All articles

Cybersecurity / 17 Sep 2026 / 5 min read

Close-on-Exec Makes Descriptor Inheritance an Explicit Boundary

A service opens a privileged socket, starts helper programs, and expects those helpers to receive only standard input, output, and error. One descriptor created without close-on-exec can quietly violate that boundary. If it remains present when a new program image is installed, the helper inherits access to the kernel object even when its own credentials could never have opened that object. Linux treats this as descriptor inheritance, not a new authorization event. The security decision made when the object was opened is embodied in the descriptor. FD_CLOEXEC controls whether that established authority crosses a successful execve().

Cybersecurity Linux Security

Cybersecurity / 17 Sep 2026 / 5 min read

close_range with UNSHARE Detaches Descriptor Tables Before Bulk Closure

A multithreaded Linux process can reach an awkward boundary just before execve(): one thread wants to discard every file descriptor above standard input, output, and error, while another thread can still create descriptors in the same table. A loop of close() calls treats descriptor numbers individually, but it does not by itself change the fact that the table is shared. close_range() with CLOSE_RANGE_UNSHARE addresses that specific race. The kernel first gives the caller a file descriptor table that is no longer shared with the other users of the old table, then applies the requested bulk closure to the caller’s table. The security property is about table ownership during cleanup, not merely fewer system calls.

Cybersecurity Linux

Cybersecurity / 17 Sep 2026 / 7 min read

Certificate Transparency Makes Certificate Issuance Publicly Auditable

Certificate Transparency Makes Certificate Issuance Publicly Auditable A publicly trusted certificate authority can issue a syntactically valid certificate for a domain even when the issuance should never have occurred. TLS path validation alone cannot reveal that mistake if the certificate chains to a trusted root, matches the requested name, remains within its validity period, and satisfies the client’s other policy checks. Certificate Transparency changes the evidence available around that event. Instead of relying only on private CA records and eventual incident disclosure, the ecosystem can require certificate issuance to leave cryptographically verifiable evidence in public append-only logs. The logs do not decide whether a certificate was authorized. They make issuance observable and make certain forms of log equivocation detectable.

Cybersecurity TLS

Artificial Intelligence / 17 Sep 2026 / 6 min read

Bound Gradient Updates with Global Norm Clipping

A single optimization step can contain gradients whose combined magnitude is far larger than the surrounding steps. If those gradients are passed directly to an optimizer, the resulting parameter update can move the model into a very different region of parameter space. Global norm clipping places a bound on the gradient magnitude before the optimizer consumes it. The mechanism is simple, but its behavior is easy to misread. It does not cap every gradient element independently, and it does not guarantee a fixed parameter-update norm for adaptive optimizers. It rescales the collected gradient vector when a chosen norm crosses a threshold.

Artificial Intelligence Neural Networks

Artificial Intelligence / 17 Sep 2026 / 7 min read

Balance Token Routing in Sparse Mixture-of-Experts Models

A sparse mixture-of-experts layer can contain many expert networks while evaluating only a small subset for each token. The router makes that sparsity possible: it assigns scores to experts, selects a limited set, and sends each token through the selected computation paths. That selection is not only an optimization detail. If many tokens concentrate on a few experts, some devices can receive much more work than others, capacity limits can discard or redirect assignments, and experts that receive little traffic get fewer task gradients. Router balance therefore affects both computation and the function represented by the model.

Artificial Intelligence Mixture of Experts

Cybersecurity / 16 Sep 2026 / 7 min read

WebSocket Origin Checks Keep Browser Sessions Inside an Explicit Trust Boundary

A user can be signed in to a WebSocket-backed application while browsing an unrelated site in another tab. JavaScript on that unrelated site can attempt a WebSocket connection to the application’s endpoint. If the browser attaches credentials applicable to the handshake and the server upgrades the connection without checking the initiating origin, the new message channel can inherit authenticated authority that the page itself was never meant to receive. This boundary differs from ordinary cross-origin fetch() handling. WebSocket establishes its own protocol channel through an HTTP opening handshake, and the server has to decide whether the browser origin named in that handshake is permitted to create the channel. CORS response policy is not a substitute for that decision.

Cybersecurity WebSocket

Cybersecurity / 16 Sep 2026 / 9 min read

WebAuthn RP IDs Bind Credentials to Domain Scope, Not a Single Origin

WebAuthn RP IDs Bind Credentials to Domain Scope, Not a Single Origin An authentication service at https://login.example.com can create a WebAuthn credential scoped to example.com rather than only to its own host. That choice permits eligible sibling origins under the same domain to request use of the credential, yet an assertion still carries the calling origin for server-side validation. WebAuthn deliberately separates these two identities. The split solves a practical architecture problem: one relying party can operate across multiple web origins without issuing an unrelated credential for every host. It also creates a security boundary that is easy to flatten incorrectly. The RP ID controls credential scope at the client and authenticator layers; the origin identifies the web context that initiated a ceremony. Treating either value as a substitute for the other can expand authentication authority beyond the intended deployment.

Cybersecurity WebAuthn

Artificial Intelligence / 16 Sep 2026 / 5 min read

Version Embedding Spaces as Incompatible Interfaces

Two embedding models can emit vectors with the same number of dimensions and still produce similarity scores that have no useful cross-version meaning. A vector database accepts the shapes, the distance function runs normally, and retrieval returns ranked results. Nothing in that execution path proves that query and document vectors occupy a compatible representation space. This makes embedding model identity part of the retrieval interface. Replacing an encoder is not equivalent to swapping a serialization routine. Unless compatibility is explicitly established, vectors produced by separate model versions should be treated as belonging to separate spaces.

Artificial Intelligence Embeddings

Artificial Intelligence / 16 Sep 2026 / 6 min read

Verify Speculative Decoding Without Changing Model Output

Autoregressive generation normally asks the target model to produce one next-token distribution at a time. Speculative decoding changes that execution pattern. A cheaper draft model proposes several tokens, then the target model evaluates those candidates in a batch and decides how much of the proposal can be accepted. The useful property is not merely that two models participate. The verification rule determines whether the optimization preserves the target model’s intended decoding distribution or silently changes it.

Artificial Intelligence LLM

Software Engineering / 16 Sep 2026 / 6 min read

Vary Expands HTTP Cache Selection Beyond the URI

Two GET requests for the same target URI can require different cached responses. If an origin selects representation metadata or content from request headers such as Accept-Encoding, a cache keyed only by the URI can return a representation selected for a different request. HTTP’s Vary response field extends cache selection across nominated request fields. It does not merely document negotiation. For a stored response carrying Vary, those nominated fields constrain whether that response can satisfy a later request without revalidation.

Software Engineering HTTP

Tech / 16 Sep 2026 / 5 min read

USB Selective Suspend Reduces Power for Idle Devices

USB does not require every attached device to remain fully active whenever the computer is running. A host can suspend an idle USB device while other devices continue transferring data. This behavior reduces unnecessary power use, especially on portable systems with several peripherals. The useful distinction is scope: selective suspend targets an idle device or interface rather than treating the entire USB controller as one power unit. Suspend applies to idle USB activity A USB host schedules transfers. When a device has no useful work pending, keeping all of its circuitry active can waste energy.

USB Power Management

Artificial Intelligence / 16 Sep 2026 / 6 min read

Trade Activation Memory for Recomputation

Backpropagation needs intermediate values from the forward computation to form gradients. Retaining every required activation can consume substantial accelerator memory, especially as sequence length, batch size, hidden width, or network depth grows. Activation checkpointing changes that storage decision. Selected forward regions retain only chosen boundary tensors, then reproduce omitted intermediates when the backward pass reaches those regions. Peak activation memory can fall, but some forward computation is executed again. The useful engineering question is not simply whether checkpointing saves memory. The placement of recomputation boundaries determines which tensors disappear, how much extra compute appears, and whether replayed operations reproduce a valid backward computation.

Artificial Intelligence Neural Networks

Cybersecurity / 16 Sep 2026 / 6 min read

TLS Early Data Trades Handshake Latency for Replay Exposure

TLS Early Data Trades Handshake Latency for Replay Exposure A returning client can possess enough state from a prior TLS 1.3 connection to send application data alongside its first handshake flight. That removes a round-trip from the critical path for eligible traffic, but it also changes a security property that applications often treat as implicit: encrypted transport no longer means that a request can appear only once across connections. TLS 1.3 early data, commonly called 0-RTT, is protected using keys derived from a pre-shared key associated with an earlier session or an externally provisioned PSK. The server has not yet contributed fresh handshake state when those bytes are transmitted. As a result, early data has weaker replay properties than ordinary application data sent after the handshake.

Cybersecurity TLS

Cybersecurity / 16 Sep 2026 / 8 min read

TLS 1.3 Early Data Moves Replay Risk Into HTTP Request Semantics

TLS 1.3 Early Data Moves Replay Risk Into HTTP Request Semantics A returning client can possess a TLS 1.3 resumption ticket and send an HTTP request before a new handshake has completed. That removes a round trip from the request path, but it also changes a security property that ordinary application code often assumes: accepted encrypted traffic is not necessarily unique to one connection. TLS 1.3 early data, commonly called 0-RTT data, is protected with keys derived from a pre-shared key associated with an earlier session or provisioned out of band. The request is encrypted, yet its protection does not depend on the fresh ServerHello from the new connection. As a result, TLS does not provide the same cross-connection replay protection for early data that it provides for application data sent after the handshake.

Cybersecurity TLS 1.3

Tech / 16 Sep 2026 / 7 min read

TLB Caches Recent Virtual Address Translations

Modern processors commonly execute programs in virtual address spaces. A load or store can begin with a virtual address while the memory system ultimately needs a physical location and access permissions. Page tables hold the mapping information, but consulting their hierarchy for every memory reference would add substantial work. A translation lookaside buffer, or TLB, keeps recently used address translations near the processor. A TLB hit supplies cached mapping information without a full page-table walk. A TLB miss triggers additional translation work even when the requested application data is already present in a CPU cache.

CPU Memory

Artificial Intelligence / 16 Sep 2026 / 6 min read

Test Transformer Mechanisms with Activation Patching

A transformer can produce two different outputs from prompts that differ in one relevant detail, yet inspection of attention weights or hidden-state similarity does not establish which internal states actually matter for that difference. Activation patching addresses a narrower question by intervening on a forward pass: replace a selected activation with the corresponding activation from another run, then measure how the output changes. The result is causal with respect to that intervention. It does not automatically identify a complete circuit, a unique mechanism, or a human-readable feature. That boundary is central to using patching results correctly.

Artificial Intelligence Transformers

Tech / 16 Sep 2026 / 6 min read

TCP Window Scaling Expands the Receive Window for Fast Long Paths

TCP flow control limits how much data a sender may have outstanding according to the receiving endpoint’s available buffer space. The receiver advertises that limit in the TCP Window field so the sender does not deliver data faster than the receiving stack can accept it. The Window field in the TCP header is 16 bits wide. Without an extension, its largest value is 65,535 bytes. That ceiling can be too small on a path that carries data quickly but has a substantial round-trip time.

Networking TCP

Tech / 16 Sep 2026 / 6 min read

TCP TIME-WAIT Preserves Closed Connection State

A TCP endpoint can finish an application’s close operation while the protocol still retains state for that connection. After an active close completes its FIN exchange, the endpoint normally enters TIME-WAIT instead of discarding the connection record immediately. That retained state has two jobs. It leaves the endpoint able to acknowledge a retransmitted final FIN, and it separates a closed connection from a later incarnation that could use the same local and remote addresses and ports.

TCP Networking

Software Engineering / 16 Sep 2026 / 5 min read

TCP TIME-WAIT Delays Four-Tuple Reuse

A TCP endpoint that performs the active close can keep the closed connection in TIME-WAIT after the final ACK has been sent. The application-visible stream is finished, yet the transport retains state for a bounded interval before permitting unrestricted reuse of the same connection identity. That retention is not leftover application state. It protects the protocol boundary between one connection incarnation and a later connection that could otherwise use the same source address, source port, destination address, and destination port.

Software Engineering Networking

Tech / 16 Sep 2026 / 6 min read

TCP Keepalive Probes Test Idle Connections

A TCP connection can remain established while carrying no application data. That is valid behavior: an open connection does not need a continuous stream of packets to remain a TCP connection. Silence creates a practical problem when one endpoint disappears without completing the normal close sequence. A machine can lose power, a network path can fail, or state in an intermediate device can vanish. If the surviving endpoint has no data to send, ordinary retransmission logic has nothing to act on.

TCP Networking

Tech / 16 Sep 2026 / 5 min read

SSD TRIM Marks Unused Data for Controller Reclamation

Deleting a file changes filesystem metadata, but an SSD does not automatically know that every flash page formerly associated with the file can be treated as disposable. From the drive’s point of view, previously written logical block addresses can remain valid until the host explicitly indicates otherwise or overwrites them. TRIM provides that indication for ATA storage. Comparable deallocation commands exist in other storage protocols. The host identifies logical block ranges whose previous contents no longer need to be preserved, and the SSD can use that information when managing flash internally.

Storage SSD

Tech / 16 Sep 2026 / 5 min read

SSD Garbage Collection Amplifies Host Writes

An SSD can write substantially more data to NAND than the host sends to the device. The extra traffic appears when the controller must relocate still-valid pages before reclaiming flash blocks that contain invalid data. This internal movement is write amplification. It is a consequence of the mismatch between fine-grained logical updates and NAND erase constraints, not an extra write issued by the application. NAND pages cannot be overwritten in place NAND flash is programmed in pages but erased in larger erase blocks. A page that already contains programmed data cannot generally receive an arbitrary in-place replacement. The controller writes the new version to another available page and marks the old physical page as stale in its mapping state.

Storage SSD

Tech / 16 Sep 2026 / 7 min read

SATA Native Command Queuing Reorders Storage Requests

A storage request does not always need to finish in the same order that software submitted it. SATA Native Command Queuing, commonly shortened to NCQ, lets a compatible host issue several commands without waiting for each one to complete first. The device can then schedule eligible work in an order suited to its internal operation. The mechanism was especially valuable for hard disk drives, where physical head movement and rotational position can make request order affect service time. Solid-state drives have no moving heads, but multiple outstanding commands can still expose parallel work to the controller and reduce idle gaps.

SATA Storage

Cybersecurity / 16 Sep 2026 / 7 min read

SameSite Cookies Draw a Site Boundary That Is Broader Than Origin

SameSite Cookies Draw a Site Boundary That Is Broader Than Origin Two HTTPS applications can be isolated by the browser’s same-origin policy yet still occupy the same cookie site. A service at accounts.example.com and another at shop.example.com have different origins because their hosts differ, but cookie policy can classify their request context at a broader site boundary. That gap matters when SameSite is treated as if it were equivalent to origin isolation.

Cybersecurity Cookies