Blog
All posts · security, infrastructure, open web
cua: Computer-Use Automation at Scale
An open-source framework for cross-OS computer-use agents with built-in benchmarks and fleet infrastructure — protocol-first, evaluation-native, fleet-aware.
The Myth of Universal VPN Security
Common belief that any VPN provides equal protection ignores implementation differences, transparency, and real-world effectiveness. Reality shows VPNs hide IP …
Sandboxing Autonomous AI Coding Agents: Ephemeral Containers and Egress Boundary Enforcement
Infrastructure security engineer Alex Chen discusses container sandboxing, system call filtering with seccomp and Landlock, and network egress boundaries for au…
Cache Invalidation via Surrogate Keys: Edge Architecture and Purge Mechanics
Decouple cache invalidation from URL paths using Surrogate-Key headers for targeted CDN purging.
Autonomous Vulnerability Discovery: Replacing Static SAST with Adversarial Verifiers
Static code scanners drown engineering teams in unverified alerts. Autonomous security harnesses now combine deterministic coverage ledgers with adversarial ver…
Oryxis vs SSHPilot: Architectural Trade-offs in Modern Remote Shell Clients
A technical evaluation of Oryxis and SSHPilot, comparing local ChaCha20-Poly1305 encrypted vaults, GTK4 versus Rust runtime footprints, and peer-to-peer fleet s…
Why Agent-Driven Code Review Needs Real-Time Observability Hooks
Agent code review tools ship blind without observability into LLM decisions. Learn five steps to instrument your agent pipeline, track filtering decisions, and …
witr: Tracing Process Start Chains
ps and lsof show what is running, not why. witr walks the ancestry: PID to supervisor to the script that started it, in one chain.
bgscan vs WebCheck-OSINT: Two Ways to Run an Engagement Recon Pass
bgscan sweeps networks from a BubbleTea TUI, chaining ICMP, TCP, HTTP, DNS, and tunnel probes into one run. WebCheck-OSINT dissects a single site from a self-ho…
Why MoE Models Stream From NVMe: Kernel Prefetch, Read-Ahead, and Async I/O
Frontier MoE models run on consumer hardware by streaming expert weights from disk. Not compression—kernel I/O prefetching overlapped with GPU compute. Here's h…
SSH Certificates vs. Key Files: Why Production Ops Teams Are Finally Moving
Key files don't scale. SSH certificates solve revocation, audit trails, and onboarding at production scale—here's why adoption is accelerating.
BGP Flowspec False Positives: When DDoS Filters Block Legitimate Traffic
Flowspec rules are coarse-grained. They catch attack traffic and legitimate traffic alike. How to monitor, whitelist, and protect your critical services from co…