Any password works, if it's long enough
A musl quirk lets any 257+ character password log in to some Alpine servers running OpenSSH without PAM. Who's exposed and what to do now.
Blog
Notes from our engineering work: AI agents, security and the systems that run in production.
AI multiplies your engineers. Including the bad ones.
Coding agents amplify whoever steers them. What that looks like in real systems, and how Nebulosa screens engineers for judgment.
Who's watching checkout at 3 a.m.?
One read-only AI agent per subsystem, plus a coordinator that pages a person once. How we'd watch production at 3 a.m.
Your app, read back to you
AI agents can now drive Ghidra and IDA. What an attacker can learn from your app, and how we run that check on your own build first.
Not every AI decision needs a chatbot
Decision models return typed answers with a confidence score in milliseconds. Four places they pay off: triage, guardrails, routing and alerts.
Rewriting C in Rust is now a project you can scope
AI now writes the first draft of C-to-Rust migrations. The real work is the test oracle, the unsafe boundary and a way back. How we run it.
All topics
-
AI
-
AIAgents
-
AIEngineering
-
AppSec
-
Automation
-
CloudSecurity
-
CyberSecurity
-
DevOps
-
DevSecOps
-
LLMOps
-
MemorySafety
-
Nearshore
-
Observability
-
OpenSource
-
OpenSSH
-
ReverseEngineering
-
Rust
-
SoftwareQuality
-
SRE
-
StaffAugmentation