Welcome to Container Escapes 101 at the AppSec Village at DEF CON 34!! Slides here 📽️ 🎯 Goal: to have a working knowledge of container escapes and how each security measure or risk maps to pot...

Cryptography seems deceptively simple until you get into implementation. Tempted by shortcuts to save money, organizations ship something “just good enough” to pass compliance checks. I see this ...

Let’s run large language models locally, without too much time spent fiddling with it versus time spent building. I touched on this a tiny bit earlier in the year in “You didn’t miss the boat on A...

A few observations and thoughts about writing on the internet for four years. Doing fewer, bigger things 📝 This is post #130, meaning only 20 pieces this year. It’s much less than prior years, ...

My AI slop annoys me. Your AI slop annoys me, but probably not as much as my own slop annoys me. We shouldn’t review it more than we have to, yet here we are. 🙄 We need to work together anyways....

I have a love/hate relationship with vendoring dependencies in a repository. This enduring trauma and admiration comes from many of the projects I’ve supported over the years. Vendoring is a terr...

There are a ton of weird, non-standard places to manage dependencies that don’t work with software composition tools or package managers. Somehow I seem to find many of these reasons. Each made s...

But why though? I’ve been running a kernel build with a patch to enable addressing of identical hardware individually for around 8 years. Until now, users would have to either build it themselves...

In starting a new job as an engineer after 5 years as a sales engineer, I expected the tech stack to be different, but not the shape of the work itself … even having been at the leading edge of AI ...

Some thoughts for the end of Container Escapes 101, having updated it for all the changes of 2026 so far and as presented in the AppSec Village @ DEF CON 34. It’s now the middle of 2026. We’ve...