Posts

A model may leak encoded prompt fragments yet corrupt the final decode. Capture verbatim tokens, preserve case and order, and transform them deterministically.

Dollar-prefixed action inputs can reach React Flight decoding. Reproduce decoding locally, compare error digests, and avoid mistaking a parser signal for RCE.

Passing a request line to snprintf as its format string turns logging into memory disclosure. Use a constant format and keep secrets out of process memory.

rsync into an encrypted APFS sparse bundle stored on an SMB share failed on every write with error 45. The files were fine. APFS inside the image needs F_FULLFSYNC on the band files, the NAS's SMB server doesn't support it, and a short Python probe proves it.

A backup job on a macOS SMB share kept dying with EBADF. The NAS stalled under load, macOS reconnected without a word, and because the old SMB 2.1 server granted no durable handles, every open file on the share went bad, including the bash script that was running. Only the kernel log says so.

Three times a coding agent read a result from a check that never ran: zsh's `log` builtin (`(eval):log:1: too many arguments`) hid `/usr/bin/log`, `cargo test --exact` matched no test and passed, and an empty variable from "argument list too long" made 400 of 400 runs fail.

An app-hosted iOS test target passed in the console and failed in fastlane. The host app's own login screen made a network request at launch, and its response reached an unimplemented swift-dependencies test value after the tests had started. The failure belonged to no test and was visible only in the result bundle.

A Debian 13 server had unattended-upgrades enabled, its timers ran every day, and 61 security updates sat uninstalled. The config used Ubuntu's Allowed-Origins lines, which match the suite, and Debian's security suite is stable-security, not trixie-security.

A macOS FSKit extension mounted from the command line could stat its source folder but not read it. The extension sandbox was denying file-read-data on a plain path. Reinstalling the app then switched the module off in a way pluginkit does not undo.

Keep Claude Code local, use SSH for remote commands, and submit long jobs to OpenPBS with explicit resources, paths, and completion checks.