Never attribute to incompetence that which is adequately explained by malice.
Notes on security, systems, and the things that were not, in fact, an accident. Sharper takes at @inverse_hanlon.
-
BrokenRNG: Entropy Boogaloo.
Did switck place a bug in the entropy generation for later retrieval? Was the bug really a feature written by CoinKites CTO under a nym?
-
Bitkey: The Bitcoin Hardware Wallet for Your Normie Friends?
TLDR: Block published the Bitkey source. I read it. The 2-of-3 is real, privacy is decent, coin control is built but wired into nothing
-
Retirement Attack: Coldcard Sold Us a Warning
Ten weeks before Coldcard's entropy bug shipped, Coinkite's CEO waved off the idea that a vendor would ever run a retirement attack, and suggested dice. His CTO wrote the bug under a pseudonym. Two people warned them. The answer was: if something was wrong, we'd already know about it by now.
-
Coldcard Exploit: The Timeline Is the Tell
A config flag nobody checked for five years cost Coldcard users $88 million. The bug is just a footnote. What matters is who got to decide when the rest of us found out.
-
I Cloned Paperboy in an Afternoon With Claude
One prompt turned into a playable Paperboy clone in under two hours.
-
Why Bitcoin Will Go Up (Eventually)
A no hype look at supply mechanics, institutional plumbing, and holder behavior.
-
Top 10 Signs Your Friend Group Fell Off (Twitter Edition)
Ten telltale signs that a friend group has quietly migrated from a group chat to a timeline, ranked roughly by how far gone it is.
-
The Guy Who Doesn't Understand What a Flow Round Is
Every gym has one: the training partner who treats every roll like a title match. He hurts himself more than anyone else, and how to fix it if it's you.
-
BIP-110: The Threshold Is the Tell
BIP-110 needs 55% to change Bitcoin's consensus rules; SegWit and Taproot needed 95%. That gap is not a rounding error. It's a decision about how many people you're willing to strand.
-
Hacking Is Dead, Long Live Hacking
The most devastating breaches of the decade required almost no technical skill. It's a return to hackings original social and adolescent form. And this time it comes with a body count.
-
Why Orthodox Christianity Is True, From Someone Who Doesn't Trust Institutions
Running the Orthodox Church through the same incentive analysis I run every failing institution through and watching it keep passing tests it should fail.
-
The 5 AM Guard: What Competing as a 40 Something Blue Belt Taught Me About Showing Up
Training and competing in jiu jitsu around a full time job and three kids and why the hardest opponent isn't the guy across the mat, it's the calendar.
-
I built an AI bedtime story generator (and it took an afternoon)
Storytime generates an original, illustrated bedtime story in one click, running end-to-end on Cloudflare and Groq. Built in an afternoon, on purpose kept that small.
-
The Vibe Coding Ick
The app didn't change when you learned it was vibe coded. Your opinion of it did. A look at what that reflex is actually measuring.
-
Hello, world. I assume the worst.
Why this blog exists, what the inverse of Hanlon's razor actually means, and why 280 characters stopped being enough.
-
How to read a breach notification
A field guide to the passive voice, the abundance of caution, and other load-bearing phrases of incident PR.
-
Sometimes it really is a typo
The inverse razor cuts both ways: a note on not becoming the thing you mock.
-
Case Study: Turning One Failed Change Into Nine Hostages
Introducing Synergized Solo Execution: the bold new format where ten engineers clear their calendars so one of them can do the work.
-
The Dog and Pony Show
Corporate cybersecurity is a theatrical production for auditors, regulators, and insurance underwriters. The hackers are extras on set.