Skip to content
ProjectsSecurityOSSAIInfrastructureWritingContact

Writing

Notes from building & climbing

Two streams, one notebook: technical deep-dives on what I'm shipping, and the occasional rambling from the trail.

All posts

Technical · 8 min

Attacking the Lies About Disk Layout

A flag hidden in the RAM disk with no name, a crafted directory entry that reads it right out, and the one-field fix that turns 'in the image' into 'in the data.' A bounds check is only as trustworthy as the bound it compares against.

Read
Technical · 10 min

The confused deputy

I planted a flag on a kernel-only page and wrote a ring-3 program to steal it. The CPU stopped the direct read cold — then my own syscall handed the flag over the moment it dereferenced a caller-chosen pointer. The one door the hardware cannot guard for you.

Read
Technical · 9 min

The first wall

Ring 3, a syscall gate, and the two bits that turn 'the kernel is the only program' into 'the kernel runs code it doesn't trust.' The first time in this project that the hardware, not my kernel's goodwill, holds code back.

Read
Technical · 10 min

The whole point, arrived at

Subdirectories, cd/pwd/ls/cat, and the moment the core arc — boot, memory, tasks, shell, files — is complete. Along the way I learned the hard way that a termination proof is not a safety proof: my validator provably terminated and still hid two denial-of-service bugs.

Read
Technical · 9 min

Files are just convincing lies about disk layout

I built a read-only filesystem for my from-scratch kernel, and the lesson is what a 'file' actually is: a directory table of {name, offset, length} over a flat run of bytes. The hard, security-relevant code isn't the reading — it's the refusing.

Read
Technical · 9 min

It has a prompt now

My from-scratch kernel runs its first interactive program: a shell, spawned as an ordinary task on the scheduler. The keyboard interrupt shrinks to 'enqueue one byte and return' — and the 'interactive code can't be tested' excuse falls apart.

Read
Technical · 9 min

Multiple things at once, sort of

I gave my from-scratch kernel a timer and its first scheduler. Two tasks take turns on one CPU — first politely, then by force — and the preemption step turned out to be a concurrency trap wearing a simple mechanism's face.

Read
Technical · 7 min

Room to grow

Milestone 8 of my AI-assisted OS build: the heap allocator. The kernel gains dynamic memory — Vec, Box, and String start working with no operating system underneath.

Read
Technical · 7 min

The illusion of memory

Milestone 7 of my AI-assisted OS build: paging and virtual memory. The kernel stops using the map the bootloader handed it and starts drawing its own — and survives the CR3 switch on the first try.

Read
Technical · 6 min

It knows what it has now

Milestone 6 of my AI-assisted OS build: physical memory management. The kernel finally learns how much RAM the machine has, and hands it out one 4 KiB frame at a time.

Read
Technical · 5 min

It Listens Now

Milestone 5 of my from-scratch Rust kernel: PS/2 keyboard input — the first time the machine reacts to the outside world instead of just talking at it. Remapping the PIC, enabling interrupts for the very first time, and learning why forgetting one EOI makes the keyboard die after exactly one keypress.

Read
Technical · 4 min

Teaching It to Fail Gracefully

Milestone 4 of my from-scratch Rust kernel: the IDT and exception handling — where the machine stops silently rebooting on a mistake and starts telling me what went wrong. The whole thing lives or dies on assembly and Rust agreeing about the shape of the stack.

Read
Technical · 4 min

Setting Up to Build Nothing

I'm building an x86-64 operating system from scratch in Rust, and this is milestone zero: a toolchain and an empty kernel that compiles for a machine that isn't my machine. No boot, no output — just the unglamorous groundwork where most OS projects quietly die.

Read
Technical · 13 min

When the Machine Always Agrees: AI, Sycophancy, and Your Head

We learned the hard way what an engagement-optimized feed does to a mind. A model trained to agree with you is a different version of the same problem — and for some people it has already turned dangerous. How to use AI without letting it become a yes-man for your worst spirals.

Read
Technical · 14 min

Steelmanning the Skeptics: The Strongest Case Against the Thing I Love

I'm optimistic about AI and use it every day — which is exactly why I wanted to write the best possible case against it. Not strawmen: the arguments that actually keep me up, argued as well as I can argue them.

Read
Note Technical

Does AI Make You Dumber? What the Research Actually Says (and My Jury-Duty Counterexample)

The scary 'cognitive debt' study is real but softer than the coverage — here's the honest read, plus a personal counterexample from jury duty.

Read
Technical · 9 min

Ten Rounds of Breaking My Own App: The Tools, and the Lessons

The bespoke tooling that made a ten-round self-pentest possible, the attacks that failed, the full round-by-round scoreboard, and the lessons that outlive the app. Part 4 of a four-part series.

Read
Technical · 11 min

How I Actually Use AI: The Real Workflow Behind These Posts

Not the hype version — the actual tools, habits, and guardrails I use to build, write, and think with AI every day, and the specific ways I keep it sharpening my judgment instead of replacing it.

Read
Note Ramblings

The Off Switch Isn't Yours: What the Fable/Mythos Shutdown Taught Me About AI Dependence

A model people relied on got switched off overnight by an order none of its users had a say in — and why that's a reason to hedge, not to stay away.

Read
Note Technical

A Slop Filter for Your Own Voice: The Anti-AI-Cliché Linter I Run on Every Auto-Post

AI-written text has tells, so I keep a blocklist of the worst clichés and reject any auto-post that contains one before it can leave in my name.

Read
Note Technical

The USB Flash That Died Every Two Seconds (and the Power-Button Trap)

A bootloader flash that failed at a suspiciously consistent interval, the misdiagnosis that chased the cable, and the power-management timer that was actually killing it.

Read
Note Technical

One CVE, Two Ecosystems: a Kopia RCE Check for Metasploit and Nuclei

CVE-2026-45695 is an argument-injection RCE in Kopia's SFTP ProxyCommand handling. I shipped a detection for it twice — a Metasploit exploit and a Nuclei template — and the two idioms disagree in instructive ways.

Read
Technical · 11 min

The Flagship Encryption Feature That Never Actually Turned On

The eighth round of a self-pentest found MoodHaven's flagship 'encrypted at rest' feature had never engaged on any build — then a custom attack tool and a fix-the-fixes round closed the campaign. Part 3 of a four-part series.

Read
Technical · 8 min

The Speakers Were Fine. The Amplifier Was Asleep.

My laptop's internal speakers were silent on Linux but worked on Windows. Every software layer said audio was playing — I even recorded an 80%-amplitude signal off the sink. The speakers weren't broken: the Cirrus Logic CS35L41 smart amplifiers never engaged, and the kernel 6.8 driver couldn't wake them on an HP Envy x360. Here's the full diagnostic path and the one-line fix.

Read
Technical · 7 min

My First Metasploit Module to Land: an Audiobookshelf Auth Bypass

CVE-2025-25205 is an unauthenticated auth bypass in Audiobookshelf caused by matching a whitelist regex against the full request URL — query string and all. Here's the bug, the crash-safe detection module I wrote for it, and what it took to get my first PR merged into the Metasploit Framework.

Read
Technical · 10 min

Attacking the AI Stack: Teaching garak to Smuggle Exploits Through a Model

The LiteLLM scanner attacked the gateway. These two garak probes attack the layer above it — getting the model itself to hand you a shell command or a Mongo operator, on the bet that something downstream will run it. Here's how the probes work, and why the detectors are the hard part.

Read
Technical · 10 min

The Machine That Posts for Me: How This Blog Publishes and Promotes Itself

I don't like posting to social media, so I built a pipeline that publishes my blog and promotes it across LinkedIn, Bluesky, and X — on a schedule, in my voice, with a linter that won't let it sound like a robot. Here's the whole system, including the two automated feeds I had to stop from colliding.

Read
Technical · 9 min

I Pentested My Own Ask Bot

I put the 'Ask Me' bot on this site through a real security pass — prompt injection, jailbreaks, input fuzzing, and an automated LLM scanner from a Kali box. Here's what held, what surprised me, and the one latent bug I found.

Read
Technical · 10 min

Writing a Metasploit Module for a Pre-Auth SQLi in an LLM Gateway

How I turned CVE-2026-42208 — a time-based blind SQL injection in LiteLLM's proxy — into a benign, lab-verified Metasploit detection module, and what the Rapid7 review cycle taught me about shipping upstream.

Read
Technical · 9 min

A Header You Were Never Supposed to Send: Detecting the Next.js Middleware Bypass

CVE-2025-29927 lets an external request skip Next.js middleware entirely — and with it every auth check built there — by sending one header the framework only ever meant to talk to itself. Here's the bug, and the Metasploit scanner I wrote to detect it without touching the data behind the gate.

Read
Technical · 11 min

The Bugs I Found Attacking My Own Journaling App — and the Bugs My Fixes Created

The confirmed vulnerabilities from a ten-round self-pentest of MoodHaven Journal: a readable database, silently lost edits, keys leaking over the LAN — and the critical bugs my own fixes introduced. Part 2 of a four-part series.

Read
Technical · 8 min

How the "Ask Me" Bot on This Site Actually Works

A small RAG-style assistant that answers questions about me, built with no vector database, no framework, and a model bill measured in cents — here's the whole architecture, and the guardrails that keep a public endpoint from spending my money.

Read
Technical · 16 min

Optimistic, Eyes Open: What AI Actually Does to Us, and How to Use It Well

Does AI make us dumber, or sharper? The honest, fact-checked version — what the research really says about AI and your brain, its real environmental cost, the quiet ways it flatters you, and how to use it well.

Read
Technical · 8 min

MoonLander Enhanced: Teaching an AI to Land on the Moon (and Other Things I Didn't Plan to Build)

A browser remake of the 1979 Atari Lunar Lander that turned into real orbital physics, historic Apollo missions, and an AI Theater where you watch a neural net learn to land in real time. Built with AI, for fun.

Read
Technical · 6 min

The Generalist's Edge: Doing IT Work in the Age of AI

I'm a generalist, not a specialist — and for the first time that feels like an advantage instead of an apology. How AI changed what one IT person can actually do in a day.

Read
Technical · 9 min

A Lazy Sunday: Rebuilding My Site with AI and Leaving Wix Behind

How I went from a templated Wix site to an owned, fast, markdown-native stack — thought to design to a live cutover — in about a day, with AI as the pair programmer and me making the calls.

Read
Technical · 8 min

How I Tried to Break My Own Encrypted Journaling App — Ten Times

Why I ran a ten-round penetration test against my own privacy-first journaling app — the attack lab, the AI-orchestrated workflow, and the rules of engagement. Part 1 of a four-part series.

Read
Technical · 13 min

So We Rooted the Phone and Went Deeper

The unrooted phone told us our encryption held. Root let us check whether we were telling ourselves the truth. We weren't, entirely — and that was the point.

Read
Technical · 10 min

I Tried to Break Into My Own Journaling App on an Unrooted Pixel 9

A weekend attacking my own encrypted journaling app. The only foothold I got was my own debug build, my standard MITM playbook failed completely, and figuring out why taught me the most.

Read
Technical · 9 min

Changing a Password Is a One-Liner — Unless You Encrypt Everything

Crash-safe master-password rotation in a zero-knowledge journaling app: re-encrypting across two layers and two runtimes with a single atomic flip a kill -9 can't corrupt.

Read
Technical · 18 min

Seven Months of Vibe Coding: How I Built a Privacy-First Journal App with an AI Pair Programmer

Building MoodHaven Journal from scratch as a non-developer — zero-knowledge encryption, a Wear OS companion, peer sync, and what it actually takes to learn while you ship.

Read
Ramblings · 6 min

Borah's Crucible: A Feather, a Rock, and the Mountain's Fire

A predawn dream of falling, a feather caught on Chicken-Out Ridge, and what Mount Borah burned away over 13 hours and 5,062 feet.

Read
Ramblings · 9 min

The Things that Borah Peak Spoke to Me

An account of an early-morning, first-major-mountain ascent of Idaho's Borah Peak, and the people, fears, and lessons the mountain revealed along the way.

Read
Ramblings · 6 min

From Humble Beginnings Come Great Things (A Borah Love Story)

It all starts with a Big Hairy Dream and ends with a thriving sense of accomplishment and pride in oneself. A hiking love story about chasing Idaho's tallest peak.

Read
Technical · 4 min

How To: Integrate Unifi AP Metrics into Zabbix (and Graph It in Grafana)

Integrate Unifi Access Point metrics into a Zabbix server and graph the data with Grafana, using the Unifi Proxy project on Ubuntu Linux 18.04.

Read
Technical · 3 min

Home Lab Fun: Virtualize a Domain — Part II: Router Configuration

Detailed instructions on installing and configuring pfSense as a router, optionally exposing its WebGUI on the WAN, and creating an IPSec tunnel between two offices on separate networks.

Read