Skip to main content
Writing

Blog

Engineering, security, and growth. Short notes on how we ship, what we test, and how a page earns a citation.

Security

The patch that broke the guard

Microsoft shipped a fix for Windows Defender crashing with 0xc0000005 after a security update. The same week Ars reported a Mac bug under active exploitation. Patch is not a vibe.

Read
Security

Someone else has to sign the tree

Trail of Bits is an independent signer on Signal's key-transparency work. If your product stores secrets or model memory, you also need a third party who can say the tree is wrong.

Read
Security

Shared metal still has a memory

Cloudflare revisited Spectre-class attacks on Workers. AWS wrote up passing user auth into Bedrock agents the same day. Isolation and identity are still the job.

Read
Engineering

Revoke the stolen PAT, leave the deploy keys

GitHub now lets admins revoke credentials by token type. That is the difference between containing a leak and taking the company offline for a night.

Read
Engineering

Open weights are a procurement question

Hugging Face's summer 2026 open-model roundup and Mistral's regional inference pitch are the same decision: residency, lock-in, and who owns the off switch.

Read
Security

Eight hours in someone else's EHR

CareCloud told HHS that 3.76 million people were affected after an attacker spent eight hours in an EHR environment. Dwell time is the product. Detection is the service.

Read

Send the ticket

Write what is broken or what you want shipped. We will say if it is a week or a quarter.

Start a project