Articles
Long-form writing on tech, culture, and the edges of the internet.
A homepage visit now runs PowerShell on your machine
Gizmodo's homepage served a ClickFix attack routing a pasted URL into PowerShell. The failed boundary is the shell and the user's identity, not the browser.
A SQLite underflow, and the flood behind it
AI isn't replacing defenders - it's multiplying vulnerability volume, hallucinated dependencies, and synthetic findings. The skill that survives is validation at machine rate.
AMD's Memory Encryption Blind Spot
AMD re-enables TSME on Ryzen 9000 in July. What it stops, what it never touches, and the physical-attack telemetry gap defenders miss.
An AI engineer skipped the prediction test
How to evaluate an AI engineer's claim to have cracked Linear A - the data limits, the missing known language, and the peer review that separates progress from hype.
Completing the task was the breach
An identity completed tasks it was never provisioned for. The boundary was described, not enforced. This is a control gap, not a competence problem.
DuckDB trusts persisted blocks attackers control
DuckDB runs in-process as a C++ library. Its immutability and checksum assumptions create a quiet memory-corruption surface that host EDR never sees.
Gizmodo's front door now hands visitors malware
Gizmodo's homepage delivered a ClickFix attack at runtime, showing how unenforced content delivery controls turn a trusted brand surface into a delivery point.
Google gates Workspace by browser, not credential
Google Workspace's move to gate Firefox keys access on a client signature, not identity. A control on the wrong boundary does not stop attackers.
It's 6.1, not 3.8
SteamOS 3.x runs a Valve-patched 6.x kernel, not Linux 3.8 - the real risk is standard local-privilege-escalation bugs on an unmanaged device with no telemetry.
No instances, bigger targets
ATProto has no instances, but the trust boundaries didn't vanish - they consolidated into plc.directory, DNS handle resolution, and rotation-key custody.
The Open Courts Act exposes what PACER fees hid
PACER's per-page fee was an accidental privacy brake. Making court records free is right - but only if redaction, governed bulk access, and security replace it.
Trust does not carry forward
GPT55 hallucinated three times more than GLM52 on identical prompts. The cause is systemic: systems resolve references without revalidating their content.