Articles

Supply-chain security, self-hosting, and notes from inside trust and safety.

7 total

  • Writes to a Dead Socket Succeed

    A firewall rule, a container detach or an expired NAT entry severs a TCP connection without closing it. Writes keep returning success into nothing, and the only thing that notices is a read deadline you set yourself.

  • A Hero's Journey

    Laid off from Uber when the company went all-in on AI, and hired by GitHub thirty days later. What it took, and what I had already built without knowing why.

  • The Docker Socket Is Root

    Mounting the Docker socket into a container hands that container the host. The read-only flag most compose files use does not change this, and the reason is a detail about what :ro actually applies to.

  • Cooldowns and Lifecycle Scripts

    The defences that actually change the outcome of an npm supply-chain attack are unglamorous: do not run install scripts, do not install code published this morning, and do not let a stolen token publish anything.

  • The Worm That Publishes Itself

    Shai-Hulud steals a maintainer's npm token, uses it to republish every package that maintainer owns, and repeats. No operator, no command server, no human in the loop after the first compromise.

  • Quorum Is a Voting Problem

    A two-node Proxmox cluster is not a smaller three-node cluster. It is a cluster that stops working the moment either node reboots, and the reason is arithmetic rather than configuration.

  • One Maintainer, Two Billion Installs

    In September 2025 a phishing email to a single npm maintainer put malicious code into eighteen packages downloaded 2.6 billion times a week. The interesting part is not the phish. It is how ordinary it was.