Articles
Long-form writing on tech, culture, and the edges of the internet.
Kalshi ships an unauthenticated oracle
Kalshi resolves contracts against unauthenticated public news feeds - an oracle-manipulation flaw that lets crafted narratives move regulated markets.
Not a pricing problem
Why security automation like Splunk SOAR and ML triage costs more than the engineer it replaced: systems execute on referenced trust, not verification.
Vectra lifted bearer tokens off Teams disk
Why Microsoft Teams session tokens leak between workspace and consumer accounts, how bearer-token replay bypasses MFA, and what fires - and doesn't - in telemetry.
dd writes raw sectors below the filesystem
Why the Unix dd command is a real security primitive: raw block writes below the filesystem, wiper TTPs, exfiltration, and the telemetry gap defenders miss.
Alibaba moves to ban Claude Code over backdoor risk
A reported ban on a widely-used AI development tool reframes third-party AI access as a board-level exposure most organizations have not measured.
Bearer tokens vouch for nobody
Alibaba's restriction of Claude Code exposes how OAuth 2.0 bearer tokens resolve a past verification instead of validating the entity acting now.
htop is a reconnaissance surface
How htop and top expose Linux resource contention - OOM-killer steering, D-state telemetry gaps, niced miners, and PID exhaustion mapped to MITRE T1562 and T1499.
OAuth converts consent into standing permission
OAuth 2.0 issues a token, not an identity. It verifies authority once at consent and honours the reference thereafter, without ever revalidating the grant.
Palantir was blacklisted for working exactly as designed
Spain's Palantir blacklist is not about capability. It is what happens when a system executes trust granted once and never revalidates its lawful basis.
The unread binary every compiler still trusts
Translating rustc to C changes the compiler's substrate, not its logic of trust: build pipelines execute on resolved references, never verified content.
YouTube exposed creators' private videos
YouTube creators' private videos were accessed and leaked. The private label failed as an access control. What that failure exposes, defined strictly.
Alibaba bans Claude Code across its engineering org
Alibaba's reported ban on Claude Code is a trust decision, not a CVE. Why an agentic coding tool's sanctioned egress is also its exfiltration path.