https://windshock.github.io/en/Recent content in After the Code, the Structure Remains on After the CodeHugo -- 0.145.0en-USMon, 10 Aug 2026 00:00:00 +0000https://windshock.github.io/en/post/2026-08-10-does-hiring-world-best-hackers-improve-security/Mon, 10 Aug 2026 00:00:00 +0000https://windshock.github.io/en/post/2026-08-10-does-hiring-world-best-hackers-improve-security/Bringing world-class hackers and a CTF research ecosystem into an organization can make it stronger, but real security improvement requires turning offensive capability into governance and structural change.https://windshock.github.io/en/post/2026-08-03-attack-path-synthesizer/Mon, 03 Aug 2026 00:00:00 +0000https://windshock.github.io/en/post/2026-08-03-attack-path-synthesizer/A practical method for modeling vulnerabilities as attacker-relevant security state transitions and combining human intuition with bounded AI searchhttps://windshock.github.io/en/post/2026-07-27-ai-package-egress-boundary-architecture/Mon, 27 Jul 2026 00:00:00 +0000https://windshock.github.io/en/post/2026-07-27-ai-package-egress-boundary-architecture/Package and container registry proxies are active trust boundaries for AI runtimes. This report turns incident evidence, public SSRF history, and runtime observations into an artifact egress control architecture.https://windshock.github.io/en/post/2026-06-16-crypto-learning-guide/Tue, 16 Jun 2026 00:00:00 +0000https://windshock.github.io/en/post/2026-06-16-crypto-learning-guide/In practical cryptography, failures often occur in the design—combining randomness, key management, operating modes, error handling, and authentication—rather than in the algorithms themselves. This post outlines criteria for auditing cryptographic implementations from the perspective of security assessors and reversers.https://windshock.github.io/en/post/2026-06-08-security-spec-test-repair-fuzzing/Mon, 08 Jun 2026 00:00:00 +0000https://windshock.github.io/en/post/2026-06-08-security-spec-test-repair-fuzzing/This article explains how I split an XSS security development specification for small local models into core/verify/dev/test overlays, and what I learned while connecting LLM-based judgment to regression-test generation and Jazzer/Jazzer.js fuzzing seeds.https://windshock.github.io/en/post/2026-05-24-structural-ethics-cybersecurity-policy-korea/Sun, 24 May 2026 00:00:00 +0000https://windshock.github.io/en/post/2026-05-24-structural-ethics-cybersecurity-policy-korea/A reading of Korea's 2025 whole-of-government information protection plan through the structural parallel between the Nightingale myth and the white-hacker discourse. Policy is moving from dependence on individual ethics toward structural accountability, but the transition is not complete.https://windshock.github.io/en/post/2026-05-24-ai-problem-reframing-cross-domain-reasoning/Sun, 24 May 2026 00:00:00 +0000https://windshock.github.io/en/post/2026-05-24-ai-problem-reframing-cross-domain-reasoning/Through the Nightingale myth, the white-hacker discourse, the Sterbenz lemma, and browser exploit reasoning, this essay argues that the real change LLMs bring lies not in knowledge retrieval but in problem reframing.https://windshock.github.io/en/post/2026-05-24-ai-national-strategy-control-plane/Sun, 24 May 2026 00:00:00 +0000https://windshock.github.io/en/post/2026-05-24-ai-national-strategy-control-plane/The decisive front in national AI strategy is not GPU count alone, but who controls and can prove the flow of data, models, agents, permissions, logs, and verification running on top of those GPUs.https://windshock.github.io/en/post/2026-05-19-sec-audit-static-feedback-loop/Tue, 19 May 2026 00:00:00 +0000https://windshock.github.io/en/post/2026-05-19-sec-audit-static-feedback-loop/I designed sec-audit-static workflow v2.0, ran it against a real auth-server codebase, and missed two things. This is the record of how those misses were folded back into the tool — through v2.8.https://windshock.github.io/en/post/2026-05-11-adaptive-security-customer-context/Mon, 11 May 2026 00:00:00 +0000https://windshock.github.io/en/post/2026-05-11-adaptive-security-customer-context/Security controls already exist. The real problem is that we cannot decide which customer, at which moment, deserves how much friction. As the closing chapter of the CAPTCHA·ATO series, this post is about moving from quantity of controls to context of controls — adaptive security as an operational discipline.https://windshock.github.io/en/post/2026-05-07-market-can-move-security-governance/Thu, 07 May 2026 00:00:00 +0000https://windshock.github.io/en/post/2026-05-07-market-can-move-security-governance/Policy is not the only thing that creates change. Once external actors — insurers, customers, supply chains, evaluation services, security SaaS — start pricing the cost, governance eventually follows.https://windshock.github.io/en/post/2026-05-07-mcp-is-repeating-rpc-security-history/Thu, 07 May 2026 00:00:00 +0000https://windshock.github.io/en/post/2026-05-07-mcp-is-repeating-rpc-security-history/MCP security risks are not about prompt injection. They stem from the same configuration-to-execution escalation pattern that has plagued RPC, local security software, and CI/CD pipelines for decades.https://windshock.github.io/en/post/2026-05-04-adaptive-security-metrics-and-ciso-template/Mon, 04 May 2026 00:00:00 +0000https://windshock.github.io/en/post/2026-05-04-adaptive-security-metrics-and-ciso-template/To move from compliance capability to adaptive capability, what do we measure? This post proposes MTTA, MTTP, MTRS, and a minimal execution template for the field.https://windshock.github.io/en/post/2026-05-02-ai-development-tools-supply-chain-governance/Sat, 02 May 2026 00:00:00 +0000https://windshock.github.io/en/post/2026-05-02-ai-development-tools-supply-chain-governance/AI IDEs, MCP, and automation connectors are not merely developer convenience tools. They are supply-chain assets that affect the trust path of how code is written, reviewed, and shipped.https://windshock.github.io/en/post/2026-05-01-security-assessment-as-development-process/Fri, 01 May 2026 00:00:00 +0000https://windshock.github.io/en/post/2026-05-01-security-assessment-as-development-process/AI-era security assessment is not primarily about reducing outsourcing cost. It is about embedding repeatable verification into the development process while separating automation candidates from human judgment.https://windshock.github.io/en/post/2026-04-30-ai-slop-vulnerability-triage/Thu, 30 Apr 2026 00:00:00 +0000https://windshock.github.io/en/post/2026-04-30-ai-slop-vulnerability-triage/AI lowers the cost of finding vulnerability candidates, but it also increases low-quality reports, duplicates, and false positives. In the AI slop era, triage quality becomes the core security operation.https://windshock.github.io/en/post/2026-04-30-why-korean-security-governance-does-not-change/Thu, 30 Apr 2026 00:00:00 +0000https://windshock.github.io/en/post/2026-04-30-why-korean-security-governance-does-not-change/A game-theoretic analysis of why Korean security governance stays stuck when NIS, KISA, the Board of Audit, the security industry, CISOs, and policy agencies are each acting rationally.https://windshock.github.io/en/post/2026-04-29-after-cve-response-ai-vulnerability/Wed, 29 Apr 2026 00:00:00 +0000https://windshock.github.io/en/post/2026-04-29-after-cve-response-ai-vulnerability/AI-era vulnerability response cannot wait for a CVE number. Pre-CVE signals such as issues, commits, PoCs, write-ups, and patch traces now have to be mapped against internal exposure earlier.https://windshock.github.io/en/post/2026-04-26-ai-security-governance-korea/Sun, 26 Apr 2026 00:00:00 +0000https://windshock.github.io/en/post/2026-04-26-ai-security-governance-korea/Korean security governance in the AI era needs to change not the title of any one agency, but the behavior that evaluation rewards.https://windshock.github.io/en/post/2026-04-21-after-the-code-the-structure-remains/Tue, 21 Apr 2026 00:00:00 +0000https://windshock.github.io/en/post/2026-04-21-after-the-code-the-structure-remains/The representative foreword of this blog: security now fails less at finding issues than at absorbing, sustaining, and acting on what has already been found.https://windshock.github.io/en/post/2026-04-21-security-knowledge-to-default-design/Tue, 21 Apr 2026 00:00:00 +0000https://windshock.github.io/en/post/2026-04-21-security-knowledge-to-default-design/An organizational design report that reframes the security–DevOps problem from failed knowledge transfer to default design, interfaces, exception handling, and alignment.https://windshock.github.io/en/post/2026-04-15-security-code-clustering/Wed, 15 Apr 2026 00:00:00 +0000https://windshock.github.io/en/post/2026-04-15-security-code-clustering/A practical account of applying dataflow-based clustering to a real codebase — reducing 228 endpoints to 5 reviewable clusters, and finding an RCE chain in the cross-section.https://windshock.github.io/en/post/2026-04-07-dismantling-ato-supply-chain/Tue, 07 Apr 2026 00:00:00 +0000https://windshock.github.io/en/post/2026-04-07-dismantling-ato-supply-chain/How Korea's CaaS supply chain reproduces itself through the recycling loop of points, gift cards, and crypto — and why defending against it requires reading the entire behavioral network, not just the login page.https://windshock.github.io/en/post/2026-04-02-security-from-sense-to-structure/Thu, 02 Apr 2026 00:00:00 +0000https://windshock.github.io/en/post/2026-04-02-security-from-sense-to-structure/18 years of vulnerability hunting distilled into one insight: the shift from individual instinct to scalable structure — and what AI means for those left standing.https://windshock.github.io/en/post/2026-03-30-captcha-bypass-poc-defense-strategy/Mon, 30 Mar 2026 00:00:00 +0000https://windshock.github.io/en/post/2026-03-30-captcha-bypass-poc-defense-strategy/A practical look at an audio CAPTCHA bypass PoC built with Playwright, Whisper, and Page-Agent, plus the login defenses that still matter after CAPTCHA falls.https://windshock.github.io/en/post/2026-03-17-security-testing-as-code/Tue, 17 Mar 2026 00:00:00 +0000https://windshock.github.io/en/post/2026-03-17-security-testing-as-code/We point out the limitations of traditional security diagnostic reports and share the necessity and practical application cases of 'Security Testing as Code', managing diagnostic results not as 'documents' but as 'executable code (PoC)'.https://windshock.github.io/en/post/2026-03-13-waf-ips-ids-detection-gap-analysis/Fri, 13 Mar 2026 00:00:00 +0000https://windshock.github.io/en/post/2026-03-13-waf-ips-ids-detection-gap-analysis/Structural analysis of WAF, IPS, and IDS detection gaps from parsing discrepancies, with a practical remediation taxonomy.https://windshock.github.io/en/post/2026-02-13-contract-vs-security-governance/Fri, 13 Feb 2026 00:00:00 +0000https://windshock.github.io/en/post/2026-02-13-contract-vs-security-governance/Why security governance must drive decisions before contracts enforce them—a structural reframing for security leadership.https://windshock.github.io/en/post/2026-01-19-digital-identity-eidas2-korea/Mon, 19 Jan 2026 00:00:00 +0000https://windshock.github.io/en/post/2026-01-19-digital-identity-eidas2-korea/Comparative analysis of EU eIDAS 2.0 wallet-based identity and Korea's mobile ID system across governance, privacy, and operations.https://windshock.github.io/en/post/2026-01-07-amadey-static-vs-memory-detection/Wed, 07 Jan 2026 00:00:00 +0000https://windshock.github.io/en/post/2026-01-07-amadey-static-vs-memory-detection/Comparing static vs memory-based malware detection using Amadey, showing why runtime YARA rules outperform file-hash approaches.https://windshock.github.io/en/post/2025-12-29-the-visibility-principle/Mon, 29 Dec 2025 00:00:00 +0000https://windshock.github.io/en/post/2025-12-29-the-visibility-principle/How transparent internal vulnerability visibility drives remediation through accountability and deterrence without formal punishment.https://windshock.github.io/en/post/2025-12-22-attack-surface-management-in-2025-why-continuous-visibility-is-essential/Mon, 22 Dec 2025 00:00:00 +0000https://windshock.github.io/en/post/2025-12-22-attack-surface-management-in-2025-why-continuous-visibility-is-essential/Why continuous attack surface management is critical in 2025, covering AI-driven discovery, shadow IT, and zero trust integration.https://windshock.github.io/en/post/2025-06-30-ciso-strategy-execution/Mon, 30 Jun 2025 00:00:00 +0000https://windshock.github.io/en/post/2025-06-30-ciso-strategy-execution/A comprehensive report presenting a roadmap for practical security improvement and field leadership, centered around the debate on WAF and the gap between philosophy and execution.https://windshock.github.io/en/post/2025-06-25-ssrf-defense/Wed, 25 Jun 2025 00:00:00 +0000https://windshock.github.io/en/post/2025-06-25-ssrf-defense/A deep dive into why common SSRF defense code is often incomplete, real-world bypasses, and practical, layered mitigation strategies for developers and security engineers.https://windshock.github.io/en/post/2025-06-10-rce-via-exception-serialization-in-openstack-nova/Tue, 10 Jun 2025 00:00:00 +0000https://windshock.github.io/en/post/2025-06-10-rce-via-exception-serialization-in-openstack-nova/Theoretical RCE risks in OpenStack Nova's exception serialization via oslo.messaging, with PoC scenarios and defense patterns.https://windshock.github.io/en/post/2025-05-28-endpoint-security-evasion-techniques-20202025/Wed, 28 May 2025 00:00:00 +0000https://windshock.github.io/en/post/2025-05-28-endpoint-security-evasion-techniques-20202025/A technical analysis of how BYOI, BYOVD, DLL hijacking, and service abuse shifted endpoint attacks from EDR bypass to EDR kill between 2020 and 2025.https://windshock.github.io/en/post/2025-05-15-spof-analysis-in-cybersecurity/Thu, 15 May 2025 00:00:00 +0000https://windshock.github.io/en/post/2025-05-15-spof-analysis-in-cybersecurity/Graph-based analysis of Single Points of Failure in cybersecurity, using weighted path enumeration to identify critical infrastructure nodes.https://windshock.github.io/en/post/2025-05-12-cve-cve-2022-24434-dicer/Mon, 12 May 2025 00:00:00 +0000https://windshock.github.io/en/post/2025-05-12-cve-cve-2022-24434-dicer/Mitigation guide for CVE-2022-24434 in the Dicer module affecting Multer and Express, with practical dependency chain fixes.https://windshock.github.io/en/post/2025-05-12-managing-unmaintained-open-source-with-snyk-and-gmail/Mon, 12 May 2025 00:00:00 +0000https://windshock.github.io/en/post/2025-05-12-managing-unmaintained-open-source-with-snyk-and-gmail/Automating Snyk vulnerability alert management with Google Apps Script and Gmail when official API access falls short.https://windshock.github.io/en/post/2025-05-07-ai-insight-vs-human/Wed, 07 May 2025 00:00:00 +0000https://windshock.github.io/en/post/2025-05-07-ai-insight-vs-human/Can AI achieve enlightenment? Exploring the asymmetry between human insight and machine repetition, with technical and philosophical limits.https://windshock.github.io/en/post/2025-04-29-ebpf-backdoor-detection-framework/Mon, 28 Apr 2025 00:00:00 +0000https://windshock.github.io/en/post/2025-04-29-ebpf-backdoor-detection-framework/How eBPF-based backdoors evade traditional detection, and modern frameworks like Tracee and LKRG that counter kernel-level threats.https://windshock.github.io/en/post/2025-04-28-telecom-security-breach-analysis/Mon, 28 Apr 2025 00:00:00 +0000https://windshock.github.io/en/post/2025-04-28-telecom-security-breach-analysis/In-depth analysis of the 2025 SKT breach, telecom authentication mechanisms, and 5G SA vs NSA security architecture differences.https://windshock.github.io/en/post/2025-04-24-cve-2019-17570-apache-xmlrpc/Thu, 24 Apr 2025 00:00:00 +0000https://windshock.github.io/en/post/2025-04-24-cve-2019-17570-apache-xmlrpc/Technical analysis of CVE-2019-17570 deserialization RCE in Apache XML-RPC, with patch comparison and secure implementation guidance.https://windshock.github.io/en/post/2025-04-21-expert-personal-data-report/Mon, 21 Apr 2025 00:00:00 +0000https://windshock.github.io/en/post/2025-04-21-expert-personal-data-report/Analysis of the 2025 KakaoPay breach exposing 40M users' data, and why formal consent fails without AI-based DPIA and civic oversight.https://windshock.github.io/en/post/2025-04-17-theres-no-such-thing-as-a-free-lunch-but-security-was-free/Thu, 17 Apr 2025 00:00:00 +0000https://windshock.github.io/en/post/2025-04-17-theres-no-such-thing-as-a-free-lunch-but-security-was-free/The CVE system nearly collapsed in 2025. Who should fund public cybersecurity infrastructure when free-riding is no longer sustainable?https://windshock.github.io/en/post/2025-04-07-evil-management-manual/Mon, 07 Apr 2025 00:00:00 +0000https://windshock.github.io/en/post/2025-04-07-evil-management-manual/A satirical critique of how AI-era organizations isolate employees through async workflows and data-driven control to suppress solidarity.https://windshock.github.io/en/post/2025-04-03-human-place-in-ai-age/Thu, 03 Apr 2025 00:00:00 +0000https://windshock.github.io/en/post/2025-04-03-human-place-in-ai-age/A philosophical essay on human authorship and creativity in the AI era, declaring the creator's rights over machine-generated output.https://windshock.github.io/en/post/2025-04-01-common-security-myths-developers-tell-themselves/Tue, 01 Apr 2025 00:00:00 +0000https://windshock.github.io/en/post/2025-04-01-common-security-myths-developers-tell-themselves/Debunking developer security myths around responsibility deflection, tech overconfidence, and risk underestimation with real-world examples.https://windshock.github.io/en/post/2025-03-31-dnsmasq-ech-doh-block/Mon, 31 Mar 2025 00:00:00 +0000https://windshock.github.io/en/post/2025-03-31-dnsmasq-ech-doh-block/A hands-on guide using dnsmasq to filter SVCB and HTTPS records for disabling ECH and enforcing central DNS policies. Notes that DoH requires separate network-layer policies.https://windshock.github.io/en/post/2025-03-28-xml-rpc-security-vulnerabilities-analysis-and-mitigation-strategies/Fri, 28 Mar 2025 00:00:00 +0000https://windshock.github.io/en/post/2025-03-28-xml-rpc-security-vulnerabilities-analysis-and-mitigation-strategies/Comprehensive analysis of XML-RPC security flaws including RCE, XXE, and DDoS, with mitigation strategies and a Python PoC exploit.https://windshock.github.io/en/post/2024-11-05-review-of-citrix-security-policy-effectiveness/Tue, 05 Nov 2024 00:00:00 +0000https://windshock.github.io/en/post/2024-11-05-review-of-citrix-security-policy-effectiveness/Citrix administrators apply security policies to each user’s VDI (Virtual Desktop Infrastructure) through Citrix Group Policy. However, certain structural vulnerabilities in Citrix CSE (Citrix Service Engine) and the Citrix VDI Agent allow for potential bypassing of these security policies.https://windshock.github.io/en/post/2024-06-20-kpi-causes-accidents/Thu, 20 Jun 2024 00:00:00 +0000https://windshock.github.io/en/post/2024-06-20-kpi-causes-accidents/Real cases where manipulated KPI metrics led to cybersecurity incidents, exposing the dangers of metric-driven security management.https://windshock.github.io/en/post/2024-06-16-common-misconceptions-of-security-assessors/Sun, 16 Jun 2024 00:00:00 +0000https://windshock.github.io/en/post/2024-06-16-common-misconceptions-of-security-assessors/Three common misconceptions that weaken security assessments and strategies to build repeatable, effective vulnerability evaluation.https://windshock.github.io/en/post/2024-05-22-can-development-culture-influence-security-levels/Wed, 22 May 2024 00:00:00 +0000https://windshock.github.io/en/post/2024-05-22-can-development-culture-influence-security-levels/Exploring how development culture shapes code security, with practical examples using static analysis tools like Joern.https://windshock.github.io/en/post/2023-04-27-bypassing-citrix-policy-is-not-a-vulnerability-but-it-can-be-a-violation-of-the-law/Thu, 27 Apr 2023 00:00:00 +0000https://windshock.github.io/en/post/2023-04-27-bypassing-citrix-policy-is-not-a-vulnerability-but-it-can-be-a-violation-of-the-law/How Citrix VDI policies can be bypassed via registry manipulation—a legal risk analysis with detection and mitigation strategies.https://windshock.github.io/en/post/2023-04-18-strengthening-cybersecurity-through-government-ngos-and-bug-bounty-programs/Tue, 18 Apr 2023 00:00:00 +0000https://windshock.github.io/en/post/2023-04-18-strengthening-cybersecurity-through-government-ngos-and-bug-bounty-programs/How government NGOs and bug bounty programs strengthen cybersecurity, with insights on security taxes and public-private collaboration.https://windshock.github.io/en/post/2019-09-03-security-threats-and-mitigation-strategies-for-java-reflection/Tue, 03 Sep 2019 00:00:00 +0000https://windshock.github.io/en/post/2019-09-03-security-threats-and-mitigation-strategies-for-java-reflection/The **Java Reflection API** is a powerful tool that allows dynamic manipulation of classes, methods, and interfaces at runtime. However, due to its flexibility, it introduces significant security risks, as attackers can exploit it to gain unauthorized access to systems. In this article, we will explore the security threats posed by Java Reflection and outline strategies to mitigate these risks.https://windshock.github.io/en/post/2019-08-08-about-the-xssaudit/Thu, 08 Aug 2019 00:00:00 +0000https://windshock.github.io/en/post/2019-08-08-about-the-xssaudit/Why Google removed XSSAudit from Chrome and what it means for web security—analyzing the shift from XSS filters to CSP.https://windshock.github.io/en/about/Mon, 01 Jan 0001 00:00:00 +0000https://windshock.github.io/en/about/This site tracks how security findings become durable change across code, method, and governance.