Technical writing on software engineering, systems design, and the tools that make it possible.
Constrained decoding guarantees a model's output has the right shape. It guarantees nothing about what a free-text field holds. Agent-to-agent pipelines that read schema-valid as validated inherit an injection surface the schema was never built to close.
RFC 9849 finalizes Encrypted Client Hello, encrypting the one field most enterprise firewalls used to inspect encrypted traffic. What breaks, what still works, and how to rebuild detection without reviving blanket TLS interception.
A four-stage PoC — from a benign tool registration to one agent exfiltrating a second, more privileged agent's secrets — shows how AI agents bridge systems using authority they already legitimately hold, bypassing lateral-movement defenses built for network paths and stolen credentials.
Encryption secures the ciphertext. The schema answers questions the privacy contract never considered — sharing graphs, behavioral timelines, search-token frequency maps. How to read a database the way an attacker does.
A technical taxonomy of web race conditions beyond TOCTOU, explaining read-write gaps, HTTP/2 single-packet attacks, and the storage-layer primitives that close them.
Most inter-VLAN routing in enterprise networks isn't done by a router. It's done by a switch that understands IP. This post breaks down how Layer 2 and Layer 3 switches differ, how SVIs and routed ports work, and why TCAM makes hardware-based routing possible.