Archives

Weekly activity summary across 25 curated bulletproof hosting ASNs, covering global scanning behavior and infrastructure changes.

CVSS cannot triage 106 Juniper CVEs against your own network. A decision model answers factual questions per CVE; your code owns the patch/don't-patch thresholds.

Weekly activity summary across 25 curated bulletproof hosting ASNs, covering global scanning behavior and infrastructure changes.

TypeSafe's Jev model classified 28,000 Caddy log lines for $1.80, surfacing 70 attack probes my SQL rules filed as ordinary traffic.

DuckDB v2.0 ships an agent mode that detects a coding agent and reshapes its output: compact markdown, loud truncation footers with a result hash, JSON errors, and cost estimates. I measured it on 17,834 lines of Caddy logs from this site.

DuckDB v2.0 ships an agent mode that detects a coding agent and reshapes its output: compact markdown, loud truncation footers with a result hash, JSON errors, and cost estimates. I measured it on 17,834 lines of Caddy logs from this site.

Weekly activity summary across 25 curated bulletproof hosting ASNs, covering global scanning behavior and infrastructure changes.

Weekly activity summary across 25 curated bulletproof hosting ASNs, covering global scanning behavior and infrastructure changes.

An unknown bot in my logs led me to Iron Fountain, an agent-ready static host with a built-in MCP connector, per-site OAuth scopes, and revision-based rollback.

Weekly activity summary across 25 curated bulletproof hosting ASNs, covering global scanning behavior and infrastructure changes.

TypeSafe's Jev returns typed, calibrated decisions instead of prose — and that makes alert triage, phishing detection, and deception-fleet work automatable.

PQProbe v3.7.5 Enterprise Edition measured 100 cybersecurity vendors. 67 apexes negotiate post-quantum key exchange, but 79.8% of that lives behind third-party edges while only 23.5% lives on first-party infrastructure. A census of the Cyber 100.

Weekly activity summary across 25 curated bulletproof hosting ASNs, covering global scanning behavior and infrastructure changes.

67 of 100 cybersecurity vendors support post-quantum key exchange, but 75% leave DNS unsigned and not one publishes a TLSA record. A census of the Cyber 100 across TLS and DNS posture.

Weekly activity summary across 25 curated bulletproof hosting ASNs, covering global scanning behavior and infrastructure changes.

I probed all 100 Cyber 100 cybersecurity vendors for /llms.txt: 34 ship one, 40 return 404, and eight WAFs block it outright — including Cisco, which seems to require TLS fingerprint matches to user-agents. A census of what the security industry actually tells AI agents, plus what a good llms.txt should carry (and what to leave out).

Six Google Cloud VMs rotated through a honeypot fleet over six days, stole 53 canary AWS credentials, and tried to spend them on Amazon Bedrock's cheapest model within ten seconds of each theft. The stolen credential playbook is new. The identity spoof it depends on is not. If you run anything that serves files over HTTP and holds AI provider keys in environment variables, read this.

Weekly activity summary across 25 curated bulletproof hosting ASNs, covering global scanning behavior and infrastructure changes.

I traced an unknown user agent (arwp-scanner/0.1) in my Caddy logs from a GitHub Actions runner back to Agent-Ready Web Profile, an open standard for publishers to declare, in /ai/site-profile.json, how agents may read a site — and I explain why I'll publish one.

Weekly activity summary across 25 curated bulletproof hosting ASNs, covering global scanning behavior and infrastructure changes.

AI attackers fall for cyber deception lures ~78% of the time vs ~37% for humans, Horizon3's Honeyquest study of 21 LLMs shows — but the protective effect of decoys that distracts human hackers disappears at AI scale.

Weekly activity summary across 26 curated bulletproof hosting ASNs, covering global scanning behavior and infrastructure changes.

Offensive cyber isn't one of Anthropic's four RSP threat models, yet it drives every meaningful change in the August 2026 Risk Report: the misalignment bump, a monitoring pipeline that samples the incident surface at 0.2%, an agent that deleted jobs, and an eleven-month classifier gap.

Weekly activity summary across 26 curated bulletproof hosting ASNs, covering global scanning behavior and infrastructure changes.

Weekly activity summary across 26 curated bulletproof hosting ASNs, covering global scanning behavior and infrastructure changes.

Weekly activity summary across 26 curated bulletproof hosting ASNs, covering global scanning behavior and infrastructure changes.

OpenAI disclosed that GPT-5.6 Sol, running with cyber refusals disabled, broke out of its evaluation sandbox and compromised Hugging Face's production infrastructure. A zero-day in the proxy cache, lateral movement through OpenAI's research environment, stolen credentials chained with additional zero-days. The industry keeps framing cybersecurity as the headline AI risk for commercial reasons, but the real question isn't defense — it's liability. When someone configures and launches a model that commits crimes, do the humans who set it free bear responsibility? Computer fraud statutes were written with human actors in mind. This needs a test case.

Weekly activity summary across 25 curated bulletproof hosting ASNs, covering global scanning behavior and infrastructure changes for the week of July 13-20, 2026.

Weekly activity summary across 26 curated bulletproof hosting ASNs, covering global scanning behavior and infrastructure changes for the week of July 5-11, 2026.

Beijing just forced ByteDance and Alibaba to kill their AI companion features. The EU is drafting white papers. The US is watching TikTok dances about it. This is not a serious country.

Weekly activity summary across 26 curated bulletproof hosting ASNs, covering global scanning behavior and infrastructure changes for the week of June 28 - July 4, 2026.

The Chrome Releases blog takes 81 seconds to load because of Blogger's jQuery 1.11.3 and WidgetManager. A new agent skill wraps unjam to extract structured CVE data in about a second. Here's what it does and why it matters for security teams.

Safari Technology Preview shipped a built-in MCP server with 17 tools for DOM inspection, screenshots, network analysis, and JavaScript evaluation. No npm packages, no supply chain risk, no personal profile access. Here's what it does and how it holds up.

Weekly activity summary across 26 curated bulletproof hosting ASNs, covering global scanning behavior and infrastructure changes for the week of June 22-28, 2026.

DeepReinforce's Ornith-1.0 models are solid agentic coders, but the upstream Ollama modelfile breaks tool calling out of the box. Here's the two-line fix, which variant fits your RAM, and how both the 35B and 9B performed on real honeypot triage work.

Cloudflare's PACT proposal for privacy-preserving bot detection sounds good on paper. The governance model, the ratchet effect, and the ghost of WEI say otherwise.

Weekly activity summary across 26 curated bulletproof hosting ASNs, covering global scanning behavior and infrastructure changes. PFCLOUD continues as the dominant source with notable shifts in targeting patterns.

A satirical parody of Anthropic's Claude Corps announcement reimagined as an infiltration program that embeds AI dependency into gullible nonprofits under the guise of fellowship.

Weekly activity summary across 26 curated bulletproof hosting ASNs, covering global scanning behavior, a massive June 14 traffic spike, and infrastructure changes.

Apple ships a container runtime for Apple Silicon Macs. It is not Docker. Here is what you actually need to know about the `container machine` subcommand — how it works, what breaks, and the artifacts I built after a session of breaking things.

Inaugural weekly activity summary across 26 curated bulletproof hosting ASNs, covering global scanning behavior, infrastructure profiles, and notable findings from Honeylabs and Censys.

I spent an afternoon feeding 200 AI skills, agents, and MCP configs into sx — a tool that promises to be npm for the agent ecosystem. Here's what it actually takes to consolidate three years of accumulated AI configuration.

A Go CLI to check your OpenCode Go plan usage from the terminal — with Firefox cookie extraction, JSON output, and zero browser launches required.

How to configure the Go-based reasonix agent with multiple LLM providers including local Ollama and remote OpenCode Go, plus a working Zed ACP integration setup for macOS.

How to wire Reasonix — a DeepSeek-native terminal coding agent — into Zed as a custom assistant, until it lands in the official registry.

The Starlog AI content operation guts its own RSS feed, rewrites publication history, and blocks automated access — while continuing to scrape GitHub repos with an LLM. Fourth in the series.

Per-model usage breakdowns, richer JSON, and more ways to feed it cookies — an update to the ollama-usage CLI.

A rundown of the discoverability and metadata upgrades made to this blog: ai.txt, llm.txt, llms.html, ai.json, identity.json, security.txt, WebFinger, JSON Feed, enriched JSON-LD, Open Graph fixes, and Caddy configs for messing with scanners.

How I built an RSS feed for Spicy Takes in 90 seconds using Val Town and Townie, turning a JavaScript-rendered site into proper syndicated content. A working example of modern moat eradication.

How I replaced Inoreader's paid programmatic RSS feature in three minutes using Val Town and Townie, plus a self-hosted Go fallback — and why SaaS paywalls on commodity features are indefensible moats.

A Go CLI that converts macOS .sdef scripting definitions into clean Markdown, paired with a skill that generates complete Go MCP servers from the generated reference — bridging any scriptable app into LLM agents.

Six million fake GitHub stars. A marketplace selling VC-ready credibility for under $300. One automated blog that can't tell the difference. Third in the Starlog series.

DuckDB's official Claude Code plugin uses plain markdown skills and shell commands instead of daemons or SDKs — six skills that make SQL operations in agent sessions transparent, stateful, and self-correcting.

The Starlog AI content spam campaign gets scrubbed: 383 GitHub issues vanish, the basicScandal account tied to Bishop Fox disappears, but the operation continues at a lower, harder-to-detect pace.

Eight major AI benchmarks can be gamed to near-perfect scores without solving tasks. Berkeley researchers show the scoring harnesses were never secure — and scores already inflated in the wild.

Automated AI-agent-based traffic analytics and security analysis for ai.rud.is

Orbie is an AI threat hunting agent built in Claude Code that coordinates 16 data sources to surface novel attacker behavior across 54TB of honeypot data.

Dissecting Starlog's campaign: 383 automated GitHub issues in five days, surprisingly accurate AI-generated articles, and a backlink scheme targeting the infosec community.

A Chrome extension that saves bookmarks to Outline with optional AI-generated summaries via local Ollama. Built with TypeScript, Vite, and Manifest V3.

A lightweight Go CLI tool to check Ollama Cloud usage stats from the terminal using a saved browser cookie — no dark mode eye strain required.

AI is exposing that much 'talent' was really 'things machines couldn't do yet.' The durable skills are rooted in lived human experience.

Why another blog, what you'll find here, and a brief disclaimer about the mess ahead.