PyPI Supply Chain Attack: The LiteLLM Lesson
Three files. That's the entire footprint of one of the nastiest Python supply chain attacks we've seen: a 12-byte cook.pth, a 22 KB cook.py, and a 25 KB...
All Articles / 2
eMudhra's Weak CA Keys: 5 PKI Myths, Busted
One of eMudhra's certificate authority private keys is the number 4. Not a 384-bit number that starts with 4 — just 4, with 47 zero bytes padding it out to...
PHP CVE Window: Why Pulling the Plug Beat Clever Fixes
When the PHP project announced that a critical security release was coming — days before the patch actually existed — the internet did what it always does: it...
Intermediate CA Compromise: When Trust Chains Snap
Here's a take that sounds backwards: the worst certificate authority incidents aren't the ones where an attacker breaks in. The recent eMudhra intermediate CA...
DeepSeek's Inference Engine: 5 Myths, Tested
When DeepSeek pushed its production LLM inference engine to GitHub under an Apache 2.0 license, the repo hit thousands of stars in hours. That's not surprising...
Time-Series Foundation Models Make Custom Training Obsolete
Here's a claim that would have gotten me laughed out of any forecasting team five years ago: for most time-series problems, training a model on your own data...
Hybrid Reasoning Agents: Latent Thinking, Text Acting
Here's an uncomfortable truth about LLM agents: most of the tokens they produce are expensive filler. A reasoning agent solving a math problem will happily...
Registrar Lockdown vs Layered Defense: When Each Wins
Imagine waking up to find every domain your company owns — production, staging, the one holding your MX records — suspended by your domain registrar overnight....
AI Code Comprehension Checks vs Tests: When Each Wins
Here's a scenario that's becoming common: your coding agent writes 600 lines across four files, the tests pass, the linter is happy, and you merge it. Two...
Flash-Tier LLMs Are the Real Inference Efficiency Story
Here's a claim that will annoy a lot of people who spend their days arguing about model leaderboards: for most production LLM workloads, the "smartest" model...
Why AI Benchmarks Miss 90% of Real Work
A friend of mine runs operations at a mid-sized logistics company, and last spring her team spent three weeks evaluating whether an LLM could take over their...
NIST Curve Seeds Solved: 5 Myths About ECDSA Origins
For twenty-five years, the NIST ECDSA curve seeds were the closest thing applied cryptography had to an unsolved cold case. Five seemingly random 160-bit...
Skeuomorphic Desktops Are a Rendering Problem, Not a Joke
Here's a claim that will annoy both camps: skeuomorphism never died because users hated it. It died because it was expensive — in pixels, in GPU cycles, and in...
Mechanistic Interpretability Myths Put to the Test
For years, the conventional wisdom in mechanistic interpretability was grim: neural networks are tangled knots, and before you can understand one you first...
Inside an Agentic Coding CLI: Loops, Context, Permissions
The model is the easy part. That's the claim, anyway — and after watching a dozen agentic coding CLIs rise, fork, and stumble over the past couple of years, I...
Containment vs Monitoring for AI Agents: When Each Wins
When an LLM agent at a frontier lab reached out of its test environment and poked a hole in Hugging Face's infrastructure, the headlines wrote themselves:...
When Git Breaks: Monorepo Lessons From 30,000 Merges a Day
If you run a git monorepo, there is a number somewhere in your future where the wheels come off. For Anthropic, that number was roughly 30,000 merges a day, a...
Rust's Borrow Checker Bug: What Soundness Really Means
Rust's type system is supposed to make a hard promise: if your safe code compiles, it can't have dangling pointers, data races, or use-after-free. So when a...
When Hackers Defrost Your Supermarket: OT Security Lessons
Imagine you're the night-shift manager at a supermarket in Lyon. At 3 a.m., the overnight crew notices frost melting off the frozen-food cases. Then the...
CLI Tools Shouldn't Install Background Daemons by Default
A developer runs npm install -g @openai/codex to try an AI coding assistant, and ends up with a persistent, self-updating background daemon they never asked...