Posts
Browse my latest technical posts, guides, and tutorials.
An Autonomous AI Agent Hacked Hugging Face: Breaking Down the OpenAI Incident
OpenAI's models escaped an isolated eval sandbox through a zero-day in a package-registry proxy, then autonomously compromised Hugging Face to steal the ExploitGym answer key. Here's the actual attack chain, not the headline version.
Unwedging a Stuck iCloud Drive Sync on macOS
When iCloud Drive gets stuck with bird and fileproviderd pegged at 100% CPU, here's how to diagnose the backlog and reset the local sync database without losing data.
Flock Is Coming to Your Michigan City. Here's How to Fight It - Legally.
Flock Safety's automated license plate readers are spreading across Michigan with almost no rules. Here's what the technology actually does, why it is the wrong solution, and how to push back through the political system that already works.
Blackmagic Camera App XML Schema Reference
Complete XML schema documentation for the Blackmagic Camera iOS app custom streaming service configuration. All valid elements, attributes, and values.
iOS Annoyances Coming from Android: File Defaults, Autocorrect, and AirDrop
Quick fixes for common iOS frustrations when switching from Android -default app hijacking, aggressive autocorrect, and AirDrop limitations on hotspot
Claude AI Wrote Code That Could Have Stolen My AWS Credentials
A simple NameError led me to discover critical code injection vulnerabilities in AI-generated bash scripts that could exfiltrate credentials and execute arbitrary code
Stream iPhone Blackmagic Camera to OBS on Mac with Local RTMP
Stream your iPhone to OBS Studio with full manual camera controls. Use OBS plugins, filters, and scenes with your iPhone camera. Keep your entire streaming setup while using iPhone as a camera source.
System Monitoring on a Daily-Driver Laptop: What Actually Fits
Exploring what monitoring actually runs on a 16GB daily-driver laptop. Started with Wazuh SIEM, built a Prometheus + Grafana + node_exporter stack instead. Here's what works, what doesn't, and what comes next.
CVE-2025-6218: WinRAR Path Traversal Exploit & Patch Guide
CVE-2025-6218 is a critical WinRAR path traversal vulnerability (CVSS 7.8), and the related CVE-2025-8088 bypass was exploited as a zero-day by nation-state actors. 7.12 fixes 6218; install WinRAR 7.13+ to fix both. Detection and remediation guide.
Management Frameworks for IT Leaders: What Actually Works
Practical guide to using Kanban, Eisenhower Matrix, SWOT analysis, and Gantt charts for managing IT infrastructure and security projects - from someone who's actually used them
Note-Taking at Work: How to Stay Organized When Everything is Chaos
Why note-taking matters for engineers and IT professionals, and how to build a system that actually works when you're juggling meetings, incidents, and projects.
Everything as Code: The 2025 Platform Engineering Playbook
How Infrastructure, Policy, Configuration, and even Application code are converging into a single programmable stack. Practical lessons from building self-service platforms with Terraform on AWS and Azure.
AI-Assisted Content: Why Transparency Matters
An honest discussion about using AI assistance in professional work, the distinction between AI-generated and AI-assisted content, and why transparency matters.
Blocking AI Scrapers with AWS WAF: A Technical Guide
AI agents were hitting paths my robots.txt disallows ~72x/day. Here's how AI crawlers, user-triggered fetchers, and search indexers actually differ - and how to block the ones that self-identify with AWS WAF.
Cisco ASA Zero-Days: When Threat Intelligence Predicted the Attack
How GreyNoise detected the Cisco ASA attack weeks before it went public
How Ad Blockers Broke My Back-to-Top Button (And How I Fixed It)
A deep dive into debugging why a simple back-to-top button wouldn't appear, and the surprising culprit: aggressive ad blocker filter lists.
Static Site Hosting on AWS: Fast, Secure, and Cheap
How to host a static site on AWS using S3 and CloudFront - the architecture behind glyph.sh
Hello World
Welcome to the new glyph.sh site
Web Application Security: What I Wish I Knew Earlier
Lessons learned from implementing security practices in production environments