Security
A penetration test report landed with a finding rated critical. The tester had taken a valid token from their own low privilege account, changed the payload, set the header algorithm to none, stripped the signature, and been granted access to another tenant's data. We had read the advisories.
Bug Hunt
The ticket said search was broken. The user searched for a product they had bought before and got results for industrial fasteners. They do not sell industrial fasteners. Two hours later there were eleven tickets. Then a merchant called. The common thread was that every affected user was logged in,
Security
Tokens rejected as expired seconds after issue, or accepted long after they should have died. Both are the same bug seen from opposite ends.
MicroVMs
The question is not whether an autonomous agent will do something destructive. It is what the destruction can reach when it does.
MicroVMs
curl works on the box and hangs from outside. Four places the packet can die, and how to tell which one killed it without guessing.
Networking
handshake failure, protocol version, unknown ca and bad certificate all mean different things. Here is how to get the real reason out of a connection that dies in the first two packets.
MicroVMs
A patched kernel that kept reporting the old version after every reboot. The reboot was working perfectly. My assumption about where the kernel comes from was wrong.
Deep Dive
Traditional VMs take thirty seconds. Firecracker takes 125 milliseconds. The difference is everything it refuses to do.
AI
Every mitigation at the model layer can be worked around. The fix is architectural: assume the model will be compromised and limit what it can do.
DevOps
A build system with production credentials and the ability to run arbitrary code from a pull request is the most under-secured part of most stacks.
AI
Models invent plausible package names. Attackers register them. Here is why this attack works and the two checks that stop it.
AI
If an agent can run shell commands, you have an arbitrary code execution problem. Here is what each isolation option genuinely protects against.