security

• A Memory Budget on Two Small Machines: a DarkFi Node from sled to fjall

  Part three of the DarkFi Pi. The memory lessons of running DarkFi nodes on a Raspberry Pi and a rented 4 GB server: what the node took under sled and what it takes under fjall, what a full sync costs, twenty-one allocator runs, what both machines run now, and darkscope, the open tool all of it was measured with.

  10/2/2026 · 25 min

• Study notes on Linux fundamentals: setuid and capabilities with ping

  As the first part of this series of study notes, I am exploring a very simple concept: why ping does not need sudo, what capabilities are and why they are a fundamental feature in Linux.

  9/19/2026 · 7 min

• The Node That Killed Its Own Host — cgroups, Sled, and a 2.3 GB Miner on 8 GB of RAM

  Part two of the DarkFi Pi: the node grew to 4.5 GB and was taking the host down with it. Notes on why the memory limits I wrote were ignored, why swap made it worse, how the OOM fight corrupted the database, and what a RandomX miner really costs.

  7/14/2026 · 20 min

• Reverse-Engineering a North-Korean-Style Supply Chain Attack Delivered via Fake Web3 Job Interview

  Full forensic analysis of a targeted supply chain attack delivered through a fake Web3 job interview. A single npm install silently deployed a two-stage RAT: an initial loader that decrypts a second-stage C2 endpoint, exfiltrates the full process environment, and maintains a persistent TCP beacon on port 1224 awaiting operator commands. I got targeted, responded in 45 minutes, then reproduced the entire attack chain in an isolated Hetzner VM and captured the complete C2 protocol.

  4/15/2026 · 30 min