grep -l "#security" posts/*
#security
63 posts · all posts
- Sandboxing agents
- Our model provider had a security incident
- The backdoor in the job offer
- Hardware attestation and who controls your device
- The prompt injection in a support ticket
- What a source map can leak
- Axios on npm was compromised, and our lockfile held
- The agent that wiped our staging database
- Agents talking to agents
- How Tailscale works
- Should my agents get their own computer?
- Two of our most-used npm packages got owned
- If the CVE program goes away
- The wrong person in the channel
- How you get tracked
- Computer use and the first real agents
- The expired domain in our build
- SQL injection is still here
- Twenty-seven laptops in a boot loop
- How SSH authentication works
- Auditing our build images after the xz backdoor
- The phone on our leadership team
- Zenbleed: a CPU bug explained
- Writing our AI usage policy
- Chatbots with a persona problem
- Rotating the secrets in our password vault
- Offboarding 30 people in an afternoon
- Power side channels and Hertzbleed
- A contractor's laptop and our identity provider
- Log4Shell: the weekend we grepped every JAR
- Perceptual hashing, and how NeuralHash collided
- Our ransomware tabletop
- A kernel ban and trust in open source
- Merkle trees, from git to Certificate Transparency
- Auditing every agent with admin rights
- Social engineering at the help desk
- Book review: Building Secure and Reliable Systems
- Uninvited guests at our all-hands
- Password hashing, from crypt to bcrypt to Argon2
- The SSRF that reached our metadata service
- Ghidra, a reverse engineer's first impressions
- GPT-2 and "too dangerous to release"
- The malicious dependency in our build
- How DNS resolution works, step by step
- Patching for Spectre and losing 30% on the database tier
- Meltdown and Spectre, visually
- KRACK: breaking the WPA2 four-way handshake
- The framework patch we hadn't applied
- WannaCry Friday
- How a SHA-1 collision is made
- Rolling out 2FA everywhere in a week
- Apple vs the FBI: why I'm with Apple
- The TLS handshake, visually
- The ex-employee who still had VPN access
- The root certificate on our sales laptops
- The Shellshock weekend
- Rotating every certificate we own in 72 hours
- Heartbleed, drawn out
- How Bitcoin works, block by block
- A holiday-weekend card data scare
- Public key crypto, and what "NSA foils encryption" might mean
- PRISM and the systems we build
- Our host got breached, so we rotated everything