Articles
Supply-chain security, self-hosting, and notes from inside trust and safety.
7 total
Writes to a Dead Socket Succeed
A firewall rule, a container detach or an expired NAT entry severs a TCP connection without closing it. Writes keep returning success into nothing, and the only thing that notices is a read deadline you set yourself.
A Hero's Journey
Laid off from Uber when the company went all-in on AI, and hired by GitHub thirty days later. What it took, and what I had already built without knowing why.
The Docker Socket Is Root
Mounting the Docker socket into a container hands that container the host. The read-only flag most compose files use does not change this, and the reason is a detail about what :ro actually applies to.
Cooldowns and Lifecycle Scripts
The defences that actually change the outcome of an npm supply-chain attack are unglamorous: do not run install scripts, do not install code published this morning, and do not let a stolen token publish anything.
The Worm That Publishes Itself
Shai-Hulud steals a maintainer's npm token, uses it to republish every package that maintainer owns, and repeats. No operator, no command server, no human in the loop after the first compromise.
Quorum Is a Voting Problem
A two-node Proxmox cluster is not a smaller three-node cluster. It is a cluster that stops working the moment either node reboots, and the reason is arithmetic rather than configuration.
One Maintainer, Two Billion Installs
In September 2025 a phishing email to a single npm maintainer put malicious code into eighteen packages downloaded 2.6 billion times a week. The interesting part is not the phish. It is how ordinary it was.