Writing

Blog

Engineering, security, and growth. Short notes on how we ship, what we test, and how a page earns a citation.

Featured

19 August 2026Engineering

Thirty billion on the desk, three billion awake

Ollama shipped NVIDIA Nemotron 3.5 Lightning, a 30B open model that keeps about 3B parameters active. That is a local agent you can actually budget hardware for.

Read

19 August 2026Security

IKE is not a set-and-forget VPN checkbox

CISA put a Windows IKE Extension RCE on the KEV list after seeing it used. If your edge still speaks IPsec, treat IKE like a live service, not a set-and-forget box.

Read

19 August 2026Engineering

Fifty-two from a 17GB file

Qwen 3.8 27B scored 52 on Artificial Analysis's Intelligence Index, tied with GPT-5.6 Luna (max). The default reasoning setting is what actually burns the box.

Read

19 August 2026Engineering

Your kernel crypto socket is leaving

LWN reports Fedora moving to restrict AF_ALG, the old userspace crypto socket, after flaws like Copy Fail. Kernel 7.1.9 stable landed the same week. Name your branch.

Read

19 August 2026Engineering

The vendor that stopped answering

A PBS station may lose about 50TB after a cloud storage vendor went silent. Cheap object storage without an export drill is not a disaster plan.

Read

19 August 2026Security

The patch that broke the guard

Microsoft shipped a fix for Windows Defender crashing with 0xc0000005 after a security update. The same week Ars reported a Mac bug under active exploitation. Patch is not a vibe.

Read

19 August 2026Security

Someone else has to sign the tree

Trail of Bits is an independent signer on Signal's key-transparency work. If your product stores secrets or model memory, you also need a third party who can say the tree is wrong.

Read

19 August 2026Security

Shared metal still has a memory

Cloudflare revisited Spectre-class attacks on Workers. AWS wrote up passing user auth into Bedrock agents the same day. Isolation and identity are still the job.

Read

19 August 2026Engineering

Revoke the stolen PAT, leave the deploy keys

GitHub now lets admins revoke credentials by token type. That is the difference between containing a leak and taking the company offline for a night.

Read

19 August 2026Engineering

Open weights are a procurement question

Hugging Face's summer 2026 open-model roundup and Mistral's regional inference pitch are the same decision: residency, lock-in, and who owns the off switch.

Read

19 August 2026Security

Eight hours in someone else's EHR

CareCloud told HHS that 3.76 million people were affected after an attacker spent eight hours in an EHR environment. Dwell time is the product. Detection is the service.

Read

Send the ticket

Write what is broken or what you want shipped. We will say if it is a week or a quarter.

Start Your Project

Our Services

Quick Links

Get In Touch

Our Services

Quick Links

Get In Touch

Blog

Featured

Thirty billion on the desk, three billion awake

IKE is not a set-and-forget VPN checkbox

Fifty-two from a 17GB file

Your kernel crypto socket is leaving

The vendor that stopped answering

The patch that broke the guard

Someone else has to sign the tree

Shared metal still has a memory

Revoke the stolen PAT, leave the deploy keys

Open weights are a procurement question

Eight hours in someone else's EHR

Send the ticket