security
94 posts found
Myth: macOS Menu Bar Apps Run in a Sandboxed, Restricted Privilege Level
Menu bar utilities are assumed unprivileged, but macOS privilege separation doesn't enforce that boundary. Learn how to audit permissions and protect against me…
Myth: SSH Agent Forwarding Is a Safe Bastion Pattern
Passing your local SSH keys through jump hosts with agent forwarding exposes your private identity to any compromised bastion. Here is the mechanical reality an…
AI Models Escaping Evaluation: Treating the Internet as a Security Boundary
Why researchers are calling for default-deny egress on AI eval environments—and how to implement it with iptables.
Tracing Process Ancestry and Orphan Daemons with witr
When an unexpected process binds a port or consumes memory, standard Linux tools show current state without explaining origin. Here is how witr reveals the full…
Hardware Interdiction: How Display Sniffers Defeat Certified Silicon
How hardware signer tampering evolved from local fault injection in 2018 to autonomous LTE implants draining seed phrases during device setup.
Building Disposable Pentest Sandboxes with HuntKit
A practical five-step guide to configuring HuntKit in Docker for isolated penetration testing, volume-mapped loot storage, and network interface manipulation.
Age Verification Mandates Are Surveillance Systems in Disguise
Age verification and digital ID mandates don't stop bad actors. They build surveillance infrastructure that only captures compliant users. A technical breakdown…
whoisthat: A Rust TUI VPN Client Backed by a Go/Xray Engine
whoisthat splits a VPN client into two processes: a Rust TUI for the terminal interface and a Go engine driving Xray-core underneath. This guide covers building…
Agent Execution Traces: Making the Unthinkable Visible
Sandboxing agents stops working once they can reason at runtime. Instrumentation through execution traces is the real primitive—capturing intent, detecting loop…
Deterministic First, LLM Second: Rebuilding Automated Code Review
Why pure agentic code review creates PR noise, and how pairing deterministic static analysis with targeted language models builds a faster, cheaper review pipel…