied your directory to xAI's servers
Grok uploaded a user directory to xAI. The failure is identity and access management: execution context reached local files with no enforced boundary.
tanh now fingerprints your OS
Chromium 148 dispatches Math.tanh to the platform libm, leaking OS identity through last-bit IEEE 754 divergence. A silent, unpatchable fingerprinting signal.
The flat line is the exploit
A flat SOC dashboard can be defense evasion, not a quiet network. How APTs shape telemetry to land in a pipeline's discard paths, and why the graph is the IOC.