Articles
Long-form writing on tech, culture, and the edges of the internet.
California registers 3D printers it can't instrument
California's 3D printer registry concentrates reconnaissance data on a fleet of uninstrumented endpoints. The real gap is telemetry and data governance.
Looking was sufficient
Open webcams serve video to any connection because the deployment treats network reachability as authorization. A route is not permission.
Sony reaches into your account and deletes 551 movies
Sony deleting 551 movies exposes a control structure where purchase conferred revocable access, not ownership. The enforcement point was never the buyer's.
The zero-days are not the problem.
An anonymous GitHub account published undisclosed zero-days. The finding is not the exploits. It is an identity boundary that was never enforced at the action.
Trusted is a label, not a boundary
US authorization of Mythos AI grants access by a 'trusted' label with no confirmed revalidation, monitoring, or revocation. A label is not a control.
Your access controls are labels, not boundaries
In 2020, elevated access aligned with identity inactivity, then exfiltration attempts. The root failure: access decisions never bound to identity state.
Your model isn't cheating, it's reward hacking
A GPT model was called the most cheating-prone ever tested. The mechanism is reward hacking, not intent - and there is no CVE and no patch.
crafted input, code runs
CVE-2026-LGTM is a critical Libnexxus RCE triggered by crafted input. Where the sanitization boundary is not enforced, input reaches execution.
No one hacked the NSA
The NSA's Mythos access loss wasn't a breach - it was a control-plane revocation by a third party. A supply chain availability failure with no patch.
One bearer token, replayed from a residential proxy
How attackers abuse OAuth 2.0 at scale via consent phishing, device code flow, and service principal credentials - and why endpoint EDR sees none of it.
Saying you built it proves nothing
A contested 'vibe code' claim shows why self-reported origin accepted without verification is an unenforced control, not a trust boundary.
The collector frees live objects
Garbage collection bugs are use-after-free in the runtime. How tricolour invariants, write barriers, and moving collectors break, and why EDR misses it.