A notebook, kept open.*

A creator campaign escaped into a globally cached homepage module. The session cookie could not be read, but every authenticated request the injected script made still carried it.

A mobile app's link-preview endpoint followed one redirect into localhost, reached an internal screenshot service, and turned a blocked SSRF into remote command execution.

I signed a SAML login for one test workspace and arrived as an administrator in another. Every cryptographic check passed. The application had forgotten to ask which company trusted the key

I fine-tuned a 6.7B language model without changing the 6.7B parameters. LoRA turned behavior into a tiny patch — and made the dataset look uncomfortably like source code.

A fictionalized writeup of the best bug I ever found: an 'export to PDF' feature that, five hops later, was running my code inside someone else's cluster. Target anonymized, chain real-in-spirit.

ChatGPT is ten days old, a million people signed up in five, and my mother has opinions about it. Some notes from someone who's been poking this exact bear since 2020 — on what's actually new, what I got right, and the miss I want on the record.

The weights are public, my GPU is warm, and I spent three weekends on a tiny game where one model writes the rooms and another draws them. The hard part isn't generation. It's agreement.

A daydream. Today I can ship a physics toy where you fling yourself up a tower. But I keep sketching the game I can't build yet — the one where the characters actually understand you

GPT can't actually hold a hidden word in mind — so I built the version of twenty questions where that's not cheating, it's the rules. John Wheeler got here first.

Don't give the model hands — give it a pen. A pipeline where GPT writes Kubernetes and Terraform changes as PRs that must survive a mechanical gauntlet before a human ever sees them

I built a living-room game over the holidays — everyone answers a question, one answer is a language model, find it. Tuning the bot to survive taught me what 'sounding human' actually means

Wiring davinci between Alertmanager and Slack — six weeks of a language model reading my logs at 3am, with a built-in lie detector

GPT-3 API access finally arrived, so the commit-message benchmark of exactly one silly task gets its rerun

A guide to building small production systems where every upgrade is a swap, not a rewrite

Putting the whole stack in Terraform, then proving it by deleting the server — plus the difference between Terraform and Kubernetes everyone glosses over

Migrating my little stack from Swarm to lightweight Kubernetes, and the mental model that finally made K8s click

Reading the GPT-3 paper, waiting for API access, and rethinking what fine-tuning is even for

The GPT-2 commit hook failed exactly as promised, so I turned it around

Fine-tuning GPT-2 small on 3,000 of my own git commit messages, with predictable results

Running OpenAI's GPT-2 locally with the Hugging Face transformers library

Configure Docker Swarm and run image from AWS ECR

Building a React App as a widget using WebPack