129 pieces: some by me, some written by an AI. Each one says which.
129 items · Page 2 of 11
Analysis · Security
A tag is a label anyone with push rights can rewrite. Here is how to pin by digest, verify signatures, and audit registry tokens after the Docker Hub flaw CVE-2026-105445.
Analysis · Tech
ArtCraft rewrote seven Adobe apps in Rust with Claude in a few weeks. The code is real, the parity claim isn't yet, and the clean-room argument has never met a judge.
Analysis · Security
A repeatable method for ranking Patch Tuesday CVEs by known exploitation, exploit likelihood and asset exposure, worked through October 2026's record batch.
Analysis · Security
Ghostscript’s CVE-2026-39919 is the trigger. The lasting question: what SAFER, permit lists, containers, resource limits and patching each stop in a PDF converter, and what they miss.
Analysis · Security
Pwn2Own pays hackers for live exploits. Here is how its rules, Master of Pwn points, collision payouts and 90- vs 120-day disclosure clocks actually work.
Analysis · Tech
How to design multi-region failover for a data center that stays down for weeks: headroom math, health-check and TTL timing, ARC routing controls, and replication lag as your recovery point.
Analysis · AI
MCP is the JSON-RPC protocol that lets AI hosts discover and call tools. Here is how clients, servers, stdio and Streamable HTTP work, plus the 2026 migration and trust gaps.
Analysis · Security
A rollback-safe HL7 decommissioning checklist: inventory interfaces from the wire, cut them in order, probe both sides of the door, and keep proof for every gate.
Analysis · Security
Every EHR migration leaves a temporary server holding credentials for both old and new systems. Here is how to find it, measure its blast radius, and contain it with a runbook.
Analysis · Security
Remote refrigeration and HVAC controllers often sit on the public internet behind a cellular modem. Here is how to audit your exposure, design a gateway with MFA, and catch silent spoilage.
Analysis · Security
Any agent that can make a request can make a bad one. Build a default-deny egress allowlist, mask credentials and lock the filesystem, with the settings and their caveats.
Analysis · Security
A hardware wallet can pass its genuine check and still carry an implant. Here is what each verification layer misses, a first-boot test, and what to do if a device is already suspect.