Jul 17, 2026 Essay
Copy Fail and Dirty Frag: A Shared-Fragment Invariant
Copy Fail and Dirty Frag, three Linux CVEs in ten days, share one root cause: in-place crypto fast paths that write over paged fragments they do not own.
Notes
Essays from the seams between security, systems, and operations.
I use this section to work through the engineering constraints, failed assumptions, and operating tradeoffs that short answers tend to hide.
Featured
Representative posts
Notes on vulnerability research, technical leadership, and AI security.
Apr 27, 2026 Essay
Defaults are the only security control that scales
Every checkbox on the paved road taxes traffic off it. The real product of a platform team is the default every team inherits by doing nothing.
Apr 20, 2026 Essay
The unit economics of deception
Deception is a rare defense where each detection burns attacker resources at near-zero defender cost. A week of data from my site, and why few programs use it.
Apr 9, 2026 Essay
Why prompt injection is architecturally hard to solve
Prompt injection is structural in any system that mixes instructions and untrusted data in one context, not a patchable prompting bug.
Apr 6, 2026 Deep Dive
FHE and LLM inference: the hardest open problem in private AI
Running LLMs on fully encrypted data is theoretically sound and practically brutal. Here is where the research stands and what actually works today.
Feb 2, 2026 Essay
Leading small teams that punch above their weight
What leading eight missionaries through cyclone season taught me about building small engineering teams that outperform their headcount.
Archive
All notes
Aug 19, 2026
Sound Obligations, Faltering Machinery: What Joseph II Teaches Us About the CMMC Pause
Joseph II learned that good reforms stall when their machinery outruns their constituency. CMMC now faces the same test.
Read the noteAug 5, 2026
The base-rate analyst: why SOC intuition decays without feedback
Good analysts run on calibrated priors. Those priors only stay calibrated when the triage queue talks back to them.
Read the noteJun 13, 2026
Compliance is kind. Threats are wicked. That's the CMMC problem.
CMMC L2 is a kind sub-environment bolted onto a wicked one. The job is bridging the two without letting kind absorb wicked. The failure mode is theater.
Essay Security
Read the note
May 18, 2026
The gap between red team findings and engineering fixes
Red teams find vulnerabilities. Engineering teams ship features. The gap between finding and fixing is where security programs quietly fail.
Read the noteMay 11, 2026
Why Security Platforms Accumulate Operational Complexity
The threat model is only the beginning. A security platform also has to survive telemetry growth, retention demands, index debt, and customer variance.
Read the noteMar 26, 2026
What the LiteLLM Compromise Taught Me About Butler
The LiteLLM compromise is a useful threat-model test for Butler, a smaller proxy I maintain for local Ollama deployments.
Read the noteMar 24, 2026
Why Memory Safety Is a Language Property, Not a Compiler Feature
Why Rust and Go are memory safe and type safe while C is not, and why you cannot simply fix this with a better C compiler.
Read the noteMar 20, 2026
What the xz Backdoor Says About Open Source
The xz incident shows why inspectability, release provenance, and independent verification matter, not that open source is inherently safer.
Read the noteMar 20, 2026
The SolarWinds Supply Chain Attack
How attackers compromised a closed-source build pipeline, shipped a backdoor to 18,000 organizations via a routine update, and hid for nine months.
Read the noteMar 17, 2026
Why Rust Is the Right Language for eBPF
eBPF has meant writing C and fighting the verifier. Rust and the aya framework change that: type safety, no libbpf, one cargo build for kernel and userspace.
Read the noteFeb 13, 2026
CVE-2014-6271: Shellshock
How a 25-year-old Bash parsing bug allowed remote code execution through environment variables, and why it took multiple patches to fix.
Read the noteFeb 6, 2026
CVE-2024-3094: How the xz Backdoor Crossed the Build Boundary
A sourced teardown of the xz 5.6.0 and 5.6.1 backdoor, from release-tarball tampering to liblzma loading inside selected OpenSSH builds.
Read the noteJan 23, 2026
CVE-2021-44228: Log4Shell
How a message interpolation feature in Log4j turned every Java app into an unauthenticated RCE target, and what the response revealed about supply chains.
Read the noteOct 3, 2025
The hidden cost of 'just one more exception'
Exceptions feel harmless in the moment. Over time they become the slow leak that drains security programs.
Essay Security
Read the note
Sep 19, 2025
Productizing Infrastructure: what surprised me most
What cutting enclave deployment from two weeks to two hours taught me about one codebase, fleet operations, and saying no to forks.
Read the noteSep 5, 2025
Security Architecture vs Security Operations: the gap that breaks teams
Security architecture defines the promises; security operations keeps them. When those two drift, the organization pays the bill.
Read the noteAug 29, 2025
Shellcode Under Constraints
Techniques for crafting exploit payloads when buffer space is limited, bad characters are abundant, and mitigations restrict your options.
Read the noteAug 11, 2025
Private AI in Your SOC: How to Run LLMs Locally
Operating LLMs locally can help analysts summarize and triage sensitive telemetry without shipping data to third-party services.
Read the noteMar 10, 2025
Multi-Tenant WireGuard: One VPN Server per Client, Orchestrated with iptables
How Mistborn gave every WireGuard client its own server instance, generated firewall rules per device, and kept Docker from punching holes in the host.
Read the note2024
Automation Is How Zero Trust Survives Contact with Operations
Zero Trust needs sound identity, policy, and enforcement. Automation keeps those controls current as systems and people change.
Read the note
No notes match the selected topic.