# Essays from the seams between security, systems, and operations. > Technical essays and field notes by Steven Foerster on security research, exploit development, AI red teaming, and Linux hardening. - Source: https://stevenfoerster.com/notes/ Notes I use this section to work through the engineering constraints, failed assumptions, and operating tradeoffs that short answers tend to hide. [RSS feed](https://stevenfoerster.com/rss.xml) [How to subscribe](https://stevenfoerster.com/subscribe/) Published when there is something worth sharing. ## Filter by topic - [All notes · 26](https://stevenfoerster.com/notes/) - [AI · 4](https://stevenfoerster.com/notes/#tag=ai) - [Cryptography · 3](https://stevenfoerster.com/notes/#tag=cryptography) - [eBPF · 1](https://stevenfoerster.com/notes/#tag=ebpf) - [Exploitation · 6](https://stevenfoerster.com/notes/#tag=exploitation) - [Infrastructure · 7](https://stevenfoerster.com/notes/#tag=infrastructure) - [Internals · 1](https://stevenfoerster.com/notes/#tag=internals) - [Leadership · 8](https://stevenfoerster.com/notes/#tag=leadership) - [Linux · 8](https://stevenfoerster.com/notes/#tag=linux) - [Red Teaming · 2](https://stevenfoerster.com/notes/#tag=red-teaming) - [Security · 18](https://stevenfoerster.com/notes/#tag=security) - [Windows · 2](https://stevenfoerster.com/notes/#tag=windows) Featured ## Representative posts Notes on vulnerability research, technical leadership, and AI security. Jul 17, 2026 Essay ### Copy Fail and Dirty Frag: A Shared-Fragment Invariant Copy Fail and Dirty Frag, three Linux CVEs in ten days, share one root cause: in-place crypto fast paths that write over paged fragments they do not own. - [Cryptography](https://stevenfoerster.com/notes/#tag=cryptography) - [Exploitation](https://stevenfoerster.com/notes/#tag=exploitation) [Read](https://stevenfoerster.com/notes/copy-fail-and-dirty-frag-page-ownership-invariant/) Apr 27, 2026 Essay ### Defaults are the only security control that scales Every checkbox on the paved road taxes traffic off it. The real product of a platform team is the default every team inherits by doing nothing. - [Infrastructure](https://stevenfoerster.com/notes/#tag=infrastructure) - [Leadership](https://stevenfoerster.com/notes/#tag=leadership) [Read](https://stevenfoerster.com/notes/defaults-are-the-only-security-control-that-scales/) Apr 20, 2026 Essay ### The unit economics of deception Deception is a rare defense where each detection burns attacker resources at near-zero defender cost. A week of data from my site, and why few programs use it. [Security](https://stevenfoerster.com/notes/#tag=security) [Read](https://stevenfoerster.com/notes/unit-economics-of-deception/) Apr 9, 2026 Essay ### Why prompt injection is architecturally hard to solve Prompt injection is structural in any system that mixes instructions and untrusted data in one context, not a patchable prompting bug. - [AI](https://stevenfoerster.com/notes/#tag=ai) - [Red Teaming](https://stevenfoerster.com/notes/#tag=red-teaming) [Read](https://stevenfoerster.com/notes/why-prompt-injection-is-unsolvable/) Apr 6, 2026 Deep Dive ### FHE and LLM inference: the hardest open problem in private AI Running LLMs on fully encrypted data is theoretically sound and practically brutal. Here is where the research stands and what actually works today. - [AI](https://stevenfoerster.com/notes/#tag=ai) - [Cryptography](https://stevenfoerster.com/notes/#tag=cryptography) [Read](https://stevenfoerster.com/notes/fhe-llm-inference-the-hardest-problem-in-private-ai/) Feb 2, 2026 Essay ### Leading small teams that punch above their weight What leading eight missionaries through cyclone season taught me about building small engineering teams that outperform their headcount. [Leadership](https://stevenfoerster.com/notes/#tag=leadership) [Read](https://stevenfoerster.com/notes/leading-small-teams-that-punch-above-their-weight/) Archive ## All notes Aug 19, 2026 ## Sound Obligations, Faltering Machinery: What Joseph II Teaches Us About the CMMC Pause Joseph II learned that good reforms stall when their machinery outruns their constituency. CMMC now faces the same test. Essay [Leadership](https://stevenfoerster.com/notes/#tag=leadership) [Security](https://stevenfoerster.com/notes/#tag=security) [Read the note](https://stevenfoerster.com/notes/joseph-ii-cmmc-reform/) Aug 5, 2026 ## The base-rate analyst: why SOC intuition decays without feedback Good analysts run on calibrated priors. Those priors only stay calibrated when the triage queue talks back to them. Essay [Leadership](https://stevenfoerster.com/notes/#tag=leadership) [Security](https://stevenfoerster.com/notes/#tag=security) [Read the note](https://stevenfoerster.com/notes/base-rate-analyst-feedback-loops/) Jun 13, 2026 ## Compliance is kind. Threats are wicked. That's the CMMC problem. CMMC L2 is a kind sub-environment bolted onto a wicked one. The job is bridging the two without letting kind absorb wicked. The failure mode is theater. Essay [Security](https://stevenfoerster.com/notes/#tag=security) [Read the note](https://stevenfoerster.com/notes/compliance-is-kind-threats-are-wicked/) May 18, 2026 ## The gap between red team findings and engineering fixes Red teams find vulnerabilities. Engineering teams ship features. The gap between finding and fixing is where security programs quietly fail. Essay [Leadership](https://stevenfoerster.com/notes/#tag=leadership) [Red Teaming](https://stevenfoerster.com/notes/#tag=red-teaming) [Security](https://stevenfoerster.com/notes/#tag=security) [Read the note](https://stevenfoerster.com/notes/red-team-findings-engineering-fixes/) May 11, 2026 ## Why Security Platforms Accumulate Operational Complexity The threat model is only the beginning. A security platform also has to survive telemetry growth, retention demands, index debt, and customer variance. Essay [Infrastructure](https://stevenfoerster.com/notes/#tag=infrastructure) [Leadership](https://stevenfoerster.com/notes/#tag=leadership) [Security](https://stevenfoerster.com/notes/#tag=security) [Read the note](https://stevenfoerster.com/notes/why-most-security-platforms-collapse-under-operational-complexity/) Mar 26, 2026 ## What the LiteLLM Compromise Taught Me About Butler The LiteLLM compromise is a useful threat-model test for Butler, a smaller proxy I maintain for local Ollama deployments. Essay [AI](https://stevenfoerster.com/notes/#tag=ai) [Security](https://stevenfoerster.com/notes/#tag=security) [Read the note](https://stevenfoerster.com/notes/litellm-supply-chain-attack-and-the-case-for-butler/) Mar 24, 2026 ## Why Memory Safety Is a Language Property, Not a Compiler Feature Why Rust and Go are memory safe and type safe while C is not, and why you cannot simply fix this with a better C compiler. Deep Dive [Linux](https://stevenfoerster.com/notes/#tag=linux) [Security](https://stevenfoerster.com/notes/#tag=security) [Read the note](https://stevenfoerster.com/notes/why-memory-safety-is-a-language-property/) Mar 20, 2026 ## What the xz Backdoor Says About Open Source The xz incident shows why inspectability, release provenance, and independent verification matter, not that open source is inherently safer. Essay [Linux](https://stevenfoerster.com/notes/#tag=linux) [Security](https://stevenfoerster.com/notes/#tag=security) [Read the note](https://stevenfoerster.com/notes/open-source-vulnerability-visibility/) Mar 20, 2026 ## The SolarWinds Supply Chain Attack How attackers compromised a closed-source build pipeline, shipped a backdoor to 18,000 organizations via a routine update, and hid for nine months. Teardown [Exploitation](https://stevenfoerster.com/notes/#tag=exploitation) [Security](https://stevenfoerster.com/notes/#tag=security) [Windows](https://stevenfoerster.com/notes/#tag=windows) [Read the note](https://stevenfoerster.com/notes/solarwinds-teardown/) Mar 17, 2026 ## Why Rust Is the Right Language for eBPF eBPF has meant writing C and fighting the verifier. Rust and the aya framework change that: type safety, no libbpf, one cargo build for kernel and userspace. Build Log [eBPF](https://stevenfoerster.com/notes/#tag=ebpf) [Linux](https://stevenfoerster.com/notes/#tag=linux) [Read the note](https://stevenfoerster.com/notes/rust-ebpf-linux-observability/) Feb 13, 2026 ## CVE-2014-6271: Shellshock How a 25-year-old Bash parsing bug allowed remote code execution through environment variables, and why it took multiple patches to fix. Teardown [Exploitation](https://stevenfoerster.com/notes/#tag=exploitation) [Linux](https://stevenfoerster.com/notes/#tag=linux) [Read the note](https://stevenfoerster.com/notes/shellshock-teardown/) Feb 6, 2026 ## CVE-2024-3094: How the xz Backdoor Crossed the Build Boundary A sourced teardown of the xz 5.6.0 and 5.6.1 backdoor, from release-tarball tampering to liblzma loading inside selected OpenSSH builds. Teardown [Exploitation](https://stevenfoerster.com/notes/#tag=exploitation) [Linux](https://stevenfoerster.com/notes/#tag=linux) [Security](https://stevenfoerster.com/notes/#tag=security) [Read the note](https://stevenfoerster.com/notes/xz-backdoor-teardown/) Jan 23, 2026 ## CVE-2021-44228: Log4Shell How a message interpolation feature in Log4j turned every Java app into an unauthenticated RCE target, and what the response revealed about supply chains. Teardown [Exploitation](https://stevenfoerster.com/notes/#tag=exploitation) [Security](https://stevenfoerster.com/notes/#tag=security) [Read the note](https://stevenfoerster.com/notes/log4shell-teardown/) Oct 3, 2025 ## The hidden cost of 'just one more exception' Exceptions feel harmless in the moment. Over time they become the slow leak that drains security programs. Essay [Security](https://stevenfoerster.com/notes/#tag=security) [Read the note](https://stevenfoerster.com/notes/hidden-cost-of-exceptions/) Sep 19, 2025 ## Productizing Infrastructure: what surprised me most What cutting enclave deployment from two weeks to two hours taught me about one codebase, fleet operations, and saying no to forks. Essay [Infrastructure](https://stevenfoerster.com/notes/#tag=infrastructure) [Leadership](https://stevenfoerster.com/notes/#tag=leadership) [Read the note](https://stevenfoerster.com/notes/productizing-infrastructure/) Sep 5, 2025 ## Security Architecture vs Security Operations: the gap that breaks teams Security architecture defines the promises; security operations keeps them. When those two drift, the organization pays the bill. Essay [Infrastructure](https://stevenfoerster.com/notes/#tag=infrastructure) [Leadership](https://stevenfoerster.com/notes/#tag=leadership) [Security](https://stevenfoerster.com/notes/#tag=security) [Read the note](https://stevenfoerster.com/notes/security-architecture-vs-operations/) Aug 29, 2025 ## Shellcode Under Constraints Techniques for crafting exploit payloads when buffer space is limited, bad characters are abundant, and mitigations restrict your options. Deep Dive [Exploitation](https://stevenfoerster.com/notes/#tag=exploitation) [Internals](https://stevenfoerster.com/notes/#tag=internals) [Linux](https://stevenfoerster.com/notes/#tag=linux) [Windows](https://stevenfoerster.com/notes/#tag=windows) [Read the note](https://stevenfoerster.com/notes/shellcode-under-constraints/) Aug 11, 2025 ## Private AI in Your SOC: How to Run LLMs Locally Operating LLMs locally can help analysts summarize and triage sensitive telemetry without shipping data to third-party services. Deep Dive [AI](https://stevenfoerster.com/notes/#tag=ai) [Cryptography](https://stevenfoerster.com/notes/#tag=cryptography) [Infrastructure](https://stevenfoerster.com/notes/#tag=infrastructure) [Security](https://stevenfoerster.com/notes/#tag=security) [Read the note](https://stevenfoerster.com/notes/private-ai-in-your-soc-how-to-run-llms-locally/) Mar 10, 2025 ## Multi-Tenant WireGuard: One VPN Server per Client, Orchestrated with iptables How Mistborn gave every WireGuard client its own server instance, generated firewall rules per device, and kept Docker from punching holes in the host. Deep Dive [Infrastructure](https://stevenfoerster.com/notes/#tag=infrastructure) [Linux](https://stevenfoerster.com/notes/#tag=linux) [Read the note](https://stevenfoerster.com/notes/wireguard-multi-tenancy-with-iptables/) 2024 ## Automation Is How Zero Trust Survives Contact with Operations Zero Trust needs sound identity, policy, and enforcement. Automation keeps those controls current as systems and people change. Essay [Infrastructure](https://stevenfoerster.com/notes/#tag=infrastructure) [Security](https://stevenfoerster.com/notes/#tag=security) [Read the note](https://stevenfoerster.com/notes/zero-trust-without-automation/) No notes match the selected topic.