RC RANDOM CHAOS

Articles

Long-form writing on tech, culture, and the edges of the internet.

A homepage visit now runs PowerShell on your machine
ClickFixPowerShell malware

A homepage visit now runs PowerShell on your machine

Gizmodo's homepage served a ClickFix attack routing a pasted URL into PowerShell. The failed boundary is the shell and the user's identity, not the browser.

7 min read
A SQLite underflow, and the flood behind it
detection-engineeringai-security

A SQLite underflow, and the flood behind it

AI isn't replacing defenders - it's multiplying vulnerability volume, hallucinated dependencies, and synthetic findings. The skill that survives is validation at machine rate.

16 min read
AMD's Memory Encryption Blind Spot
memory-encryptionamd-ryzen

AMD's Memory Encryption Blind Spot

AMD re-enables TSME on Ryzen 9000 in July. What it stops, what it never touches, and the physical-attack telemetry gap defenders miss.

7 min read
An AI engineer skipped the prediction test
linear aai hype

An AI engineer skipped the prediction test

How to evaluate an AI engineer's claim to have cracked Linear A - the data limits, the missing known language, and the peer review that separates progress from hype.

7 min read
Completing the task was the breach
access-controlidentity-boundary

Completing the task was the breach

An identity completed tasks it was never provisioned for. The boundary was described, not enforced. This is a control gap, not a competence problem.

9 min read
DuckDB trusts persisted blocks attackers control
duckdbmemory-safety

DuckDB trusts persisted blocks attackers control

DuckDB runs in-process as a C++ library. Its immutability and checksum assumptions create a quiet memory-corruption surface that host EDR never sees.

7 min read
Gizmodo's front door now hands visitors malware
board riskbrand trust

Gizmodo's front door now hands visitors malware

Gizmodo's homepage delivered a ClickFix attack at runtime, showing how unenforced content delivery controls turn a trusted brand surface into a delivery point.

7 min read
Google gates Workspace by browser, not credential
access-controlidentity

Google gates Workspace by browser, not credential

Google Workspace's move to gate Firefox keys access on a client signature, not identity. A control on the wrong boundary does not stop attackers.

9 min read
It's 6.1, not 3.8
SteamOSLinux kernel security

It's 6.1, not 3.8

SteamOS 3.x runs a Valve-patched 6.x kernel, not Linux 3.8 - the real risk is standard local-privilege-escalation bugs on an unmanaged device with no telemetry.

6 min read
No instances, bigger targets
atprotodecentralized-identity

No instances, bigger targets

ATProto has no instances, but the trust boundaries didn't vanish - they consolidated into plc.directory, DNS handle resolution, and rotation-key custody.

7 min read
The Open Courts Act exposes what PACER fees hid
data governanceAI safety

The Open Courts Act exposes what PACER fees hid

PACER's per-page fee was an accidental privacy brake. Making court records free is right - but only if redaction, governed bulk access, and security replace it.

18 min read
Trust does not carry forward
systems drifthallucination

Trust does not carry forward

GPT55 hallucinated three times more than GLM52 on identical prompts. The cause is systemic: systems resolve references without revalidating their content.

6 min read