Articles
Long-form writing on tech, culture, and the edges of the internet.
Train the AI or Samsung erases your health record
Samsung deletes your health data unless you let it train AI. That is not consent. It is coercion recorded as authorization.
XBOW topped HackerOne in 2025 and fixed nothing
Vulnerability research rewards finding, not fixing. Exploitation tracks disclosure, not the flaw. Why attackers react to reported CVEs, and where telemetry goes blind.
Possession is the credential
Verified badges, JWTs and X.509 certificates resolve trust once and keep honoring the reference long after the reality behind it has moved.
The kernel keeps its word
OpenBSD's use-after-free is not a bypass but the kernel honoring a reference it validated once and never rechecked, the same pattern behind X.509 certificate trust.
The US bought a cheaper way to keep losing
Iran's destruction of $1B in Reapers exposes predictable targeting as a static-trust failure. A cheaper drone with the same pattern is engaged at the same rate.
A smarter model would have leaked it too.
GitHub's AI agent leaked private repos not from a bug but a design failure. How two-plane architecture, scoped tokens, and deterministic validation stop it.
Open source is not decentralized
Damn Interesting going paid is an indicator, not a failure: deep technical analysis concentrates value, and concentrated value gets targeted.
The browser runs whatever the host returns
A browser tab holding 2 GB is not a malfunction; it is a trust model that resolves references and never revalidates the referent behind the name.
The copy runs past the allocation, again
Recurring dystopian tech vulnerabilities persist because defenders patch the CVE instance and never hunt the underlying mechanism. The inaction is the vuln.
The kernel is still C
An OpenBSD kernel use-after-free (CWE-416, CVSS 7.8) escalates a local user to root via pool reclaim and cr_uid overwrite. Mechanism, exploit path, and the BSD telemetry gap.
The rubric graded an empty chair
Brown's AI cheating scandal is not a student failure. It is an assessment system that resolves trust by reference and never revalidates the reality behind it.
The string you validated no longer exists
Unicode transliteration is a Turing-complete rewrite engine at every trust boundary. CVE-2024-4577, Django CVE-2019-19844, and Trojan Source show why.