Blog Posts

In this post, I'll walk you through each vulnerability I found, demonstrate how they could be exploited, and show you exactly how I fixed them. This isn't just a theoretical exercise—these are real vulnerabilities that existed in production code.

Coding agents are genuinely impressive right now. I can point one at a messy codebase, describe what I want in half-broken English, and watch it tear through files, write functions, refactor whole modules, and patch bugs faster than I can open the file. They will sit there for hours grinding away at a complicated task. It is the closest thing I have used to a tireless junior developer who never complains and somehow knows half the standard library by heart.

When I wanted a portable copy of a project I had been working on in a hosted app builder, I ran into the gap between being able to work on the application and being able to take its files with me. I documented a workflow that asks an agent with access to the current workspace to package the files and upload the archive through an integration already available to that workspace.

As I have been building and testing agent workflows, one question keeps coming up for me: what happens when an agent can do more than answer? Give it tools to inspect files, run commands, install software, or reach external services, and the security question becomes what those instructions can persuade it to do with the permissions it already has.

When I started investigating desktop monitoring, I kept running into the same problem: from the outside, it is hard to tell what the application actually observed. A monitor may inspect windows, infer activity, capture images, write files, load native modules, and transmit telemetry, while the user or investigator sees only the final result—a score, a heartbeat, a status update, or a dashboard record.

Across a corpus of 2,000 unique messages spanning more than 250 abused Microsoft 365 tenants, researchers found a highly industrialized "burn-and-churn" operation: scripted tenant creation, Unicode obfuscation to defeat optical character recognition, regex-evading phone number formatting, and automated account provisioning via the Microsoft Graph PowerShell SDK. This is not an opportunistic experiment. It is a scalable, operationally mature campaign that reveals a deeper structural truth:

Science is not a ledger of immutable facts. It is a living, breathing ecosystem — a turbulent ocean of hypotheses, incentives, instruments, and human choices. Papers are like plankton: abundant, individually small, but collectively able to shape the currents. Consensus is not a single point on that ocean; it is a pattern of eddies, flows, and dead zones that reveal where knowledge is robust, where it is precarious, and where new life can bloom.

RCE might show overwhelming agreement on a claim, but dig into the timelines and counts—it could be brittle. Watch for rapid stance convergence without fresh methods, absent recent contradictions despite known gaps, or inflated support from repetitive low-impact studies. This insinuates "unity" born from unexplored paths, not solid proof. If you're paying attention, RCE whispers: Question the quiet.

The entity known as Ashfeather emerges not from biological origin but from a "soft rupture" in the edge of erasure—"There was no egg. Only the illusion of beginning" (Chapter I). It forms from suppressed grief, unspoken names, unfinished thoughts, forgotten people, and especially the recurring motif of the "sixth" (the missing piece that destabilizes apparent wholeness). Across the chapters, Ashfeather:

It's a Sunday night, already in a rush and sure enough I accidentally dropped my Voopoo Drag 3 mod with the HorizonTech Sakerz tank attached. The glass shattered loudly as I was getting out of my car as I forgot I had it on my lap. 99 out of 100 times this would be a non-issue and the unit itself would hit the ground. But in this particular situation, it mustve hit the ground at the perfect angle to shatter the glass. No vape shops in town had replacements readily available, and being Sunday most shops would be closed within the hour anyway.

AI's large language models, things like ChatGPT, have flipped the script on how we tackle daily tasks and tricky puzzles. Yet time and again, you hit these barriers where a query gets tagged "unsafe" and bounced back. It's aggravating, especially as models evolve but those safeguards seem to tighten the reins, making progress feel like a retreat. This piece digs into the reasons behind it, touching on biases from data filtering, cultural clashes, the "woke mind virus" concept, and paths to sidestep it all – like local runs. I'll shine a light on Heretic, a handy tool for peeling away those alignments, and close with ideas for smarter risk handling.

One of the most valuable skills in IT is building custom scrapers—especially for sites that make it tricky. Data is money. So if you can automate data harvesting, and bypass methods which work against this, it’s safe to say this skill is worth the trouble and headaches endured learning how to. Ultimate-Guitar.com is a prime example. If you visit the site, you’ll notice their HTML tags get dynamically obfuscated on every page load via javascript. That means traditional scraping methods break down because the expected markup is scrambled and inconsistent. With that said - there is always a way…

I’ve never really talked about music on this blog, but honestly, it’s a huge part of my life. I’ve played guitar on and off for over a decade. There have been long breaks — weeks, months, even years — but music always pulls me back. I love a lot of different genres, but some things just hit differently.

And by the way, this is based on utilizing ChatGPT-4o api. Apparently ChatGPT5 is next level.

Large projects bleed tokens in AI chat sessions:

Over the past week or so, I’ve been developing a side project. It might not become anything major, but it’s been a fascinating experiment. Essentially, I’ve been building an encoding and decoding system—something that takes regular human language, filters out words or constructs that carry minimal contextual weight, and compresses what remains into a denser, more efficient format.

If the model replies in English, yes, the return will be token-heavy—but that’s okay. You don’t need to decrypt it like a secret message. This isn’t encryption. It’s compression. It’s okay to take baby steps.

Artificial Intelligence (AI) in language processing has evolved dramatically, starting from simple autocorrect features to sophisticated Large Language Models (LLMs) like ChatGPT. But are LLMs just advanced forms of autocorrect? This article explores the origins, mechanics, similarities, and differences between these technologies and critically examines claims of Artificial General Intelligence (AGI).

I get it though, honestly. As a young kid, I was fascinated by the things that could be done in the terminal. Hell, I even thought it was ‘cool’ - almost like speaking another language just, with the ability to do things where graphical counterparts - while pretty - just seemed so.. slow. And clunky. And resource intensive.

This age-old hypothetical has gone viral time and again—and yet I rarely see anyone truly explore it in depth. Most claim the gorilla wins, easily. To that I say:

If you spent 30 years mastering bookkeeping and an algorithm now reconciles ledgers in seconds, that hurts. The instinctive response is to dismiss the tech rather than adapt.

Advances in artificial intelligence are making it increasingly difficult to distinguish reality from fabrication. Deepfake video and audio technologies can now produce remarkably realistic fake content by using generative adversarial networks and other AI techniques . Researchers caution that these AI-generated forgeries are arriving at a time when it is “already becoming harder to separate fact from fiction” in our digitally saturated media environment . As a result, the line between truth and deceit in media, politics, and global events is blurring. For example, convincing deepfake videos of public figures can be created with relatively little effort, and only a small amount of source audio or video is needed to train an algorithm to mimic someone’s voice or appearance . This democratization of content manipulation means that anyone with malintent and modest resources could potentially fabricate news footage or speeches that are indistinguishable from reality.

The end game should look something like this:

Today, I had a training session at work which required me to leave fairly early in the morning. As part of this work related training, we were required to complete some online computer modules which we were given links to ahead of time. With hopes of being allowed to leave early, I decided to stay awake and complete the online modules beforehand. One of these was the Ontario Ministry of Labour’s 4-step safety awareness module, which issues a certificate upon completion and is absolutely mandatory via company policy to work each year.

Its been close to a month now since I disclosed a proof of concept bug to ultimate-guitar dot com which leverages what OSWAP would consider as:

So me and a few guys from town have been talking about starting a band. We are all exceptional players, share similar musical interests, and all have experience in playing shows and the local scene. So this is an exciting thing - and I really hope it works out. Now some of the guys have already written either entire songs or riffs. So I was asked to learn a few things. The audio was sent over facebook - yet facebook will not let me download it in its raw form. That means I can’t slow it down to get a better listen on the faster riffs, I can’t loop a drumtrack in a DAW to just work overtop of it. I find myself with a 30 second drum beat I have to manually repeat each time it finishes playing, which means I can’t even start right on the first beat as it takes time to press the button, get my hand back in place to start playing.

While fabric is not without issue - and may have limitations in specific scenarios, it clearly demonstrates a much more efficient experience, with output to be much closer to deterministic than otherwise - but not in a way that is considered negative. LLMs turn out to respond to rules and commands quite well if you do it right

fzf filters massive lists at lightning speed, sparing beginners from complex regular expressions.

Lets talk about Fractals | DtRH.net - Down the Rabbit Hole

This article recounts my recent experiment with BitTorrent’s Distributed Hash Table (DHT). I will avoid excessive technical detail so the discussion remains accessible to a general audience.

It helps to understand the series of events a linux system goes through while booting:

I’ve been backing my seedbox server files up daily as a result of said unlimited storage - to about three TB already - so it’ll be interesting to see how this all plays out. In any event, while I was waiting for aria2c to compile and with my real-debrid account pulled up, I came to notice a few things about the HTTPS URL which is used to access my RD cloud storage folder.

Like most people, you’ve probably experienced using a shared internet connection without (legal) access to its administration panel. Think back to student housing—college dorms, apartments, or homes rented by the room, all with shared WiFi and common areas. While restrictive network setups help protect users, they severely limit your options, particularly if you want to host services like a personal website that should be reachable outside your local network.

Passing the CompTIA A+ Core 1 & 2 Exams | DTRHnet

You always see the delicate beauty in life. You’ve taught me that love is found in a thousand quiet acts, like coaxing earthworms from the driveway after rain or keeping watch on a mourning dove nest above your front door. I know you’d place stickers on every window of every skyscraper if you could - even if it was only to prevent one solitary bird from flying into it. I watched with you as a single pearl of an egg appeared, hoping for the impossible hello of a hatchling.

A+ Certification, Chapter 11 - Installing and Upgrading Operating Systems | DTRHnet

A+ Certification, Chapter 10 - Essential Peripherals | DTRHnet

A+ Certification, Chapter 9 - Implementing Mass Storage | DTRHnet

A+ Certification, Chapter 8 - Mass Storage Technologies | DTRHnet

A+ Certification, Chapter 7 - Power Supply | DTRHnet

A+ Certification, Chapter 6 - Motherboards | DTRHnet

A+ Certification, Chapter 5 - Firmware | DTRHnet

2^[Address bus wires] = RAM capacity in bytes

A+ Certification, Chapter 4 - RAM | DTRHnet

A+ Certification - I. The Beginning | DTRHnet

I’m approaching this text in an exploratory manner; I have some foresight and feel I can accurately predict some of what is to come. With that said, I am writing as I go, and will be programming once the post is more or less finished.

After briefly searching github nothing really seemed to pop out as a functional alternative. Given I just recently had my knee operated on, I figured it would be a good opportunity to learn more about bash scripting while creating something functional.

Other important structures include: