Vol. MMXXVINo. 90
Field reports from cloud-security engineering,AI experiments, and a homelab that keeps getting bigger.
Security·14 min read·
npm's own replication database says 4,288,093 packages. The aggregator most supply-chain research runs on says 5,732,659. The gap is retained unpublish tombstones, and sampling from the wrong side moves a headline number by sixteen points.
Security·7 min read·
Formal verification for AI-agent security. You can't prove a probabilistic model does the right thing — but the deterministic gate in front of it is small enough to prove outright. Dafny proofs, a Rego twin, and differential testing, following the method AWS used for Cedar.
Security·7 min read·
Rewriting security controls for probabilistic agents. Static control catalogs assume systems that do what they're told; AI agents don't — so here's how to express agent guardrails (tool allowlists, secret-egress denial, audit) as machine-checkable OSCAL component definitions.
Design·10 min read·
A dataset of 545 terminal color schemes, converted to OKLCH and republished as an npm package — and the theme picker in this site's own header that quietly runs on it.
Security·13 min read·
MicroVMs and namespace sandboxes give AI coding agents mature filesystem and process isolation. Most open-source ones still hand credentials to the agent directly. Here's the proxy-injection pattern that fixes that, and what it doesn't fix.
Typescript·7 min read·
An MCP server that lets Claude live-code music in Strudel through a real, visible Chromium browser — no mocked audio API. What it does, what broke while I built it, and the engineering that came out of my first real browser-automation project.