blog
Cyber Threat Intelligence in Machine Learning
A rant and an open research problem: mapping CTI reports to MITRE ATT&CK is a sparse multi-label extraction task with a fuzzy label space and frozen benchmarks. Bigger models aren't the fix. Disagreement is data, and nobody's built the marketplace for it.
From One Tracking URL to Every DoorDash Customer's PII
Two unauthenticated bugs on DoorDash's Drive flow expose customer names, home addresses, sub-meter GPS, and dasher phone numbers. One was accepted by the vendor nine months ago.
Reading Anyone's Private Meta AI Conversations — Without Authentication
The sendMessageStream GraphQL mutation on meta.ai doesn't check whether you own a conversation. One API call to read anyone's full chat history.