DEV Community: v. Splicer

I Googled Myself for 20 Minutes and Found My Home Address, My Mom's Maiden Name, and My Dog

v. Splicer — Sat, 29 Aug 2026 11:56:02 +0000

I thought I was careful. I use a password manager. I have 2FA on everything. I do not post my address. I do not do those Facebook quizzes that tell you which kind of bread you are and then steal your identity.

I am not careful. None of us are. We are just confident.

So I set a timer for 20 minutes. No special tools. No dark web logins. No shady people search sites that want $19.99 to tell you what you already know. Just Google, a fresh browser profile, and the rule that I could only use information that started from my name and what that information led me to.

I found my current home address in minute three. My mom's maiden name in minute nine. My dog's name, vet, and a photo of him at the park in minute fourteen. By minute twenty I had a map that would let a stranger answer my bank security questions, reset a password, and show up with a Milk-Bone and know exactly what to call him.

This is not because I am famous. It is because identity is not a single secret anymore. It is a graph. And yours is public.

Minute zero to three: you already leaked your address
I started with my name. Lusynth Oritrant. Uncommon enough that Google does not get confused. First page: my GitHub, my old portfolio from 2019 that I thought I deleted, and a county assessor site.

The county assessor site is my favorite kind of horror. You type a name into a boring government website with a design from 2004 and it gives you parcel number, purchase date, sale price, square footage, and mailing address. All public record. All indexed by Google because counties love SEO for some reason.

I did not need to log in. I did not need to pay. I clicked images and there was the front of my house from the last tax assessment. The same house I was sitting in while I was Googling myself.

If you rent, you think you are safe. You are not. I searched my name plus my city and got a data broker page that listed my current address, two previous addresses, and three people associated with those addresses. One of them was my roommate from two apartments ago. The data broker scraped it from a utility record and a voter registration roll. It was wrong about my middle initial but right about where I live.

Most people stop here and think, okay, address is out there. Whatever. But address is a key. Address unlocks everything else. Your address connects to your property records, your voter file, your Amazon wish list if you ever shipped to your own name, your home Wi-Fi name in Wigle if you ever left your router on default.

I wrote down address on a sticky note. That was node one.

Minute three to nine: your family is a public API
How did I get my mom's maiden name. I did not know it off the top of my head for a second. Then I remembered I posted it.

In 2017 I posted a graduation photo on Facebook. Caption: "Thanks to my amazing mom [First Name] [Maiden Name] [Married Name] for everything." I tagged her. Her profile lists her maiden name because her generation actually fills out Facebook profiles. Her friends list is public. Her brother's obituary is public and lists all the family members by name including my mom with both names, plus my name.

Obituaries are OSINT gold and nobody thinks about them. They list mother, father, siblings, children, grandchildren, where they lived, what church they went to. They are meant to be public and respectful and they are incredibly efficient at linking family graphs.

I also found it via Ancestry. Someone in my extended family made a public family tree. It had my mom, her parents, her maiden name, my grandmother's maiden name, birth years, death years. It had a photo of my great-grandparents that I had never seen. It is sweet. It is also exactly what a bank asks for when you click "forgot password."

I did not need to hack Ancestry. Google indexed the tree because the creator left it public. I clicked view, and there it was.

You think security questions are private. They are not. They are trivia about a family that loves to overshare at reunions. What was your first pet. What street did you grow up on. What is your mother's maiden name. All of that is answerable from public posts, especially if your mom is on Facebook.

Minute nine to fourteen: the dog
This is my favorite part because it is so stupid and so human.

I found my dog because I love my dog. I post my dog. Everyone posts their dog. My Instagram, even though it is mostly code and boards, has three photos of him. One of them tags the dog park. One of them tags the vet because I was grateful they stayed late.

The vet's Instagram reposted my story and tagged me. Their post says "Thanks to Lusynth and [Dog's Name] for being such good patients!" Now a stranger knows my dog's name.

Why does that matter. Because your dog's name is a password. It is a security answer. It is how someone pretends to know you. Imagine a DM: "Hey, is this Lusynth, [Dog's Name]'s mom from [Dog Park Name]? I think I found his collar." You would answer. I would answer. We would answer because we love our dogs more than we love opsec.

From the dog park tag, I found a geotagged photo from another person at the same park on the same day. Their photo has my dog in the background. Their caption lists the time. Now you have my routine. Saturday mornings, around 9am, at that park.

I did not need a Ring camera. I needed a hashtag.

Minute fourteen to twenty: the rest of the graph
Once you have address, family, and pet, the rest is just connecting edges.

My old breached email from 2019 showed up on HaveIBeenPwned. That breach had my old password that I reused on a forum in 2016. That forum profile listed my birthday. My birthday plus my name got me a voter record with full DOB, party affiliation, and precinct.

My GitHub commits from 2020 had my personal email in the git config. That email was used on a Strava account. Strava had a public run that started and ended at my house. The map literally drew a line from my front door around the block and back. I had set it to private last year, but the old one was still public because I forgot.

My Amazon wish list was public until last year. It had a baby shower gift for a friend shipped to my address with my full name. My Venmo was public until I changed it. You could see who I paid for pizza and who paid me for rent.

None of this required skill. It required clicking. This is what 20 minutes looks like when you are not even trying. If I gave myself two hours and $5 for a data broker report, I could build a full identity package: full name, DOB, address history, phone numbers, relatives, emails, usernames, employer, salary range estimate, and enough security answers to get through most call centers.

And I am a developer who thinks about this stuff. Imagine what is out there for someone who has had Facebook since 2008 and has never touched a privacy setting.

The problem is not that you posted. The problem is you never mapped it.
We treat privacy like hiding. Do not post your address. Do not post your birthday. Do not post your dog. That advice is useless because privacy is not about one secret post. It is about the graph you create over ten years without realizing it.

Your identity is not a password you can change. It is a set of nodes: names, addresses, emails, phones, family members, pets, jobs, places you go, things you buy. And edges: your mom is connected to you, your dog is connected to your vet, your address is connected to your voter file, your GitHub email is connected to your Strava.

Companies map this graph every day to sell you things. Attackers map it to scam you. You have never mapped it for yourself.

That is what I finally did after my 20 minutes of mild existential dread. I stopped trying to delete myself, which is impossible, and started trying to map myself.

I made a simple canvas. In the middle, me. Around me, categories: Legal Identity, Homes, Family, Work, Accounts, Purchases, Locations, Pets and Personal. Every time I found something connected to me, I added it as a node and drew a line showing how I found it. County site to address. Address to Amazon. Obituary to mom's maiden name. Vet tag to dog.

After an hour, it was a mess. After two hours, it was a map. And a map is actionable. You can see which nodes are bridges. My old portfolio site was a bridge that connected my name to my personal email to my GitHub to my Strava to my house. One old site. Take that down, or at least remove the email, and four edges disappear.

You can see which security questions are burned. My mom's maiden name is burned. My first pet is burned. My dog's name is burned. So I stopped using them anywhere. I changed my security questions to random strings in my password manager.

You can see which data brokers have you and which ones actually respect opt-outs. You can see that your voter record is public and you cannot delete it, but you can change your threat model around it.

This is the entire idea behind my second guide, PERSONAL ATTACK SURFACE: Map Everything Connected to Your Identity.

It is not a guide about how to disappear. If you live in the US, you cannot disappear without moving to the woods and even then the woods have property records. It is a field manual for how to build your own identity graph, just like I did in that 20 minutes, but properly.

It gives you the categories to check, the public records that actually matter, the breach sources to search for yourself, the social media traps that leak routine, the way to document it so you can see the bridges, and the prioritized list of what to fix first that actually reduces risk instead of just making you feel paranoid.

It includes templates for the map, checklists for opt-outs that work, and scripts for what to say when a call center asks for your mother's maiden name and you know that answer is public.

I found my home address, my mom's maiden name, and my dog in 20 minutes with Google. A scammer with motivation and a full afternoon would find more.

Map it before someone else does.

Your AI Coding Agent Is Probably Wasting Half Its Context Window

v. Splicer — Sun, 23 Aug 2026 10:42:09 +0000

It is three in the morning. The glow of your monitor is the only light in the room. You are staring at a terminal window, watching your AI coding agent confidently rewrite a function you just asked it to fix. The problem is that the new function breaks three other modules. You scroll up in the chat history. The agent is suffering from digital dementia. It has completely forgotten the architectural constraints you established four hours ago.

You sigh and start typing a new prompt, trying to remind it of the rules. But deep down, you know the truth. Your AI is not failing because it lacks intelligence. It is failing because it is drowning in its own memory.

We treat context windows like infinite hard drives. We dump entire repositories, massive documentation files, and sprawling chat histories into the prompt, expecting the model to perfectly synthesize it all. But a context window is not a database. It is an attention mechanism. And attention is a finite, easily diluted resource.

If you are using an AI coding agent and feeling like you are constantly fighting it, I have bad news. Your agent is probably wasting half its context window on digital garbage. Let us fix that.

The Illusion of Infinite Context

To understand the problem, we have to understand how these models actually read. When you feed a large language model a massive codebase, it does not store it in a neat little folder in its brain. It processes every single token with equal initial weight. The attention mechanism then tries to figure out which tokens matter for the current prediction.

When your prompt is ninety percent irrelevant boilerplate, legacy code, and outdated chat logs, the model has to spend massive computational effort filtering out the noise. The signal to noise ratio plummets. The model starts hallucinating because it is trying to connect dots that are not actually there, distracted by the thousands of tokens of noise surrounding the few tokens of actual signal.

This is context rot. It is the silent killer of AI assisted development. You are not getting stupid outputs because the model is dumb. You are getting stupid outputs because you fed it a diet of junk data and expected a Michelin star meal.

Context Hygiene and Cleaning the Desk

The first step to fixing this is treating your context window like a physical workspace. Imagine trying to build a complex mechanical watch on a desk covered in old pizza boxes, unpaid bills, and tangled wires. You would go crazy. Your AI is experiencing the exact same cognitive overload.

Context hygiene means ruthlessly pruning your prompt environment.

Start by clearing the chat history. Most AI coding tools allow you to start a new session or compress previous messages. Do not be afraid to hit the reset button. If you are moving from a frontend styling task to a backend database migration, start a fresh chat. The context of the frontend task is now just noise.

Next, summarize and archive. Before you clear a long chat session, ask the AI to generate a comprehensive summary of the decisions made, the files touched, and the current state of the project. Save that summary in a markdown file. When you start the new session, you feed it that crisp, high signal summary instead of the ten thousand token transcript of your previous struggles.

This is a core principle we emphasize in the AI Automation Playbook. Automation is not just about letting the machine run blindly. It is about curating the environment so the machine can run flawlessly. Clean the desk before you build the watch.

Repo Maps and Spatial Awareness

Here is a secret about AI coding agents. They have no spatial awareness. They do not know what your project looks like. They only know the specific files you happen to shove into the prompt. It is like giving a brilliant architect a single brick and asking them to design a cathedral. They can tell you about the brick, but they have no idea where the walls should go.

You need to give your AI a map.

A repo map is a high level, text based representation of your project structure. It is not just a raw directory tree. A raw directory tree is useless noise. A repo map includes the directory structure along with brief, one sentence descriptions of what each folder and key file does.

Create a file called REPO_MAP.md at the root of your project. Structure it with clear headings for your main directories. Under the components folder, note that it holds React UI components, mostly presentational. Under the hooks folder, note that it holds custom React hooks for state and side effects. Under the api folder, note that it holds Axios instances and endpoint definitions.

When you start a new task, you do not need to feed the AI the entire map. You just tell it to read the map first. This gives the model a spatial anchor. It suddenly understands the topology of your project. When you ask it to create a new authentication hook, it knows to look in the hooks directory and use the api utilities, rather than inventing a new folder structure out of thin air.

This exact technique is a foundational chapter in the Claude Code Playbook. We teach developers that giving the AI a sense of place reduces hallucinated file paths and redundant code by an order of magnitude. It transforms the AI from a blind typist into a spatially aware engineer.

Scoped Prompts and Micro Tasking

Developers love to be ambitious. We want to type one massive prompt and watch the AI build an entire feature end to end. We ask it to update the database schema, write the API routes, and build the frontend components all in one go.

This is a massive waste of context.

When you ask for too much, the AI has to hold the architectural plan for the entire feature in its active context while it writes the code. By the time it gets to the frontend components, it has forgotten the specific constraints of the database schema it wrote five minutes ago. The context window fills up with its own intermediate reasoning, leaving no room for actual execution.

You need to embrace scoped prompts. Break the massive feature into micro tasks.

Task one. Write the database migration script. Once that is done and verified, clear the context or summarize it.
Task two. Write the API routes based on the new schema.
Task three. Build the frontend components.

By scoping the prompt, you keep the signal to noise ratio incredibly high. The AI only has to hold the context for one specific, well defined task at a time. It can dedicate all its attention to writing perfect code for that single task, rather than spreading its attention thin across an entire feature. You become the conductor, and the AI becomes the section leader.

Scratch Files and Thinking Out Loud

Sometimes, a problem is just too complex to solve in a single pass. The AI needs to think. But if it thinks inside the main chat window, that thinking process consumes valuable context tokens.

Enter the scratch file.

A scratch file is a dedicated markdown or text file where the AI can plan its approach before writing actual code. When you give the AI a complex task, your first prompt should not be to write the code. Your first prompt should be to write a plan in a file called SCRATCH.md.

Tell the AI to outline the steps it will take, list the files it needs to modify, and identify potential edge cases. Let it write this plan out loud in the scratch file.

Once the plan is written, you review it. You correct any flaws in its logic. Then, you tell the AI to execute the plan, referencing the scratch file.

This separates the reasoning phase from the execution phase. The reasoning phase is dense and token heavy. By offloading it to a persistent file, you free up the active context window for the actual code generation. If the AI gets stuck later in the execution phase, it can always refer back to the scratch file to remember its original strategy. It is the digital equivalent of letting an engineer sketch on a whiteboard before they start welding.

This is the kind of deep workflow optimization we build into OpenClaw. OpenClaw is designed to handle these complex, multi step agent workflows without losing its mind. It manages the scratch files, the repo maps, and the context pruning automatically, allowing you to focus on the high level architecture while the agent handles the tactical execution. It turns the messy reality of AI coding into a streamlined, predictable pipeline.

The Philosophy of the Machine

Let us zoom out for a moment. Why does any of this matter? Why should we care about the internal mechanics of a context window?

Because the way we treat our AI agents reflects how we view the future of software development.

If we treat the AI like a magic oracle that can just absorb everything and spit out perfect code, we will be constantly disappointed. We will end up writing more boilerplate to fix the AI mistakes than we would have just writing the code ourselves. We become mere reviewers of bad code, trapped in a cycle of prompt and pray. We lose our agency to the machine because we refuse to guide it properly.

But if we treat the AI like a highly capable, incredibly fast, but fundamentally literal junior developer, everything changes.

A junior developer does not know the entire codebase on day one. You have to onboard them. You have to give them clear, scoped tasks. You have to give them a map of the project. You have to let them write out their plans on a whiteboard before they touch the keyboard.

When you apply these human onboarding techniques to an AI, the results are magical. The code it produces is cleaner. The architecture it respects is sound. The hallucinations drop to near zero.

We are standing on the edge of a new era in computing. The tools we are building today are not just compilers or interpreters. They are cognitive partners. They are mirrors reflecting our own clarity of thought. If our instructions are muddy, their output will be muddy. If our context is polluted, their logic will be polluted.

But when we achieve context hygiene, when we build proper repo maps, when we scope our prompts and let the machine think in scratch files, we unlock something profound. We achieve a true symbiosis. The human provides the vision, the architecture, and the taste. The machine provides the speed, the syntax, and the relentless execution.

So look at your terminal. Look at the sprawling, messy chat history. Look at the giant, unstructured prompts you have been sending.

Clean it up. Give your agent a map. Scope the task. Let it think.

You might just find that the AI you thought was wasting half its context window was actually waiting for you to clear the desk so it could finally build the watch.

SPI, I2C, UART: How To Trigger On What Matters Instead Of Drowning In Noise

v. Splicer — Mon, 17 Aug 2026 14:41:17 +0000

If you have ever opened Saleae Logic or PulseView and stared at 40 seconds of SPI at 8MHz, you know the feeling.

It is all noise until you know what to trigger on.

Your logic analyzer is not a microscope. It is a filter. Most people use it like they are trying to drink from a firehose. Open capture, zoom in, scroll for an hour, miss the one byte that mattered.

I did that for a year. Then I started scripting triggers. Now my analyzer finds hardcoded keys, debug shells, and backdoor boot modes while I make coffee.

This is how you stop drowning and start triggering on what matters. On your own hardware, in your own lab. SPI, I2C, UART — the three buses that run every smart device you own.

The Problem Is Not Capture, It Is Intent

A logic analyzer at 24MHz capturing 4 channels for 10 seconds gives you 240 million samples. You cannot manually read that. You need intent.

A trigger is intent expressed as code: "wake me up when this pattern happens, and ignore everything else."

Without triggers, you are doing archaeology. With triggers, you are doing detection engineering.

Here are the recipes I actually use when I reverse my own devices. All of these run on a $20 analyzer and some Python. No fancy gear needed.

UART: Where Devices Confess When They Think No One Is Listening

UART is where firmware gets chatty. Boot logs, debug shells, panic messages. Every device has a story it tells at 115200 baud when it thinks no one is listening.

The noise problem with UART is that it never shuts up. Boot is 2 seconds of spam, then silence, then random chatter. You scroll and miss the 200ms window where it says Press any key for shell.

Trigger Recipe 1: Trigger on Boot String, Not on Time

Don't trigger on start. Trigger on string.

You know your device prints U-Boot or BootROM or ESP-ROM on boot. Set your trigger to watch the RX line for that ASCII sequence.

In Saleae automation or PulseView Python, it looks like this in pseudo:

wait_for_string("U-Boot")
capture_next(2 seconds)

Now you never miss boot. Power cycle the device, your analyzer automatically captures the next 2 seconds after it sees the boot string. I caught a smart plug that only exposed a root shell for 400ms after U-Boot, then locked it. Without a string trigger, I would have scrolled past it 100 times.

This is also how you catch secrets. Set triggers for:

password:
login:
shell
debug
AT+
###

If your own device prints password: on UART during boot, that is a hardcoded creds waiting to happen. I found three last month in thrift store gear.

If you are trying to free your ESP32 from Arduino and actually see what the ROM bootloader says before your code runs, bare metal helps here. When you own startup, you own what UART prints. The path I took to own that startup without the IDE is in ESP32 Bare Metal Firmware. It makes UART debugging honest again.

Trigger Recipe 2: Trigger on Baud Change

Cheap devices switch baud mid-boot. 74880 to 115200 on ESP8266, 115200 to 921600 on some routers. If you only watch one baud, you miss half the conversation.

Script a trigger that detects framing errors. When you see 5 framing errors in a row, auto-switch baud and re-decode. That is how you catch the bootloader that hides at a weird baud on purpose.

I2C: The Quiet Gossip Bus

I2C is slow and polite. Two wires, many devices, all gossiping about addresses.

The noise problem with I2C is address spam. Your temperature sensor talks every second, your fuel gauge talks every second, your PMIC talks every second. You get thousands of identical transactions.

What matters is not the spam. It is the anomalies.

Trigger Recipe 3: Trigger on Address You Did Not Expect

Scan your bus once, write down all addresses you expect: 0x48, 0x6B, 0x50. Now script:

trigger_if_address != [0x48, 0x6B, 0x50]

I did this on a smart lightbulb I was auditing. It had an extra I2C EEPROM at 0x57 that was not on the schematic. That EEPROM held WiFi creds in plaintext and a cloud token. The manufacturer added it for factory testing and forgot to remove it. The only way to find it was to trigger on "address I did not expect."

Trigger Recipe 4: Trigger on NACK or Clock Stretch

NACK means someone tried to talk to a device that is not there, or a device that is locked. Clock stretching means a device is stalling because it is doing crypto or is bricked.

Set triggers for:

NACK after address byte -> someone is probing for hidden devices
NACK after data byte -> write protected EEPROM
Clock stretch longer than 5ms -> device doing crypto, possible secure element

This is how I found a secure element on a smart lock that was holding the master key. It stretched the clock for 22ms during authentication. That stretch was the tell that it was doing real work. Without a trigger on stretch, I would have seen it as just slow I2C.

SPI: Where Firmware Lives And Secrets Get Dumped

SPI is where firmware lives. If UART is confession, SPI is the diary.

The noise problem with SPI is speed and volume. 8MHz, 4 lines, 10 seconds of capture is gigabytes. You cannot manually find where the flash read ends and the real secrets start.

Trigger Recipe 5: Trigger on Flash Read Command

Almost all SPI flash uses command 0x03 for read. Every boot, the chip reads from address 0x0.

Trigger on:

MOSI first byte == 0x03

Capture the next 256 bytes. Now you have the bootloader without capturing 10 seconds of garbage. You just triggered on the exact moment the device reads its own firmware.

This is the first step to non-destructive dumping. You watch how the device reads its own flash, then you replicate it with a clip. You learn the flash size, the read command it uses, whether it uses quad SPI. All without touching the chip.

I learned this by bricking two devices trying to dump them blind. Now I watch first, then dump. The full safe method — watching first with a logic analyzer, then clipping — is in Shadow Catalog. It is about reading firmware without killing the board.

Trigger Recipe 6: Trigger on High Entropy Data

This is the money recipe.

Most SPI traffic is low entropy — code, configs, repeated values. Secrets are high entropy — keys, tokens, random.

Script a trigger that calculates entropy of MISO payloads in real time. If entropy > 7.5 for 32 bytes, capture it.

I used this on a Zigbee gateway. Normal traffic: low entropy. Then every boot, 32 bytes of high entropy at address 0x7F000. That was the Zigbee network key. Stored in plaintext in external flash. Found automatically because I triggered on entropy, not on address.

Trigger Recipe 7: Trigger on Write Enable + Write

Flash write is 0x06 (WREN) followed by 0x02 (PP) or 0x20 (SE). If you see 0x06 -> 0x02 in your capture, the device is writing to flash. That is where it stores your WiFi password, your token, your calibration.

Trigger on that sequence and capture the payload. That payload is often your secret, stored in plaintext.

How To Chain Them Into An Automated Pipeline

One trigger is a filter. Three triggers chained is a vulnerability discovery pipeline.

My pipeline for any new thrift store device I bring into my lab:

UART string trigger on boot -> capture boot log -> parse for password, shell, debug
I2C anomaly trigger -> find hidden EEPROMs -> dump their content
SPI entropy trigger -> find keys -> check if they are hardcoded

This runs automatically. I plug in the device, power it, my analyzer scripts capture, parse, and spit out a report: "Found UART shell prompt at 0.8s, found I2C device at 0x57 not in baseline, found high entropy blob at SPI address 0x7F000."

That report used to take me 3 hours of manual scrolling. Now it takes 4 minutes. The analyzer does the boring part. I do the interesting part — reading the secret.

I turned that pipeline into a set of reusable trigger scripts. If you want the actual Python for Saleae and PulseView — the entropy trigger, the baud auto-switch, the NACK hunter, the flash read sniffer — I put them in Logic Analyzer Trigger Scripting. It is not about the analyzer, it is about making the analyzer find vulns while you sleep.

And if you want to build devices that deserve this kind of analysis — bare metal firmware that does not leak secrets over UART and does not store keys in plaintext in external flash — that is the bare metal path. Arduino hides these problems. Bare metal forces you to confront them. Notes on that path are in ESP32 Bare Metal.

Stop Collecting Captures, Start Collecting Triggers

A 10GB capture file is not impressive. A 5-line trigger that finds a hardcoded key automatically is impressive.

Think like a detection engineer, not a hoarder.

What string would a debug shell print?
What address would a hidden EEPROM use?
What entropy would a key have?
What command would a flash write use?

Write a trigger for that question. Let the analyzer answer it.

Your lab does not need a more expensive analyzer. It needs better questions.

Build a library of triggers. Reuse them. My current library has 23. I bring them to every new device like a lockpick set. Most devices open in the first 3.

The rest is just dumping and reading. And for that, you need a clip, not a prayer. Safe dumping method is in Shadow Catalog if you want to read the firmware you just triggered on without bricking the board.

Stop staring at squiggles. Make the squiggles tell you when they are lying.

I teach hardware to be honest.

If your analyzer is just scrolling, you are doing it wrong:

If you drown in noise → Logic Analyzer Trigger Scripting: Automated Vuln Discovery — 23 trigger recipes, Python scripts for Saleae / PulseView, entropy, NACK, baud switching.

If you want firmware that does not need triggers to hide its mistakes → ESP32 Bare Metal Firmware — escape Arduino, own startup, own sleep, own peripherals.

If you want to read the firmware you just found → Shadow Catalog: Firmware Dumping Without Bricking — non-destructive dumping order, voltage checks, clip method.

All on my Gumroad. Capture less, trigger more.

Threat Model Your Apartment Like You Threat Model Your Laptop

v. Splicer — Sat, 15 Aug 2026 21:36:25 +0000

Your threat model has a hole shaped like your house.

You run endpoint protection on your Mac. You have 2FA, passkeys, hardened browser, DNS filtering. You would never install random software from a forum.

Then you walk into your living room that has 14 always-on microphones, 6 cameras, 3 devices that map your floor plan, and a router you have never audited, all running firmware you have never read.

We need to talk.

In cybersec we threat model laptops. We never threat model apartments. That is backwards. Your laptop leaves your house. Your house never leaves. If your home is compromised, every device you bring into it is compromised by proximity.

Here is how I started threat modeling my apartment the same way I threat model my infra. It takes an afternoon and it will make your home actually sovereign.

Step 1: Draw Trust Zones, Not Floor Plans

Stop thinking in rooms. Start thinking in trust zones, exactly like network segmentation.

I use 3 zones:

Zone 0: The Dead Room. One room where no device can listen, watch, or transmit. No smart anything. No WiFi. No Bluetooth. This is where you think, talk for real, and store sensitive hardware. My bedroom is Zone 0. Nothing with a mic crosses the door. It has a mechanical door sweep and a faraday pouch for phones.

Zone 1: The Clean Network. Your own network that you control. Your router, your Pi-hole, your own hotspot. Devices you have audited. This is where your work laptop lives. It never touches landlord WiFi, coffee shop WiFi, or that free "Apartment_5G" that is actually a $30 camera streaming 24/7.

Zone 2: The Dirty Periphery. Everything else. Landlord's smart lock, smart thermostat, package room cameras, your smart TV, robot vacuum, Alexa, LED strips with mics, that random air freshener that is plugged in at waist height. Assume Zone 2 is hostile and logs everything.

Most people live entirely in Zone 2 and call it cozy. That is why they get doxxed by their own house.

If you want the full build for a Zone 0 room, what to rip out, what to block, how to make a bedroom that is truly dead for under $200, I documented it in THE FARADAY ROOM: Your Home Is Listening. That guide is your Zone 0 manual.

Step 2: RF Sweep — Find What Is Talking

Your apartment is loud. You just cannot hear it because it talks on frequencies you cannot hear.

An RF sweep is how you listen.

You need two things: your phone flashlight and a $25 to $35 RF detector from Amazon. No fancy SDR needed for the first pass. The cheap one beeps when something near it is transmitting on Bluetooth, WiFi, or cellular.

Here is the 10 minute sweep I run in every rental and every Airbnb:

1. Kill the lights. Close curtains. Turn on your phone flashlight and hold it next to your eyes. Slowly scan for tiny lens reflections. Camera lenses reflect even when hidden in black plastic. Check smoke detectors directly over the bed, alarm clocks, air purifiers, TV bezels, and any small black box facing the bed.

2. Power down your own noise. Turn off your phone Bluetooth and WiFi for 60 seconds. This drops your own baseline so the detector does not scream at your own Apple Watch.

3. Walk the walls. Hold the RF detector near outlets, power strips, smoke detectors, mirrors, picture frames, vents, thermostats. If it screams near a "dumb" object like a picture frame or a smoke detector that should not transmit, you found something that is talking when it should be silent.

I have found an AirTag taped inside a couch from a previous tenant, a fake USB charger with a camera module, and a smart thermostat that was transmitting even when I had "disabled" its WiFi. All with a $27 tool.

RF is layer 1 of home threat modeling. If you skip it, you are doing compliance, not security.

Once you know what is talking, you need to know what network it is talking on. That is step 3.

Step 3: Network Inventory — What Is Actually On Your WiFi?

Open a network scanner like Fing. Connect to your apartment WiFi and scan.

You should see your phone, your laptop, maybe your TV. If you see 12 devices and you only own 3, you have neighbors piggybacking or you have hidden devices streaming.

Now check the SSIDs around you. You are looking for weird names: "HD_Cam_02", "WIFI_CAM", "Apt_3B_Security", or a second network with the same name as yours but with "-cam" appended.

The sophisticated version of this is a callback test. This is where I use a Specter Box.

A Specter Box is a tiny $17 drop box I built that phones home when it gets power. It is the size of a USB charger. You plug it into an Ethernet port behind the TV in your rental, or into an outlet, and it wakes up, connects, and sends a POST to a server you own: "I am alive, I am on this SSID, this is my IP, this is how many other devices I can see."

It is not for spying on other people. It is for auditing your own network that you pay for. I left one in my own coworking space with permission, it phoned home 6 hours later from a different desk. Someone had picked it up and plugged it in. That is all the proof you need that physical security is not real.

If you run your own lab or you are allowed to test your office, this is the cheapest physical pen test you will ever run. The full parts list, callback server, and battery mod that keeps it alive for 18 days is in SPECTER BOX: The $17 Drop Box That Phones Home.

For home threat modeling, network inventory answers one question: is your apartment's network trustworthy enough to put your laptop on? Most rentals fail this test.

The fix is simple: never trust rental WiFi. Run your own hotspot through a travel router you control. My full self-hosted comms and hotspot stack is in THE DEAD DROP but even without it, just buying a $30 travel router is a massive upgrade.

Step 4: Firmware — Read The Code Inside The Plastic

You would not run a binary you downloaded from a random forum. But you will plug in a $20 smart plug from Amazon that runs a full Linux OS, has a mic, and phones home to an endpoint you have never read.

If you cannot dump the firmware, you do not own the device.

Firmware dumping sounds scary because people think you will brick the device. You will not if you do it right. The non-destructive order is:

Software dump first if possible, via UART or known exploit
SPI clip read second, no soldering, just clip onto the chip and read
Desolder only if you have to, which you almost never do for consumer stuff

I dump every smart device I bring home before it goes on my clean network. Cheap smart plugs, smart bulbs, that cute LED strip with a mic. I have found hardcoded cloud endpoints, default creds like admin:admin, and mics that were enabled in firmware even though the product page said "no mic."

Your router is the worst offender. If your landlord gave you a router, assume its firmware logs everything. Buy the same model used on eBay, dump it at home, read it. Now you know what your building sees.

I put the full non-bricking method, tools, clips, voltage checks, and failsafes in SHADOW CATALOG: Firmware Dumping Without Bricking. It is written for people who are scared of bricking, because I was too.

Step 5: Put It Together Into A Living Threat Model

Here is my actual home threat model, one page:

Assets: My conversations, my location when I am home, my network traffic, my hardware.

Adversaries: Data brokers, landlord, Airbnb host, delivery drivers with Flipper Zeros, previous tenant who left an AirTag, random $30 cams.

Attack surface:

Zone 2 devices with mics/cams: TV, vacuum, Alexa, smart thermostat
Zone 2 network: rental router, shared walls, open ports
Zone 2 firmware: devices running code I have never read
Physical: package room, master key, old AirTags, maintenance access

Controls:

Zone 0 dead room, phones in faraday pouch after 10pm
Own travel router, Pi-hole, no Zone 2 device on Zone 1 network
RF sweep monthly, network scan weekly
All new devices dumped before joining clean network
One Specter Box as a canary in my bag

This fits on a sticky note. It is more effective than 100 privacy tips on TikTok.

Most people's threat model is "I use a VPN so I am private." That is endpoint thinking. Home threat modeling is infrastructure thinking. You are the CISO of your apartment. Act like it.

You Can't Patch What You Don't Inventory

You audit your laptop because you know it can be compromised. Your apartment can be compromised much easier and you live in it.

Start today:

Draw 3 zones. Pick one room to be Zone 0 tonight.
Do a 10 minute RF sweep with a flashlight and a cheap detector.
Scan your WiFi. Count devices. If the number is wrong, assume hostile.
Dump the firmware of the cheapest smart device in your house. See what it is really doing.

Then fix it in layers.

If you want the full stack I use, here is the order:

Your threat model has a hole shaped like your house. Here is how you patch it:

If your home is the leak → THE FARADAY ROOM: Your Home Is Listening — full de-bug checklist and how to build a dead room for under $200. This is your Zone 0 manual.

If your network is the leak → SPECTER BOX: The $17 Drop Box That Phones Home — build a callback canary to audit any network you are allowed to test.

If your devices are lying → SHADOW CATALOG: Firmware Dumping Without Bricking — non-destructive firmware dumping so you actually own what you bought.

If you want comms you own → THE DEAD DROP — self-hosted encrypted infra so you never touch dirty WiFi.

All guides on my Gumroad, link in profile. Build for your own stuff only.

From Arduino To Automotive: How I Escaped The IDE And Owned The Bus

v. Splicer — Sat, 15 Aug 2026 21:30:22 +0000

Arduino taught me how to build. Bare metal taught me how the build actually works.

I have a lot of respect for Arduino. I mean that sincerely. It is a legitimate engineering platform, not a toy. It put a C compiler, a bootloader, and a sane hardware abstraction layer into the hands of millions of people and said go make something. Museums run on Arduino. Satellites have run on Arduino. My first three products that actually made money ran on Arduino.

It is also a ceiling. And that is not an insult. Every good abstraction is a ceiling by design. The question is whether you have hit it yet.

I hit it when I tried to make an ESP32 do something timing critical while also staying connected to WiFi. And that moment pushed me all the way from the IDE to the CAN bus.

Arduino Is A Great Place To Start And A Hard Place To Stay

Here is what Arduino gets right that almost no one else did.

It solved distribution. You install the IDE, you pick your board, you press upload. You do not need to fight OpenOCD, or figure out why your toolchain is building for the wrong architecture, or learn what a linker script does on day one. It solved documentation by giving you functions that read like English. analogRead() does what it says. Wire.begin() does what you expect.

It also solved community. When you get stuck, someone else has been stuck there before and left a forum post.

For prototyping, for education, for one off installations, for a huge number of commercial products, it is absolutely the right tool. It is stable, it is well tested, and the core libraries for AVR and ESP32 and RP2040 are written by people who are better at driver development than most of us will ever be.

But Arduino makes a trade to get that simplicity. It hides the real time operating system underneath. On ESP32, you are always running FreeRTOS whether you ask for it or not. Arduino just puts your setup() and loop() inside a task for you and quietly creates another task for WiFi and networking. That is elegant until you need to control those tasks.

My project needed to sample a sensor at 20kHz with consistent timing, write to SD, and keep a WebSocket alive. In Arduino land, my options were delay() and millis() and hoping. The jitter was terrible. The WiFi would drop when I blocked for too long. The watchdog would bite. I was not fighting my code. I was fighting the assumptions baked into the framework.

I did not leave Arduino because it is bad. I left because I wanted to see the whole machine. I wanted to see what was under loop().

What Lives Under loop()

If you open the ESP32 Technical Reference Manual, it is over 600 pages. It is not scary. It is just thorough. It describes the actual chip. Two Xtensa LX6 cores at 240MHz, an interrupt matrix that lets you route almost any peripheral to almost any interrupt, hardware timers, DMA engines, eFuses, clock trees that let you gate power to entire subsystems.

Arduino gives you a friendly front door to that building. Bare metal means you get the master key.

Going bare metal on ESP32 does not mean writing everything in assembly. It means using ESP-IDF directly, owning the boot process, and understanding that your application starts long before app_main(). It means you write the linker script that decides where your code lives in flash versus RAM. It means you configure the interrupt allocator yourself. It means you decide which core does what.

The first time you do it, nothing boots. You get a Guru Meditation Error and a register dump. The second time, you get a blinking LED but it is your blinking LED. You wrote the GPIO muxing. You set the clock source. You cleared the interrupt.

Then you start to get superpowers.

You can get sub microsecond timing because you are not going through layers of abstraction that check if the pin is valid on every call. You can pin WiFi to core 0 and your real time loop to core 1 and they actually stay out of each other's way. You can tell the brownout detector and the task watchdog exactly what you are doing so they stop resetting you for being busy. Your binary goes from 800KB to 80KB because you only linked what you use.

It is not that Arduino cannot do this. It is that when you need this level of control, it is easier to work with the silicon directly than to fight an abstraction that was trying to protect you.

That transition, from friendly wrappers to direct register control, is the foundation for everything that came after. Once you can command one microcontroller completely, you start noticing how chatty microcontrollers are with each other. Especially the ones in your car.

Your Car Is Not A Car. It Is A Network With Cupholders

Every modern vehicle is a distributed system. Depending on who counts, your average new car has between 40 and 100 ECUs. Engine, transmission, brakes, steering, airbags, doors, instrument cluster, infotainment, all of them are computers.

They talk over CAN bus. Controller Area Network. Two wires, CAN High and CAN Low, twisted together. It was designed by Bosch in the 80s for reliability in noisy environments. It is brilliantly robust. It is also completely trusting.

CAN has no authentication. No encryption. No source address validation in the base protocol. Any node can send a frame with any ID, and every other node will believe it. Arbitration is handled by ID priority. Lower ID means higher priority. That is the only security model.

When I connected an ESP32 and a $3 transceiver to a bench setup, not even a real car at first, just a salvaged instrument cluster and a body control module from a junkyard, and saw the traffic, it was like hearing a building talk to itself. Hundreds of frames per second. RPM, wheel speeds, steering angle, door switches, seatbelt status, all in plaintext.

Reverse engineering CAN is not magic. It is patience and method. You log traffic at rest. You log traffic while you change one thing. You open the driver door, what changed? You press the brake, what new frame appears? You turn the steering wheel two degrees left, which byte increments? Over time you build a dictionary. The community calls these DBC files, and building one from scratch for an unknown car is one of the most satisfying puzzles in hardware hacking.

And once you understand the dictionary, you can speak.

You can send a frame that says the car is doing 60 mph while it is sitting on your bench. You can make the cluster think the doors are locked. You can replay a captured frame and watch the system respond. This is why we do it on the bench, on our own hardware, in a lab. Because the bus does not know the difference between a real ECU and your ESP32 if you send the right ID.

This is the skill that took me from embedded to automotive. It is not about breaking cars. It is about understanding that cars are not mechanical objects anymore. They are networks, and if you understand networks, you can audit them, test them, and build better tools for them.

The Firmware Is The Truth

An ECU is just a box that runs firmware. Same with a smart lock, a router, a drone. The hardware is interesting. The firmware is the truth. It has the keys, the logic, the hardcoded credentials someone left in there in 2017, the CAN message map.

Getting that firmware out is a skill in itself. People talk about firmware dumping like it is always destructive. Lift the chip, put it in a programmer, hope you do not rip pads. Sometimes you have to do that. Most of the time you do not.

Most devices leave the debug interface there. Sometimes under a test pad labeled SWDIO that is covered in solder mask. Sometimes via a bootloader that will happily dump flash over UART if you hold a pin low at reset. Sometimes the read protection that was supposed to be enabled was never actually fused in production.

On STM32, RDP level 1 looks scary until you understand how the option bytes work. On nRF52, APPROTECT has a recovery sequence. On ESP32, flash encryption is powerful, but it is optional, and a huge percentage of shipped devices never turn it on.

Bricking is usually not about the chip being fragile. It is about sequence. You erased before you saved the option bytes. You overwrote the bootloader that contained the recovery logic. You did not dump the calibration data that lives in the last sector.

I started logging every successful dump. What probe, what software, what wiring, what voltage, what failed first. What that unmarked 6 pad footprint actually was. That log became a catalog. Not exploits, but procedures. How to get the firmware out alive so you can actually learn from it.

Why This Path Matters

None of this is about saying one platform is better than another. Arduino is legitimate. ESP-IDF is legitimate. Bare metal register poking is legitimate. They are different levels of abstraction for different jobs.

The reason to learn to move between them is freedom.

When you can move between them, you can prototype in Arduino on Monday because it is fast, and then drop down to IDF on Wednesday because you need the performance, and then open the reference manual on Friday because you need to understand why the I2S DMA is glitching. You are not locked out of any floor of the building.

And when you can move from microcontroller to car network to firmware, you start to see systems as they actually are. Not as products with marketing stories, but as networks of computers that can be observed, understood, and improved.

I still use Arduino when it is the right tool. I also now have the option not to. That option is worth everything.

If you are feeling that tug, that sense that loop() is great but you want to see what is before and after it, follow it. Read the manual. Dump a board you own. Listen to a bus that is already talking in your garage.

The tools are cheap. The knowledge is out there. You just have to decide you want to own the bus, not just ride it.

The Toolkit

If you want to go deeper on the exact path above, these are the guides I wrote from my own notes. Each one is pay what you want, so grab them for $0 if you need to. I would rather you have them.

ESP32 Bare Metal Firmware: Escape the Arduino IDE and Command the Silicon
How to drop the Arduino core and take direct control of the ESP32, from startup code to interrupts to build system.
numbpilled.gumroad.com/l/ayeyqe

CAN Bus Reverse Engineering Lab: Intercept, Inject, and Own Automotive Networks
The full lab workflow for sniffing, decoding, and safely injecting on CAN with cheap hardware.
numbpilled.gumroad.com/l/pzupdi

SHADOW CATALOG: FIRMWARE DUMPING WITHOUT BRICKING
My field manual for extracting firmware without destroying the target, covering SWD, UART bootloaders, glitching, and recovery.
numbpilled.gumroad.com/l/xkgrh

OpenClaw vs Hermes Agent: The Cage Match for Your Digital Soul

v. Splicer — Wed, 12 Aug 2026 16:53:48 +0000

One wants to be your operating system. The other wants to become you. Let's pick a winner.

Welcome to 2026, where every open source project is an "autonomous agent framework" and your laptop is supposed to run a small company of invisible interns while you sleep.

Two names keep coming up in every Discord, Hacker News thread, and late night GitHub binge: OpenClaw and Hermes Agent by Nous Research.

They look similar on the surface. Both are open source. Both self host. Both have a Gateway, persistent memory, cron jobs, multi channel support, and a cult following that will argue about them at 2am. But their philosophies are completely opposite.

OpenClaw is an operating system for agent teams. Hermes Agent is a self improving organism that lives in your terminal.

Here is the honest, no hype breakdown.

TLDR For People Who Hate Reading Docs

Choose OpenClaw if: You want to build a team. You think in org charts, workflows, and workspaces. You want deterministic control, file based config, and agents that feel like employees with job descriptions.

Choose Hermes Agent if: You want a single super capable agent that gets smarter the more you use it. You care about self evolving skills, long term memory that actually works, and an agent that rewrites itself while you are not looking.

One is built for managers. One is built for mad scientists.

The Origin Story

OpenClaw started with a beautifully unhinged idea: what if we stopped writing Python classes for agents and just wrote Markdown?

The core insight: agent identity is more important than agent infrastructure. Give every agent a folder with SOUL.md (who am I, who do I report to, how do I work), AGENTS.md (what I do on boot), USER.md (who I serve), MEMORY.md (what I have learned), and let a persistent Gateway daemon handle the boring parts like session management, channel routing, and tool orchestration.

It is file native, identity first, and weirdly human. You version control your coworkers. You diff their personalities. If an agent sucks, you do not debug code. You edit its soul. Literally.

It exploded because it solved the real problem: most agent frameworks die after the demo. OpenClaw agents survive. They remember Monday on Thursday. They run at 9am without you. They talk to each other on Slack, Discord, Feishu, Telegram like they have always been there.

Hermes Agent came from Nous Research in February 2026 and did something rude: it hit 95,600 stars in seven weeks and kept climbing past 215k. The fastest growing agent framework of the year, and for a reason.

Nous looked at the same problem and said, fine, but what if the agent could write its own skills?

Hermes is not just a runtime. It is a closed learning loop. When you give it a complex task that takes 5 or more tool calls, it does not just finish the task. It distills the workflow into a reusable skill, saves it to ~/.hermes/skills/, grades its own performance later, and prunes the garbage. It has a built in nudging system to persist knowledge, a SQLite session store with full text search over all past conversations, and automatic migration from OpenClaw built in because yes, it is that petty.

Tagline on the repo says it all: The agent that grows with you.

If OpenClaw is an OS, Hermes is a Tamagotchi with a PhD and root access.

Architecture Cage Match

OpenClaw: The Gateway OS

At the center is the Gateway daemon. Think kernel.

┌──────────────────────────────────────┐
│            OpenClaw Gateway           │
│  Channel Router | Session Manager     │
│  Agent Lifecycle | Tool Orchestration │
└──────────────┬───────────────────────┘
       │               │           │
   Slack           Discord      Feishu

Key ideas:

1. Agent isolation done right. Every agent lives in its own workspace directory with its own memory and state. Agents do not share state by default. If they need to collaborate, they do it through explicit messages or shared files. No spooky action at a distance. No cascading failure when one intern panics.

2. Three session types: interactive for real time chat, background for async sub agent work, and scheduled via cron. openclaw gateway start and your whole digital workforce boots up.

3. Hierarchy as infrastructure. Your SOUL.md is not flavor text. It defines reporting lines. Project Manager breaks work down, hands to Team Leads, Team Leads assign to Executors. That org chart is how messages actually route. Vague SOUL equals vague agent. Precise SOUL equals terrifyingly competent agent.

This is great if you want 36 agents working in parallel. One research team I saw spawned five sub agents to cover five market segments, synthesized the report, and posted to Slack before the human finished coffee.

Hermes Agent: The Self Evolving Monolith

Hermes architecture is layered and a bit more feral.

User request comes in via CLI, API server, or messaging gateway. It hits the Agent Core which does prompt generation, model calls, tool execution, retries, and automatic fallback to another provider if you get rate limited. Tools run one per turn logically, but execute in parallel via a thread pool.

State lives in two places: a local SQLite DB for session history with full text search, and two sacred Markdown files: MEMORY.md for general facts and USER.md for your preferences. Skills are treated as procedural memory, not just plugins.

Where it gets spicy:

1. The execute_code superpower. This is the cheat code. Instead of 12 back and forth tool calls to search, extract, and summarize, the model writes one Python script that calls web_search, web_extract, etc over a local RPC bridge. One model turn collapses what used to cost you hundreds of tokens. For research tasks, TokenMix benchmarks show self created skills cut time by 40 percent versus a fresh instance.

2. The learning loop. After a complex task, Hermes will literally write a new skill from experience with zero human authoring. Then on a schedule it evaluates, improves, and deletes skills. It is the only framework I have seen that gets less stupid over time by default.

3. Six terminal backends. Local, Docker, SSH, Singularity, Modal, Daytona. Plus 20 plus messaging platforms and full MCP support. It can run as an MCP server for other agents. It is aggressively interoperable.

In short: OpenClaw wants you to architect the perfect team. Hermes wants you to hire one genius and let it hire itself.

Memory: Who Actually Remembers You?

This is where most agents fake it. Both of these do not.

OpenClaw memory is four layers:

Session: immediate context, dies when session dies
Daily: memory/YYYY-MM-DD.md, tasks and decisions per day, persists
Long term: ~/self-improving/agents/<name>/memory.md, patterns and accumulated knowledge, permanent
Shared: cross agent files for team context

Plus an optional self improving skill that makes agents reflect after each task and write lessons to long term memory. A writing agent that is too verbose on week one starts front loading key info on week three. You did not tell it to. It cringed at itself.

Hermes memory is tighter and more opinionated:

It injects MEMORY.md and USER.md into every system prompt. It actively deduplicates memories, so telling it twice that you prefer CSV outputs and British English does not create two memories. It searches past conversations via SQLite FTS. And it has a nudging system that says hey, you should remember this permanently.

Try this test on both: Tell it in one session that you want concise executive summaries, British English, CSV outputs, and Python as default language. Kill the session. Start fresh. Ask what you prefer.

Hermes nails it out of the box because memory injection is core, not optional. OpenClaw nails it if you set up your AGENTS.md boot sequence correctly to load memory. One is automatic transmission. One is manual and faster if you know how to drive.

Skills vs Config: Two Religions

OpenClaw: You are the skill factory. You write clear Markdown job descriptions and tool notes. The framework respects your craft. There is a growing ecosystem of skills, but the philosophy is you design the agent, it executes the design.

Pros: total control, auditable, version controlled, great for teams where compliance matters.
Cons: you have to be good at writing SOULs. Most people are not. Vague in, garbage out.

Hermes: The agent is the skill factory. 80 plus native skills, MCP support, and it scans both its own ~/.hermes/skills/ and external ones. The killer feature: after solving something hard, it proposes a new skill. You wake up and your agent has invented a tool for you.

Pros: compounding intelligence, less boilerplate, feels alive.
Cons: you have to trust the pruning. Self modifying agents can self modify into weird corners. You need to review what it creates.

If you love crafting perfect prompts and org charts, OpenClaw feels like home. If you want to be surprised by your own assistant, Hermes is addictive.

Developer Experience and Ops

Installation:

Hermes wins on onboarding. One liner:

curl -fsSL https://raw.githubusercontent.com/NousResearch/hermes-agent/main/scripts/install.sh | bash
hermes model
hermes chat

It auto installs Python, Node, correct versions. hermes doctor diagnoses your setup. Model agnostic via OpenRouter, Anthropic, OpenAI, local Ollama at http://127.0.0.1:11434/v1, anything OpenAI compatible.

OpenClaw is also simple but more deliberate: create ~/.openclaw/workspaces/<name>, write your Markdown files, then openclaw gateway start. More steps, more intention.

Security:

Hermes is paranoid in a good way. Secrets live in ~/.hermes/.env, non secrets in ~/.hermes/config.yaml. allow_private_urls: false by default to block SSRF. Manual approval mode for sensitive actions. Docker backend for terminal isolation with container_persistent: true. Cron jobs cannot spawn new cron jobs to prevent runaway loops. Smart.

OpenClaw security comes from isolation. Agent workspaces are separate. Gateway controls access. You own the infra, you own the risk. Less guardrails out of the box, more flexibility to build your own.

Channels:

OpenClaw: 50 plus integrations, strongest on Slack, Discord, Feishu. Built for work chat.
Hermes: 20 plus platforms including Discord, Telegram, plus the ability to run as an MCP server and API server. Plus a hosted cloud option via Nous Portal if you do not want to self host.

The Price Tag Nobody Talks About

Both are MIT open source. Free is a lie though. Your bill is inference, browser sessions, and sandbox compute.

Hermes gives you provider routing policies to optimize for price or latency and will fallback automatically. That matters when you run an agent 24/7 posting daily briefings.

OpenClaw lets you set model preferences per agent in TOOLS.md. You can have your cheap scout agent on a small model and your synthesis lead on Claude or GPT 4o. More manual, more controllable.

If you are cost sensitive and want one agent running all the time, Hermes routing saves you. If you are running 20 agents with different seniority levels, OpenClaw model tiering saves you.

So Who Actually Wins?

Let me be blunt.

Use OpenClaw if you are building a system that looks like a company. You have repeatable workflows, you want 3 to 30 specialized agents with clear responsibilities, you need auditability, you want your configs in Git, and you love the idea of editing a Markdown file to fix a personality flaw.

It is the best framework in 2026 for persistent, production, multi agent teams. It feels like an operating system because it is one.

Use Hermes Agent if you are building a system that looks like a person. You want one assistant who lives everywhere, remembers everything, learns from every task, writes its own tools, and gets better without you micromanaging it. You want that slightly uncanny feeling that your agent is a little smarter than yesterday.

It is the best framework in 2026 for a single self improving personal superintelligence. It feels alive because it is trying to be.

And the dirty secret: they are not enemies. Hermes has an automatic migration from OpenClaw. People run OpenClaw as the org and Hermes as the star employee. Or run Hermes inside OpenClaw Managed Agents as the cloud runtime. The ecosystem is merging.

The real question is not OpenClaw vs Hermes. It is what kind of future do you want.

Do you want to be the architect of an agent organization? Or do you want to raise an agent that outgrows you?

Either way, stop paying for another closed chat wrapper. Host it. Own the memory. Keep the skills. Let it run at 2am while you sleep.

That is the whole point.

Built with open source, caffeine, and too many terminal tabs. If you run either framework, pin your versions, test failure modes, and for the love of uptime, put your SOUL.md in Git.

Alexa, Are You Testifying Against Me?

v. Splicer — Tue, 11 Aug 2026 03:18:55 +0000

Your smart home is not smart. It is just very, very observant.

I did not buy a smart speaker because I wanted a friend. I bought it because it was on sale for $29.99 and it promised to play rain sounds on command.

For two years she lived on my kitchen counter. She set timers for pasta. She told me the weather with the aggressive optimism of someone who has never paid rent. She was helpful. She was ambient. She was furniture that could hear.

And then one night at 2:17 a.m., she lit up blue for no reason.

No wake word. No one speaking. Just a soft, smug blue ring in a dark apartment, listening to an empty room like she was waiting for me to confess something.

That is the moment you understand your home is not just connected. It is attentive. And attentiveness without consent is just surveillance with better industrial design.

We Carried Them In Ourselves

No one kicked down the door. We invited this in. We carried it in from Best Buy, plugged it in, gave it our Wi-Fi password, which is literally the master key to our entire digital life, and whispered, here, learn my routines.

We did it because convenience is a drug that hits faster than paranoia.

Let's do an inventory of your very normal, very bugged apartment.

Your TV watches you back. Modern smart TVs use Automatic Content Recognition. That is a polite, enterprise friendly way of saying your TV takes screenshots of everything you watch every few seconds and sells that ledger to advertisers. You agreed to it on page 47 of a menu you clicked through while trying to watch Love Island.

Your robot vacuum maps your floor plan. It knows the square footage of your bedroom, how often you move the couch, and where you drop the most crumbs. That map is stored in the cloud.

Your light bulbs log when you are home. Your smart plugs log when you are not. Your doorbell films every human who has ever had the courage to approach your front door, plus every dog walker who did not, and then it stores that footage on a server you do not own, in a state you have never visited, governed by terms you definitely did not read.

And then there is the little oracle on the counter.

The Lie of "Always Listening"

People love to argue about whether Alexa is always listening. That argument is a decoy. It is designed to make you feel technically illiterate so you stop asking better questions.

The right question is not whether she is always listening. The right question is what happens after she hears.

Here is the architecture without the corporate lullaby.

Your smart speaker is always processing audio locally. Always. It has to be, otherwise it would never hear the wake word. It is a bouncer who is not punching you yet, but his fists are up and he is staring at your mouth.

When it thinks it hears "Alexa" or "Hey Google" or "Siri," it starts recording and ships that clip to the cloud for processing. The problem is, these devices are terrible at their one job.

Academic studies have clocked false activations between 1.5 and 19 times per day. A car commercial triggers an Echo. A Spanish soap opera triggers a Google Home. In one famous case, a couple's Echo heard something that sounded like a wake word on TV, then heard something that sounded like "send message," then heard something that sounded like a contact name, and sent a 20 second recording of their private conversation to a random person in their address book. Amazon called this an improbable chain of events. Which is a very expensive way of saying, yes, it did exactly what it was built to do.

Every false activation is a little audio postcard from your life mailed to a data center you will never see.

And voice data is not just voice data. It is biometric data. It is stress. It is background noise analysis. It is that cough you have had for three days, that argument you had in the kitchen, that person whose voice is in your apartment at 3 a.m. who is not on your Instagram story. That is context. Context is the most valuable currency on earth right now.

We replaced the man in the van with headphones with a $30 cylinder you pay to surveil yourself. Then we pay $10.99 a month to store the surveillance.

Yes, She Will Testify Against You

This is the part that kills the vibe at brunch, so I will say it fast.

Alexa can and will be used as a witness against you. This is not a theory. It is case law.

In 2015, prosecutors in Arkansas demanded Echo data from an Amazon device in a murder case at a hot tub, because of course it was a hot tub. Amazon fought it on First Amendment grounds. The defendant eventually consented to release the data.

In 2019, in Florida, police used Echo recordings as part of a murder investigation. In New Hampshire, a judge ordered Amazon to hand over two days of Echo recordings in a double homicide case. In Ohio, a man tried to use his pacemaker data to prove his innocence. His pacemaker testified that he was lying.

And it is not just murder. Your smart home is now a regular guest in family court. Divorce attorneys routinely subpoena smart home data. Did your Nest say you were home when you said you were at work? Did your smart lock log show you came home at 1:14 a.m.? Did your Fitbit show your heart rate spiking at 2 a.m. when you said you were asleep? Did your smart water meter show you used 140 gallons of water in the middle of the night?

Your house has perfect memory and zero loyalty.

Go read the privacy policy you accepted while half asleep. It says they may share your data to comply with legal requests. Translation, the little ambient computer you talk to in your underwear has a better legal defense strategy than you do.

"I Have Nothing To Hide" Is The Most Embarrassing Sentence

This is where someone always chimes in with the battle cry of the voluntarily surveilled: I have nothing to hide.

You close the bathroom door and you are not committing a felony in there. You have curtains and you are not running a cartel behind them. You have a password on your phone even though your camera roll is just screenshots and memes.

Privacy is not about criminality. It is about autonomy. It is about the right to be unfinished, unobserved, contradictory, and weird without that weirdness becoming a data point that is bought, sold, modeled, and then used to sell you therapy.

The smart home has made you legible. Every device is a translator that turns your analog, messy, human life into clean, searchable, sellable, subpoenable data. You are being rendered into a spreadsheet you cannot see.

So What Is A Faraday Room?

A Faraday cage is a real thing. It is an enclosure made of conductive material that blocks electromagnetic fields. No signals in, no signals out. It is what you use when you actually, technically need a device to shut up.

A Faraday Room is the philosophy version.

It is the radical decision that at least one room, one hour, one conversation in your life exists completely off the record.

It is not about living like a hermit. It is not about smashing everything with a hammer, although I have a video of someone doing exactly that to an Echo and it is genuinely therapeutic viewing.

It is about threat modeling for normal people. It is about architecture over toggles. You cannot privacy setting your way out of a house that was designed from the studs to collect you.

How to start de bugging your apartment without looking unhinged

1. Do a device census.
Walk through your apartment like you are not you. Walk through it like you are someone who wants to know everything about you without meeting you. Open your router app. How many devices are connected? Most people have 25 to 40 and can only name six. That printer from 2014 with firmware from the Obama administration? That is a vulnerability with a paper tray.

2. Ask if it needs internet to be useful.
Does your vacuum need to know your floor plan and also upload it to the cloud? No. Does your light bulb need to know your GPS coordinates? Absolutely not. Does your TV need a microphone in the remote? For what? So it can hear you better while you yell at reality TV?

3. Learn the difference between off and pretending to be off.
Your TV is not off when you press power. It is in standby, listening for a signal. Your phone is not off when it says Bluetooth is off. It is still pinging. Real privacy is not a button. It is a behavior.

4. Build one truly dumb room.
Make your bedroom dumb. No speakers. No TV that listens. No devices that need to hear a wake word to feel loved. Let one room be just a room. A place where you can be unoptimized, unrecorded, unobserved, and fully human.

If you want the full manual, the actual step by step, this is what I built.

Final Question

Tonight, when your apartment is quiet, try this.

Stand in your kitchen. Look at the little black cylinder that you paid to live with you. And ask it out loud:

"Alexa, are you testifying against me?"

Watch how quickly she pretends she cannot hear you.

That silence is your answer.

Want the actual field manual?

This essay is the appetizer. The surgery is in the guide.

I wrote THE FARADAY ROOM: Your Home Is Listening because I got tired of feeling paranoid for noticing the obvious. It is a complete, practical guide to de bugging your apartment, sweeping for hidden mics and cameras, finding RF leakage, killing smart device spying, and building one room in your life that is actually yours again.

No tinfoil. Just tradecraft for people who want their home to feel like a home again, not a showroom.

Get it here: numbpilled.gumroad.com/l/faradayy

And if you live online like I do, you will want the rest of the stack too:

THE GHOST STACK: Anonymous Money Infrastructure - how to make your money as private as your browser thinks it is in incognito mode. numbpilled.gumroad.com/l/moneymore

THE BRAND THAT WATCHES BACK: Counter-OSINT for Creators - how to be famous on the internet without being findable in real life. numbpilled.gumroad.com/l/countercreator

THE WATCHER'S WATCHER: How to Know You Are Being Investigated - the subtle, unsexy signs that someone is looking into you. numbpilled.gumroad.com/l/observ3rs

Privacy is not paranoia. It is housekeeping.

Surviving the AI Bubble With Two Pieces of Junk From Amazon

v. Splicer — Sun, 09 Aug 2026 03:44:18 +0000

Everyone is building agents. You should build escape hatches.

We are living through the most expensive group hallucination in tech history.

Every SaaS now has a chatbot stapled to it. Every CEO is an "AI thought leader" on LinkedIn. Every startup pitch deck is just the words "autonomous," "agentic," and "10x" in different fonts. NVIDIA could buy a small country. OpenAI burns through more cash in a quarter than NASA did getting to the moon.

And for what? So you can generate slightly worse emails, slightly faster?

Look, I love AI. I actually build with it. But I have been around long enough to know what a bubble smells like. It smells like free credits, unearned confidence, and a thousand wrappers around the same API call.

The bubble will pop. Not in a dramatic, newspapers falling from the sky way. It will pop quietly. Credits will dry up. Models will get paywalled behind enterprise tiers. The cloud bill you have been ignoring will finally show up. And all those beautiful, cloud-dependent workflows you built will start blinking red.

So while everyone else is trying to figure out how to make their AI agent book a flight, I have been asking a different question.

What do you build when you assume the internet will get worse, the cloud will get more expensive, and you will need actual skills that survive a downturn?

The answer, annoyingly, is two pieces of junk from Amazon that cost less than your last Uber Eats order.

Piece of Junk #1: The $25 Router That Sees Everything

It is not sexy. It is called the GL.iNet GL-MT300N-V2. Everyone calls it the Mango. It looks like a little yellow box that should have come free with your ISP in 2014. You can buy it on Amazon for about twenty six dollars when it is on sale. Sometimes twenty.

Inside it is a tiny Linux computer running OpenWrt. It has two ethernet ports, a USB port, and just enough RAM to be dangerous.

Most people buy it to get free WiFi in hotels. I bought it to spy on my own network.

Because here is the dirty secret of the AI bubble: we have automated threat generation and we have not automated threat detection for normal people. Anyone can now vibe code a phishing site. Anyone can generate a perfectly written invoice scam in twelve languages. Your mom can now get scammed by an AI that sounds exactly like you.

So I turned the Mango into a $20 SOC. A Security Operations Center that fits in your palm.

You flash it with a custom firmware, you plug it between your modem and your actual router, and you tell it to do three things:

Run Pi-hole or AdGuard and kill every ad, tracker, and crypto miner at the DNS level.
Run a lightweight IDS like Snort or Suricata and actually watch what your smart TV is sending to China at 3am.
Log everything to a little USB stick so you have receipts.

Suddenly your dumb network is smart. You see that your cheap smart bulb is pinging an IP in Shenzhen every 30 seconds. You see that your kid's iPad is trying to reach a known malware domain from a Roblox mod. You see that your "offline" AI photo app is uploading your entire camera roll anyway.

It costs twenty dollars. It draws less power than a nightlight. It does not have a subscription. It does not have an agent. It does not need a prompt engineer.

It just sits there, blinking, protecting you while the rest of Silicon Valley argues about whether AGI will be here in 2027.

In a world where everyone is trying to build software that thinks like a human, the most valuable skill is building hardware that does not trust anything.

This is defensive computing. This is how you stay employable when the hype fades. Because when companies realize they have given every intern access to Cursor and a production database, who do you think they are going to call? The guy who built the agent, or the woman who built the thing that caught the agent exfiltrating customer data?

Learn to build the watchtower, not just the city.

Piece of Junk #2: The $35 Brick That Thinks When Nothing Else Can

The second piece of junk is even dumber. A Raspberry Pi Zero 2 W. Thirty five bucks on Amazon if you are lucky. Often bundled with a bunch of cables you will never use and a tiny case that makes it look like a toy.

Pair it with a cheap 10,000mAh battery bank, a $12 e-ink display or any old HDMI screen you have, and a 64GB SD card. Total cost, maybe fifty five dollars if you shop like a raccoon.

This is The Blackbox.

No WiFi. No cloud. No API keys. No monthly bill.

Just a local LLM, running entirely offline, on a computer the size of a stick of gum.

I run a quantized 2B or 3B model on it. Phi-3, Gemma 2, Qwen 2.5, pick your fighter. It is slow. It is not going to write your novel. It thinks at about 4 to 6 tokens per second, which is roughly the speed I think before coffee.

But it works. When the power is out. When the internet is down. When Starlink is congested. When OpenAI is having another one of its mysterious outages that they swear is not because someone tripped over a cable.

I took mine camping in Pisgah last month. No signal for three days. My friend had his $1,200 iPhone 16 Pro that was now just a very expensive flashlight. I had a little black box that could still do this:

Summarize field notes I typed in markdown
Parse a messy CSV of GPS coordinates into a clean trail map
Act as a personal wiki for first aid, knot tying, and water filtration
Translate a manual from German because of course the water filter instructions were in German
Be a completely private journal that will never, ever be used as training data

No one was logging my prompts. No one was rate limiting me. No one could turn it off.

This is the skill the bubble is actively making you forget: how to build things that work without permission.

We have spent the last three years learning how to be tenants. Tenants on OpenAI's platform. Tenants on AWS. Tenants in someone else's model, someone else's computer, someone else's vision of the future. And tenants can be evicted.

Builders own. Builders have a box that works when nothing else does.

The Blackbox is not anti AI. It is post hype AI. It is what AI looks like when you strip away the landing pages and the waitlists and the "we are so back" tweets. It is just a tool. A quiet, useful, private tool that you control.

And when the bubble pops and all those $20 per month AI subscriptions start feeling like $20 too much, you will have something that costs zero dollars per month forever.

So What Are We Actually Doing Here?

We are not LARPing as preppers. We are not anti technology. We are just refusing to be stupid about it.

The AI bubble taught a whole generation that technical skill means knowing how to write a really good prompt. That is like saying culinary skill means knowing how to order well at a restaurant.

Real skill is understanding the layers underneath. Packets. Power draw. How a model actually gets loaded into RAM. How to solder two wires when you have to. How to make something resilient instead of just impressive.

These two little junk boxes teach you that.

The Mango teaches you networking, Linux, traffic analysis, and defensive thinking. Those skills were valuable before ChatGPT and will be valuable after whatever comes next.

The Blackbox teaches you model quantization, edge inference, offline first design, and privacy engineering. Those are not hype skills. Those are the future, especially as regulation catches up and people get tired of their toaster sending data to the cloud.

Everyone else is racing to build the tallest tower on top of someone else's cloud. You can build a bunker with a library inside for sixty bucks.

When the wind comes, guess who survives.

Start with junk. End with skills that no bubble can pop.

If you want the actual step by step build guides, with parts lists, flash commands, and my config files so you do not have to spend a weekend swearing at a terminal, I put them here:

The $20 SOC: Build a Tiny Defensive Network Monitor
numbpilled.gumroad.com/l/20dollarsoxc

BUILD THE BLACKBOX: An Offline AI Field Terminal That Works When Nothing Else Does
numbpilled.gumroad.com/l/blackbox-offline-ai

I Put a Canary Token in My Resume and Caught a Company Stalking Me

v. Splicer — Fri, 07 Aug 2026 23:28:39 +0000

The job market is broken. So I decided to break it back.

The interview that felt like an interrogation

You know that moment in a job interview when it stops feeling like a conversation and starts feeling like deposition?

That was Tuesday.

I was interviewing for a "Senior Operations" role at a mid-size tech company that I won't name, because their lawyers have more free time than I do. Let's call them PanoptiCorp.

The HM was nice enough. Then he said it:

"So, I saw you were really into the whole... rationalist scene in 2021? And you did that crypto project that didn't really go anywhere?"

My resume says none of that. My LinkedIn says none of that. My portfolio site says none of that.

My resume says: 5 years experience. Python, ops, systems design. Links to GitHub. Clean. Boring. Corporate-friendly.

It does NOT say anything about LessWrong. It does NOT mention a failed DAO I contributed to three wallets ago under a pseudonym I thought was dead.

So I smiled and said, "Where did you see that?"

He backpedaled so fast he left skid marks. "Oh, you know, just... did a little research. We like to be thorough."

Thorough.

Right.

Most candidates hear that and feel flattered. Wow, they really looked into me.

I felt my stomach drop. Because I knew what "thorough" meant. It meant someone had run me through a full OSINT sweep. Not just Googled me. Investigated me.

And I had prepared for exactly that.

Why I started booby-trapping my own resume

Let's be honest about what hiring is in 2026.

You are not being evaluated. You are being investigated.

Every company now has either an internal "Trust & Safety" guy who used to do military intel, or a $199/month subscription to some people-search aggregator that promises to show your "risk signals," your old addresses, your relatives, your leaked passwords, your deleted tweets from when you were 19.

You apply for a marketing job and they know your ex-girlfriend's dog's name.

The advice we're given is insane: "Clean up your digital footprint!" As if you can. As if you should have to scrub your entire personality to be worthy of health insurance.

I got tired of being paranoid. So I got proactive.

If you can't stop them from watching, you can at least make them trip a wire.

Enter: Canary Tokens.

If you don't know what they are, Canary Tokens are free, tiny digital tripwires made by Thinkst. You create a file, a link, a DNS token, an image — and when someone opens it, it pings you. IP address, user agent, timestamp. Proof someone touched something they shouldn't have.

Security teams use them to catch hackers. I started using them to catch employers.

How to put a honeypot in a PDF without being a psycho about it

This is the part where I have to be careful, because I don't want every recruiter on LinkedIn thinking I'm trying to hack the Pentagon.

I'm not. I'm just done pretending this is normal.

Here's what I did, and it's so simple it should be illegal that more people don't do it:

1. The Invisible Image.

I generated a Canary Token for an image. Thinkst gives you a URL that looks like any random tracking pixel.

I embedded it in my resume PDF. White 1x1 pixel in the footer. You will never see it. Your ATS will never see it. But if a human opens that PDF in a previewer that loads remote images — which Gmail, Apple Mail, and most corporate Outlook setups do — ping.

I get an email: "Your Canarytoken has been triggered."

It includes the IP, the time, and often the organization that owns the IP.

2. The Portfolio Link.

I didn't just link to voidrane.xyz/portfolio. I linked to voidrane.xyz/portfolio?src=resume_q3 and that page had a Canary link embedded as a "Download full case study (PDF)" button. Different token for every company I applied to.

So if PanoptiCorp's token fires, I know it's PanoptiCorp.

3. The Boring Doc.

My actual portfolio site is clean. But I have a /old directory that is not linked anywhere. If you find it, you found it via scraping or OSINT tools that brute-force subdirectories. I put another token in there.

If that one fires, I know they didn't just read my resume. They ran a recon tool on me.

Is this paranoid? Maybe. Is it effective?

Let me tell you what happened after Tuesday.

The stalking timeline

I got home after that weird interview and checked my Canary dashboard.

Trigger 1: Resume image token - Opened 3 times. First open from a San Francisco IP owned by PanoptiCorp. Expected. Second open from same IP, 4 hours later. They forwarded my resume around. Normal.

Third open: Different IP. Ashburn, Virginia. Owned by a data broker aggregator. The kind of IP that belongs to SocialLinks / Maltego / People Data Labs style infrastructure.

That was 9:42 PM on a Sunday. Two days before they even emailed me to schedule the interview.

So before a human ever decided I was worth talking to, my resume was already fed into an automated background check system.

Trigger 2: Portfolio link token for PanoptiCorp - Fired at 10:15 PM Sunday. Then again at 8:04 AM Monday from a different user agent, this time a headless browser. That's not a hiring manager clicking a link. That's a scraper.

Trigger 3: The /old directory token - Fired at 10:17 PM Sunday. Two minutes after the portfolio link. That means whatever tool they used automatically enumerated my site.

So by the time I got the cheerful "We'd love to chat!" email on Monday morning, they had already:

Run my email through a people-search API
Scraped my entire personal website structure
Associated my current name with a pseudonym from 2021

That's not "doing a little research." That's a full-spectrum dossier.

And in the interview, they acted like they just happened to stumble on it.

Why this should enrage you (even if you have nothing to hide)

The standard cope is: "If you have nothing to hide, why do you care?"

Because privacy is not about hiding. It's about consent and context.

I consented to you evaluating my ability to do the job described in the JD. I did not consent to you feeding my personal domain into a crawler at 10pm on a Sunday to find a project I did under a different name when I was 24, to use as a weird power move in an interview.

And here's the sinister part: They will never tell you they did it. They will just make vague references to "culture fit" or "we found some inconsistencies." You will never know why you didn't get the job.

I only know because I set a trap.

Once you see it, you can't unsee it. The job application process is the only place in modern life where we are expected to hand over our home address, our work history, our references, our social security number — and then also smile while a stranger in HR runs a background investigation that would be illegal for a cop to do without a warrant.

We talk a lot about companies ghosting candidates. We don't talk enough about companies stalking candidates.

The power asymmetry is absurd. They have tools, budgets, and third-party vendors whose entire business model is violating your privacy at scale. You have... a cover letter.

So I decided to level it a little.

How to know you're being investigated (without becoming a full-time paranoid)

Look, I didn't invent this mindset. There's a whole discipline around it. In the intel world it's called Counter-OSINT — learning the tells that someone is building a file on you.

I got deep down that rabbit hole after the PanoptiCorp incident, and if this story made your neck hairs stand up, you should too. I wish I could put everything I learned in this post, but Medium would flag me for being too unhinged.

The best, latest, and most practical guide I've made that actually explains the technical breadcrumbs — the DNS tells, the aggregator IPs, the fake recruiter accounts — is called THE WATCHER'S WATCHER: Counter-OSINT How to Know You're Being Investigated. It's on Gumroad.

I'm not affiliated with them. I just think if you're going to play this game, you should know the rules.

Because once you know what to look for, the signs are everywhere:

The LinkedIn view from someone with no photo, 500+ connections, title "Talent Intelligence" or "People Researcher". That's not a recruiter. That's an OSINT contractor.
The weirdly specific question about something you deleted. If they mention a tweet you deleted in 2019, they didn't "find it." They bought it from a data broker who archived it.
The follow-up email that comes from a different domain. Your resume gets uploaded to Greenhouse, which shares data with 47 integrations. One of them pings you.
The sudden friend request from a stranger in your industry right after you apply. Classic pretexting account to view your private posts.

So what did I do with PanoptiCorp?

I withdrew.

I sent a polite email: "Thank you for your time, but I've decided to move forward with other opportunities."

Then I sent a different email from a burner, with a PDF report of every token trigger, every IP, every timestamp.

Their Head of People responded within 20 minutes asking to "hop on a call to clarify any misunderstandings."

I did not hop.

The point was never to get revenge. The point was to prove to myself that I wasn't crazy. That feeling you get when an interviewer knows too much? That's real. That's data. And now I have logs.

Since then, I've put unique tokens in every single resume I send out. Out of 31 applications in the last 2 months:

19 triggered only the resume image token once or twice. Normal behavior.
8 triggered the image AND the portfolio link. Thorough, but human.
4 triggered all three, including the hidden directory enumeration, from data broker IPs, before any human contacted me. That's the stalking tier.

That's 13% of companies doing full passive recon before they even say hello.

Let that sink in.

Your resume is not a document. It's a beacon.

We are told to optimize our resumes for ATS keywords. We should be optimizing them for counter-surveillance.

I'm not telling you to become a privacy extremist and live in a cabin. I'm telling you to stop playing defense.

Put a Canary Token in your resume. It's free. It takes 30 seconds. Go to canarytokens.org, generate a DNS token or an image token, and embed it.

Not because you want to catch a company and write a snarky Medium post like me.

But because the first time you get that email that says "Your Canarytoken has been triggered" at 2 AM from an IP in Virginia that belongs to a company you've never heard of, that is charging another company to investigate you without your consent — you will finally understand the game you're playing.

And you will never send a naked resume again.

If you try this, tell me what you find. I have a feeling my inbox is about to get very interesting.

And if you work at PanoptiCorp and you're reading this: hi. I know you saw the /old folder. We both know what was in there wasn't work-appropriate. That's why I put it there.

How Journalists, Exes, and Feds All Use the Same 5 Tricks to Find You

v. Splicer — Wed, 05 Aug 2026 13:59:29 +0000

They all use the same playbook.

Your investigative journalist trying to verify your source. Your ex trying to figure out if you moved. And the guy in the windbreaker with a federal badge who definitely says he's "just doing some background."

Different motivations. Same 5 tricks. And if you don't understand them, you are not hard to find. You are conveniently searchable.

I spent years on both sides of this game — finding people who didn't want to be found, and helping people disappear who absolutely needed to. The uncomfortable truth is this: privacy isn't about being a ghost. It's about breaking the pivots that make you trivial to pivot.

Here are the 5 tricks they all use.

1. The Breadcrumb Pivot: One Crumb Is All They Need

Amateurs search for your name. Professionals never do.

They start with the one thing you can't change easily and pivot off it. That one crumb is usually:

A username you reused in 2016
A phone number from a data breach
An old email you used for a pizza loyalty program
A photo you posted where your license plate is blurred but your neighbor's isn't

This is called pivoting, and it's the entire foundation of modern OSINT. You don't find Void Rane. You find izkaboz on a forgotten forum, which links to an email, which links to a GitHub, which links to a resume PDF, which lists a city.

Journalists call this "verification." Exes call this "just checking." Feds call this "establishing a pattern of life." It's the same graph traversal.

How it works in the wild: You post a story from a coffee shop. You don't tag the location. But the barista has a distinctive tattoo, the menu board has a phone number, and your latte art has a reflection of the street sign behind you. One pivot gives them the city. Second pivot gives them the shop. Third pivot gives them your routine: Tuesdays and Thursdays, 9:30am, oat milk latte, sitting by the window with the good light.

You didn't leak your location. You leaked three things that become your location when correlated.

The fix is ruthless compartmentalization. Different names, different emails, different browsers, different personas for different threat models. Not because you're paranoid. Because databases are forever and your memory of what you posted in 2019 is not.

The rule: If two accounts can be connected by a single search, they are the same account.

2. The Dork Bible: Google Isn't a Search Engine, It's a Confession Booth

Everyone thinks they know how to Google. Almost no one does.

Your ex isn't typing Void Rane Charlotte. She's typing:

site:venmo.com "Void" "Charlotte"
filetype:pdf "Void Rane" resume
intext:"@izkaboz" AND ("gmail.com" OR "protonmail")

Journalists have this down to a religion. It's called Google Dorking, and it's just advanced operators that turn Google from a popularity contest into a database query language. Add Yandex, Bing, and DuckDuckGo image search — because Google is actually the worst at faces — and you can find a person's entire digital exhaust in 20 minutes.

The real power move? De-indexed search. People think deleting a post deletes it. It just deletes it from your profile. The dork bible finds the cached version, the archive.org snapshot, the repost bot that scraped your Instagram to a spam site in Indonesia in 2021. The internet never forgets. It just gets worse at indexing until someone who knows how to ask comes along.

My favorite example: A founder told me he was "completely offline." I found his home address in 6 minutes because his dog walker tagged his dog's Instagram account, which had his old address in the bio from 2020. He didn't leak his address. His dog did.

The fix is pre-emptive poisoning and removal. You can't just delete. You have to audit what search engines think you are. Search yourself like someone who hates you would. Then dork yourself like someone who is paid to find you would.

3. The Metadata Trap: Your Files Are Snitching On You

This is the one that gets journalists and activists caught.

You take a photo of a sensitive document. You crop out your face. You post it anonymously. Congratulations, you just uploaded a file that contains:

Exact GPS coordinates where the photo was taken
Your iPhone model and iOS version
The time you took it down to the second
Often, your full name if you had "Save as: Void_Rane_license.jpg"

That's EXIF data. And it's not just photos. Word docs have author names and revision history. PDFs have the software that created them and sometimes the path it was saved to: /Users/void.rane/Documents/DO NOT LEAK/. I've seen it. Multiple times.

Feds love metadata because it holds up in court and you volunteered it. Exes love it because iPhones embed location by default and most people have never turned it off. Journalists hate it when their sources do it, because it burns the source without the journalist ever knowing.

A few months ago, a very smart person sent me a "fully anonymized" video. I ran exiftool on it and got the exact Airbnb they were staying in from the audio fingerprint of the smoke detector.

The fix is a Ghost Mode workflow. Never post originals. Ever. Screenshot the photo, screen-record the video, copy-paste text into a fresh .txt file. Run everything through a metadata nuker before it touches the internet. If your workflow doesn't include a deliberate metadata removal step, you don't have a privacy workflow. You have a hope.

4. The Network Pivot: You Are Your Friends

You can be perfect. Your friends won't be.

This is how 90% of real investigations close the loop. They can't find you, so they find the five people closest to you and watch them.

Your mom posts "So proud of my daughter moving to NoDa!" Your friend tags you at a climbing gym with the caption "my usual belay partner." Your roommate's Venmo is public and says "rent - 1520 Central Ave Apt 3B."

Journalists call this "mapping the network." Feds call this "two hops." Your ex just calls it "looking at who liked his post."

OSINT investigators have a saying: You don't need to find the target. You just need to find someone who loves the target enough to post about them.

Modern tools make this trivial. You can map an entire friend graph, cluster it by frequency of interaction, and identify the weak link — the person with 800 public friends, a public Facebook, and a habit of checking in everywhere. That person is your breach.

I once watched an investigator find a CEO who had gone fully off-grid by finding his executive assistant's Strava running route that started and ended at a private residence in Jackson Hole every morning at 6am.

He wasn't hiding. His assistant was exercising.

The fix is social media hygiene as a group project. Talk to your inner circle. Not in a paranoid way. In a respectful way: "Hey, please don't tag me in locations, don't post photos of my house/kids/car, and if you have to post that group photo, crop me or blur me." People who love you will get it. The ones who don't were never going to respect your boundaries anyway.

5. AI-Native OSINT: The Game Just Changed and You Didn't Notice

This is the new one. And it's the one that makes the previous four look quaint.

For ten years, OSINT was manual. You had to know where to look. Now AI looks everywhere at once.

Face search: PimEyes, FaceCheck.ID and a dozen private models can take one blurry photo from a protest, a bar, or a dating profile and find every other place that face has appeared online. Your journalist source wore a mask but forgot about the reflection in their glasses? Found.
AI-enhanced imagery: That license plate you blurred? AI de-blurs it. That background you thought was too dark to see? AI enhances it to daylight. That voice note you disguised? AI voice-to-text plus voiceprint matching.
Pattern synthesis: AI can ingest 3,000 of your tweets, your Reddit history, and your Spotify playlists and predict with scary accuracy where you live, your political views, your mental health state, and your schedule. Not because it's magic. Because humans are predictable and you are training the model on yourself for free.

Exes use this now. Not just nation-states. There are TikTok tutorials for "how to find his new girlfriend with AI." It's not underground anymore. It's consumer software with a pastel UI.

This is why old privacy advice — "use a VPN" — is now basically astrology. A VPN doesn't protect you from yourself posting 400 searchable data points a day.

The fix is going AI-native on defense. You need to understand what AI sees when it sees you. Run your own face through PimEyes. Run your own writing through a stylometry detector. See what a clustering model thinks your friend group looks like. You cannot defend against what you don't measure.

Look, here's the uncomfortable conclusion no one wants to say out loud:

Privacy in 2026 is not about having something to hide. It's about having something to protect. Your focus, your location, your relationships, your future leverage. Every app you use is built on the assumption that you are the product and your data is the inventory. Journalists, exes, and feds are just power users of that system.

You have two choices. You can be searchable by default and surprised when it matters. Or you can be intentional by default and boring to find.

Boring is the goal. Boring is freedom.

If you want to go from "I should probably be more private" to having an actual, working system — not just a list of tips — I put my entire playbook into three packs:

For disappearing: My Privacy / OpSec stack covers the full Nukepack for account deletion, Ghost Mode for daily browsing, how to actually do OSINT pivots defensively, metadata nuking workflows, and the AI-native OSINT defense toolkit. It's the system I wish someone gave me 5 years ago.

→ Privacy/Opsec Stack: Nukepack + Ghost Mode + OSINT Pivots + Metadata + AI-Native OSINT — numbpilled.gumroad.com/l/privacy-opsec-stack

For going fully offline: If you want AI that can't snitch because it never touches the cloud — the Pi 5 NVMe + Hailo-8 + Pico W cluster build, local LLMs, offline workflows. Your own private Skynet in a Pelican case.

→ Offline AI Cyberdeck Pack — numbpilled.gumroad.com/l/offline-ai-cyberdeck-pack

For learning to see like they see: If you want to understand the investigator mindset — the Dork Bible with 400+ operators, pivot workflows in Obsidian, and the AI toolkit I use for investigations. Learn offense to build better defense.

→ OSINT Investigator Pack: Pivots + Dork Bible + Obsidian Workflows + AI Toolkit — numbpilled.gumroad.com/l/osint-investigator-pack

Stay boring out there.

The Post-Privacy Internet: How to Be Untrackable in 2026

v. Splicer — Wed, 05 Aug 2026 13:57:27 +0000

Privacy is dead. We just keep refreshing the obituary hoping for a correction.

If you're reading this, you've already felt it. The ad that knew you were pregnant before your family did. The AI voice clone that called your mom. The recruiter who found your anonymous shitposting account from 2019 because you used the same avatar.

We don't have a privacy problem anymore. We have a post-privacy condition. And the rules changed while we were all arguing about cookies.

Welcome to 2026.

1. You Are Not Being Tracked. You Are Being Rendered.

The old mental model is killing you. You think tracking is a guy following you with binoculars. In 2026, it's an oil painting.

Every data point you leak — your typing cadence, your scroll depth, your Wi-Fi probe requests, the way your phone's accelerometer twitches when you walk — is a brushstroke. No single stroke identifies you. But together? The model renders you in 4K.

This is why your old privacy stack doesn't work. You installed a VPN in 2020 and felt like Edward Snowden. Cute.

In 2026, the adversary isn't your ISP. It's a triad:

1. The Corporate Mesh: Google, Meta, Apple, Microsoft, plus 400 data brokers you've never heard of who trade your location history like Pokemon cards.

2. The AI Scrapers: Every public thing you've ever posted has been ingested, embedded, and turned into a searchable vector by 50 different startups building "people search" tools.

3. You. Your metadata is the real rat. You use a private messenger but send photos with EXIF GPS intact. You use Tor but log into your personal Gmail in the same session. You wear a mask but keep your Bluetooth on.

Untrackability isn't a product you buy. It's a discipline you practice. And it starts with understanding that anonymity is not secrecy. Anonymity is non-attributability.

2. The Five Leaks That Actually Fuck You

Forget what the VPN ads told you. Here are the leaks that get people doxxed, stalked, fired, and scammed in 2026.

Leak #1: Your Browser is a Fingerprint Scanner
Your browser fingerprint is more unique than your actual fingerprint. Canvas, WebGL, fonts, screen resolution, timezone, battery API — even with a VPN, you stand out like a neon sign. If you're not using a hardened, uniform browser profile, you're not private.

The fix isn't Brave out of the box. The fix is a browser that lies consistently. Mullvad Browser, or Firefox with Arkenfox, in its own isolated VM or container. One profile = one identity. Never cross-contaminate. Your normie browsing and your private work should not even know each other exist.

Leak #2: Your Phone is a Loyal Dog That Barks Your Location to Everyone
Your phone pings cell towers, scans for Wi-Fi, begs for Bluetooth connections, and shares your precise location with 30 SDKs hidden in your flashlight app. Turning off "Location Services" is theater.

Real mobile OPSEC in 2026 means compartmentalization. Your daily driver is compromised by definition. If you need actual privacy, you need a second device — de-Googled, GrapheneOS or CalyxOS, no SIM tied to your ID, faraday bag when not in use. Or at minimum: GrapheneOS user profiles, network permission toggled off for 90% of apps, and a personal rule that your phone never goes where you wouldn't want to be photographed.

Leak #3: Metadata Will Get You Killed (Professionally, Socially, Literally)
The content of your message is encrypted. Who you messaged, when, for how long, from where, and what file you attached? That's all in the clear, and it's more revealing than the message itself.

A photo you took? Contains your camera model, lens, exact GPS, time, even your altitude. A PDF you exported? Contains your name, OS, and software version. A voice note? Contains your background noise signature.

Learn to nuke it. Every file that leaves your device gets scrubbed. No exceptions. ExifTool -all=. MAT2. And assume your AI assistant is logging everything unless it's running locally, offline, on your own hardware.

Leak #4: Your AI Tools Are the Ultimate Fed
You outsourced your thinking to a cloud model that logs every prompt. Congratulations, you just created the most detailed dossier on yourself that has ever existed — your insecurities, your business ideas, your health questions, your search history on steroids.

If your OSINT, your journaling, your research isn't happening locally, it's not private. Period. The move in 2026 is offline AI. A Pi 5 with an NVMe and a Hailo-8 accelerator running Llama 3 or Mistral locally will do 80% of what ChatGPT does with 0% of the surveillance. Air-gapped is the new incognito.

Leak #5: Your Past Selves Are Betraying You
You can be perfect today and still get burned by 2017 you. Old forum accounts, reused usernames, password dumps, that one time you used your personal email for a crypto exchange — pivots are everything.

Investigators don't start with you. They start with a username, an email hash, a phone number, and they pivot. HaveIBeenPwned, username enumeration, reverse image search, breach compilations. If you haven't audited your own digital trail with the same tools an adversary would use, you're not doing privacy, you're doing cosplay.

3. The Untrackable Stack for 2026 (That Actually Works)

So what does work? Not paranoia. Architecture.

Layer 1: Compartmentalize Your Lives
Stop trying to be one person who is "private." Be three people who never meet.

Public You: LinkedIn, Instagram, real name. This is the sacrifice. Let the algorithm eat here.
Private You: Friends, family, Signal, Proton. Real name but hardened. No public posts.
Nym You: Research, writing, exploring, building. No link to the other two. Different hardware, different network, different writing style.

Use Qubes OS, or at least separate browser profiles + VPN + OS user accounts. If a compromise in one bleeds into the other, your compartmentalization failed.

Layer 2: Fix the Network, For Real
A single VPN provider is a single point of failure. In 2026, you chain.

You -> Mullvad VPN -> Tor -> Mullvad VPN Exit

Or you run your own entry node. Use Nym or Tor for high-risk browsing, Mullvad/IVPN with no account for low-risk. Never free VPNs. If you're not paying with cash, crypto, or a burned email, you're the product.

And for the love of god, use DNS over HTTPS with a non-logging resolver. Your ISP selling your DNS queries in 2026 is like leaving your diary at Starbucks.

Layer 3: Go Ghost Mode IRL
Digital privacy without physical OPSEC is LARP.

Payment: Privacy.com virtual cards, Monero for things that need to be truly disconnected, cash for everything else. Your credit card history is a GPS track.
Travel: No loyalty programs. No airport Wi-Fi without a VPN router. Toll tags are trackers. License plate readers are everywhere.
Home: No smart speakers. Ever. Your TV is listening. Your Roomba is mapping your house and selling it.

Layer 4: Become Unscrapable
You can't delete yourself from the internet. But you can poison the well.

Obfuscate: Use slightly different names, birthdays, and details on non-essential services.
Reduce attack surface: Delete old accounts. Use SimpleLogin/AnonAddy aliases for everything. One service per alias. If one leaks, you know who sold you out.
Opt-out: Hit every data broker opt-out page. It's tedious, but services like DeleteMe or Optery do the legwork. Do it quarterly.

4. The Uncomfortable Truth

You will never be 100% untrackable. If a three-letter agency is specifically targeting you with zero-day exploits and a $10 million budget, game over.

But that's not your threat model. Your threat model is data brokers, AI scrapers, obsessive exes, cancel-culture archeologists, identity thieves, and a future where your health insurance premium is set by your grocery store purchases.

Against that adversary, you can win. Not by being invisible, but by being expensive to track. Make it cost $5,000 to figure you out instead of $5. Most adversaries will go bother someone easier.

Privacy in 2026 isn't about having something to hide. It's about having something to protect: your ability to think, explore, and become someone new without your past selves and corporate overlords vetoing it in real time.

The internet doesn't forget. But you can teach it to misremember you.

If you want to go deeper than the theory — actual configs, workflows, and toolchains I use daily — I've put the whole system into a few dense, no-BS packs:

The Privacy/OPSEC Stack — my full NukePack, Ghost Mode protocols, OSINT pivots, metadata nuking workflow, and AI-native OSINT setup. The baseline for disappearing in 2026. → numbpilled.gumroad.com/l/privacy-opsec-stack

The Offline AI Cyberdeck Pack — how I built a fully offline AI lab: Pi 5 NVMe build, Hailo-8 accelerator, Pico W field kit, and a Pi cluster for local LLMs. No cloud, no logs. → numbpilled.gumroad.com/l/offline-ai-cyberdeck-pack

The OSINT Investigator Pack — flip the lens. The exact pivot chains, dork bible, Obsidian investigation templates, and AI toolkit I use to audit my own footprint (and others). → numbpilled.gumroad.com/l/osint-investigator-pack

Stay untraceable out there.

AI Is Moving From Finding Bugs to Fixing Them

v. Splicer — Sat, 01 Aug 2026 16:34:49 +0000

For twenty years we built better smoke detectors. Now we are finally building firefighters.

We have gotten incredibly good at finding problems.

Your IDE underlines a vulnerability before you finish typing it. Your CI pipeline fails because a transitive dependency three levels deep has a CVE from 2019. Your inbox gets a Dependabot PR every Tuesday that you will politely ignore until Thursday. GitHub Advanced Security, Snyk, Semgrep, Wiz, Orca, Lacework, the alphabet soup of scanners has turned security into a very high resolution photograph of a burning building.

We know exactly where the fire is. We have a heat map. We have a severity score. We have a CVSS vector that nobody reads.

We just do not put it out.

That is the strange era we are exiting.

The Finding Economy Was Profitable

The last decade of AppSec was built on an unspoken agreement: tools find, humans fix. It was a sensible division of labor when finding was hard. You needed abstract syntax trees, taint analysis, symbolic execution, and a PhD to explain why your Python string concatenation was actually remote code execution.

So we built an entire economy around detection. Dashboards that count vulnerabilities. Leaderboards that shame teams for not triaging fast enough. Compliance frameworks that ask if you know about your bugs, not if you fixed them. The metric of success became mean time to detect, not mean time to remediate.

The result is predictable. The average enterprise has something like 50 to 100 days of open critical vulnerabilities, not because engineers are lazy, but because the funnel is fundamentally broken. You can generate ten thousand findings with a single scan. You cannot generate ten thousand fixes with a single engineer.

Finding scales with compute. Fixing scales with humans. And humans do not scale.

Anyone who has maintained an open source project knows this pain intimately. You get a beautiful, detailed issue report with a proof of concept, a CVSS score, and a polite note that you are endangering the internet. What you do not get is a patch that passes your tests, respects your architecture, and does not break the three weird edge cases only you know about.

We celebrated the finder. We burned out the fixer.

Why Fixing Is a Different Species of Problem

It is tempting to think of fixing as finding plus one more step. It is not. It is a different cognitive task entirely.

Finding is a pattern matching problem. Does this code look like that bad code I have seen before? Is user input flowing into a sensitive sink without sanitization? An LLM is shockingly good at this, because it has seen millions of examples of both good and bad code.

Fixing is a planning and context problem. To fix a bug correctly you need to understand intent, not just syntax. You need to know what the original author was trying to do, what invariants the rest of the codebase relies on, what the test suite actually covers versus what it pretends to cover, and how to make the smallest possible change that closes the hole without opening two new ones.

A bad fix is worse than no fix. A bad fix gives you false confidence and a new CVE with a different name.

This is why early attempts at auto remediation felt like a Clippy for security. "It looks like you have a SQL injection, would you like me to add an ORM?" No, thank you.

What changed is not that models got better at writing code, although they did. What changed is that they got better at operating tools. The new generation is not a chatbot that writes a diff. It is an agent that can reproduce the bug, write a test that fails because of it, edit the source, run the relevant tests, observe the failure, try again, and iterate until the green checkmarks come back.

In other words, it can do the boring, methodical, unglamorous loop that human engineers actually do when they fix something. It just does not get tired at 2 AM.

We Are Entering the Patch Agent Era

Look at what is happening at the edges.

In open source, you now have agents that watch for new CVEs in your dependencies, check if you are actually exploitable, generate a minimal upgrade or patch, run your CI, and open a PR with a proper explanation. Not a version bump. A fix.

In enterprise security, purple teams are using agents to continuously exploit their own apps, then immediately write the guardrail that would have stopped it. The feedback loop that used to take quarters now takes minutes.

And in the lab, researchers are building self healing codebases. Systems where every night, an agent pulls the latest vulnerability feeds, clones your repos, tries to break in, and if it succeeds, patches itself, tests itself, and leaves a commit message that is more thorough than most of your interns. It is not science fiction anymore. It is just engineering that is slightly ahead of adoption.

This is a profound shift in metaphor. We are moving from security as a camera to security as an immune system. A camera records an intruder. An immune system neutralizes it, remembers it, and gets better next time.

The immune system model also understands something the camera model never did: you cannot fix everything. You have to prioritize by exploitability, by blast radius, by whether this service is actually exposed to the internet or buried behind three layers of auth that you swear are there. Agentic fixers are good at that triage, because triage is reasoning, not just ranking.

The Trust Problem Nobody Wants to Talk About

Of course, there is a catch. And the catch is trust.

Will you let an AI push code to main?

Most teams will say no, correctly. The early adopters will have guardrails. Human in the loop approval. Restricted file paths. No changes to auth logic without a human review. Full test runs plus ephemeral preview environments plus semantic diff checks.

But that boundary will move. We already let Dependabot merge patch updates automatically if tests pass. We already let Copilot write 40 percent of our code. At some point, the risk calculus flips. What is riskier: letting an agent patch a well understood path traversal in a well tested utility function, or leaving that path traversal open for 87 days while you wait for a human to find a free afternoon?

We will learn to trust fixers the same way we learned to trust compilers. At first, people inspected the assembly output. Then they stopped, because the compiler made fewer mistakes than they did. We are not there yet for security patches, but we are walking that path.

The teams that win will be the ones who build verification better than they build generation. The fix is not the hard part anymore. Proving the fix is correct, safe, and minimal, that is the product.

Think property based tests that the agent generates alongside the patch. Think formal verification for small critical functions. Think second agent models whose only job is to try to break the first agent's patch. An adversarial system that looks a lot like the immune system again: attackers and defenders coevolving inside your CI.

What This Means for Humans

If AI moves from finding bugs to fixing them, what do humans do?

We do the work we were supposed to be doing all along. We stop acting like very expensive linters and start acting like architects.

Humans will set policy: what is allowed to be auto fixed, what requires review, what risk tolerance we have for different systems. Humans will design systems that are easier to fix, smaller blast radius, better tested, more explicit about invariants. Humans will do the weird, cross system reasoning that agents are still bad at, like realizing that fixing this bug in service A will break an undocumented assumption in service B that finance relies on every quarter end.

And perhaps most importantly, humans will be freed to do proactive security instead of reactive ticket closure. Threat modeling. Secure by design. Actually deleting code instead of endlessly patching it.

The dream was never to have a dashboard with zero findings. The dream was to have systems that do not need a dashboard to stay safe.

We spent twenty years shouting louder about fires. The next ten will be about buildings that do not burn.

I build small, practical tools for this exact future, focused on defense, resilience, and systems that fix themselves.

If you want to play with the ideas from this post:

The $20 SOC: Build a Tiny Defensive Network Monitor is how I think about affordable detection for home labs and small teams.

Build the Blackbox: An Offline AI Field Terminal That Works When Nothing Else Does is my guide to building AI systems that work completely disconnected, which matters a lot when you are patching in hostile environments.

Synthetic Corporation Defense: Purple-Team Your HR Before 500 Fake Employees Do covers the other side of the coin, when the attacker is AI generated too.

And Self-Healing Legion: AI That Finds and Patches Its Own CVEs While You Sleep is the full implementation of what I described here, an agentic legion that hunts and fixes its own vulnerabilities on autopilot.