Blog
All posts · security, infrastructure, open web
The SSRF Problem Nobody Talks About in AI Pipelines
Everyone hardens the model. Almost nobody hardens what the model fetches. A walkthrough of SSRF and SSRF-adjacent risks in AI ingestion pipelines, with practica…
WebCheck: Self-Host Your Website OSINT Instead of Renting It
Website OSINT in one URL: DNS, TLS, headers, WHOIS, tech fingerprint, all passive. Run the WebCheck fork on your own box so targets never leave your network.
Why Is This Process Running? The Evolution of Process Provenance Tooling
How answering why a process is running moved from /proc archaeology to eBPF streams to witr, the open-source tool that makes provenance a single command.
How to Build a Censorship-Resistant Tunnel with Aether and MASQUE
A step-by-step guide to compiling and configuring Aether, a Rust userspace implementation of Cloudflare WARP using MASQUE over HTTP/3.
Paying for AI Without Revealing Who You Are: Zero-Knowledge Inference Tokens Explained
Zero-knowledge proofs decouple payment identity from LLM inference requests. Here is how the cryptographic architecture works and what security risks exist at t…
VPS Security Baseline: 10-Point Checklist Before You Go Live
A practical pre-flight checklist for hardening a fresh Ubuntu 24.04 VPS before exposing any service to the internet.
The Best Code Is the Code You Never Wrote
Minimalism is a decision procedure, not a style. Why the lazy senior dev ships the smallest working diff, reuses the stdlib, and treats deletion as a feature.
Tracing Pirated Streams Using Forensic Watermarking
Broadcasters hide a per-subscriber code in live video, then recover it from pirate relays. A walk through the embed, detect, match, and enforce pipeline.
Fullstack Rust Beyond Electron: An Architectural Case Study of Dioxus
Shipping a 150MB Chromium shell for a basic desktop utility is an outdated architectural pattern. Here is how Dioxus uses Rust signals, system webviews, and Axu…
Sandboxing Agent Runtimes with NVIDIA OpenShell
A practical guide to securing AI agent runtimes using NVIDIA OpenShell, defining capability manifests, and enforcing syscall boundaries in CI.
Proving zkVM Circuit Soundness: Lessons from zkWasm and Coq
A USENIX study showed 90% of zero-knowledge circuit vulnerabilities break soundness. Here is how formal verification in Coq caught a flawed call frame design th…
Hardware Security Modules Don’t Make Signing Interfaces Safe
Keeping a private key inside an HSM is not enough. UC San Diego and INRIA researchers forged RSA signatures without extracting the key — by treating the device …