2026-02-04
The Reachability Question
Whether a host is reachable is rarely a yes or a no. On the underrated complexity of the simplest question we ask of the internet.
Read →
2026-01-22
Certificates as Witness
The certificate transparency record is the most honest log the internet keeps. What it shows when you read it as an evidentiary trail.
Read →
2026-01-09
The Asymmetry of Observation
Adversaries see everything. Defenders see what they are sold. A short essay on the imbalance and what to do about it.
Read →
2025-12-18
Sources Are Not Datasets
On the difference between collection and product, and why most "intelligence feeds" are neither.
Read →
2025-12-03
Notes on Cluster Pivoting
A practical walkthrough of how an analyst gets from a single observable to an actor cluster, written for analysts.
Read →
2025-11-20
The Edge Moves
Network perimeters drift. So do their operators. On detecting infrastructure change at a useful timescale.
Read →
2025-11-04
Resolving the Unresolvable
On the names that do not answer, the names that lie, and the names that contradict their parents. A field report from the DNS.
Read →
2025-10-21
Operator Tradecraft, At Distance
What can be inferred about operators from the shape of the infrastructure they leave behind, and where that inference reliably stops.
Read →
2025-10-06
A Field Guide to False Positives
Notes on the categories of mistakes our pipelines make, and the categories of mistakes that humans make on top of them.
Read →
