Networks and low-level work

All topics

A seven-layer diagram makes far more sense once you see the actual packet crossing it. The same goes for a TLS handshake, or for the chip that holds your keys: the theory stands on its own, but the capture is what convinces. This work is done on my own traffic and my own hardware, not on textbook examples.

8 pieces

Article2026-09-20Rust Coreutils 0.12 vs GNU 9.12: almost everything works the same, starting a process costs nearly three times more, and mv between disks loses the datesI measured Rust Coreutils (uutils) 0.12 against GNU coreutils 9.12 in containers with limits: the GNU test suite, 157 commands with their output compared, and process start-up. uutils is slower in 91 of 157 cells, takes 2.8 times longer to launch 5,000 processes, and mv across file systems loses the modification dates.#Rust#Coreutils#GNUArticle2026-09-13A chat on Amazon Bedrock AgentCore for my blog: I broke it with 64 messages and rebuilt it with rules outside the promptTutorial: LangGraph chat on Amazon Bedrock AgentCore with an S3 Knowledge Base and guardrails, tested on a 64-message chat. Costs and a local option.#AI#AWS#SecurityArticle2026-09-08I measured 320 Chilean sites: half already use post-quantum cryptography, and almost none of them chose toI probed the 320 most visited .cl domains: 145 negotiate X25519MLKEM768 (47.7%), but only 9 of the 128 with their own infrastructure. Measured cost: 0 ms.#Post-quantum cryptography#TLS#ChileArticle2026-09-07I built a fully post-quantum handshake, then went to see which of my servers could do itRustls turned ML-DSA certificates on by default, but only for private hierarchies. I built an mTLS where the key exchange, the server signature and the client identity are all post-quantum. I measured what the chain weighs, which version of each server supports it, and corrected a number I had got wrong: the private key is not nineteen times bigger, it is 128 bytes.#Post-quantum cryptography#TLS#mTLSArticle2026-08-26I built a public sandbox for Chile's Open Finance System, and Keycloak alone did not get thereChile has an open finance regulation and no public sandbox to test it against. I built a complete unofficial one, faithful to the Technical Annex: participant directory, bank, authorization server and requesting application, with mandatory PAR, an encrypted request object, mTLS and RAR reaching the token. Keycloak 26 covers much of it through configuration, but the consent model Chile picked does not exist in the product: it had to be written from scratch.#Seguridad#Arquitectura#ChileArticle2026-08-15The chip that guards your keys is broken: I audited all four machines in my swarmTwo flaws rated CVSS 8.5 and 8.3 in firmware TPM affect Ryzen 3000 through Ryzen 9000 and Intel up to Ultra 200. I checked my four machines: two are affected, one has had a patch since July and the other was abandoned by its vendor in 2022.#Security#Hardware#LinuxArticle2026-08-15PhantomRelay: why your automation gives itself away before the first HTTP byteA Node HTTP client is distinguishable from real Chrome in the TLS handshake, before sending a single header. How I built a browser relay with a Rust addon over BoringSSL, cost-based escalation and nearly 900 tests.#Systems#NetworksArticle2026-08-14The OSI model explained: the 7 layers and encapsulationWhat the OSI model is, what each of its 7 layers is for, and how a piece of data gets encapsulated into segments, packets, frames and bits as it travels across the network.#Networks#Low level

All writing