Posts

The same check-then-act race keeps appearing across services: purchase-limit bypass, one draw used by many requests, duplicate coupon cancellation, daily-reward overruns. I built a real stack (nginx + Tomcat×2 + shared Postgres + Redis) and measured which fix actually holds. Most of them need no Redis lock — just a DB conditional UPDATE and an affected-rows check.

Algorithm names like AES-256 or TLS reveal nothing about how keys are generated, who controls the endpoint, or whether a response binds to the real transaction. A broader, evidence-based assessment model for external SDKs and native binaries.

A malicious server corrupting a client that dials out to it, carrying both the libc leak and the second stage over one already-open socket in a single ROP chain. And why this is not a new pattern but a well-known composition.

Bringing world-class hackers and a CTF research ecosystem into an organization can make it stronger, but real security improvement requires turning offensive capability into governance and structural change.

A practical method for modeling vulnerabilities as attacker-relevant security state transitions and combining human intuition with bounded AI search

Package and container registry proxies are active trust boundaries for AI runtimes. This report turns incident evidence, public SSRF history, and runtime observations into an artifact egress control architecture.

In practical cryptography, failures often occur in the design—combining randomness, key management, operating modes, error handling, and authentication—rather than in the algorithms themselves. This post outlines criteria for auditing cryptographic implementations from the perspective of security assessors and reversers.

This article explains how I split an XSS security development specification for small local models into core/verify/dev/test overlays, and what I learned while connecting LLM-based judgment to regression-test generation and Jazzer/Jazzer.js fuzzing seeds.

A reading of Korea’s 2025 whole-of-government information protection plan through the structural parallel between the Nightingale myth and the white-hacker discourse. Policy is moving from dependence on individual ethics toward structural accountability, but the transition is not complete.

Through the Nightingale myth, the white-hacker discourse, the Sterbenz lemma, and browser exploit reasoning, this essay argues that the real change LLMs bring lies not in knowledge retrieval but in problem reframing.