Notes on HBCC

I timed EPSS against CISA on 204 exploited CVEs. It mostly forecasts yesterday's rain – part 2/3

Tue, 03 Nov 2026 00:00:00 +0000

Part 1 ended on a claim it could not yet settle: on the day a CVE is published there is almost nothing to rank it by, unless it arrives already loud, so the design problem is asking again on later runs. Ten days was an anecdote. This is the claim measured over longer, and the finding is uncomfortable: the signal the whole architecture leans on, the probability a vulnerability will be exploited, stayed silent.

A CVE triage pipeline that keeps asking, because day one tells you nothing

Sat, 31 Oct 2026 00:00:00 +0000

The pipeline is called Rappaport, after a scientist in Lem’s His Master’s Voice, a novel in which a team of researchers reads meaning into a signal from the stars and slowly learns that the meaning tells them more about themselves than about the signal. That is the failure I kept meeting in the field. A detection stack returns a confident verdict, and the confidence comes from how little it has seen. When partial signal can corrupt the verdict, priority cannot be read off whatever a record claims about its own severity. It has to be computed from signal that actually predicts exploitation, before anything a model could be talked into gets near it.

Counting a Snowflake proxy's users without becoming its honeypot

Fri, 30 Oct 2026 00:00:00 +0000

My Raspberry Pi 1 has been relaying Tor traffic as a Snowflake proxy since 20 October. The first entry covers the setup. This one started with a simple question: where do the people using it come from?

A Snowflake proxy on a first-generation Raspberry Pi

Wed, 28 Oct 2026 00:00:00 +0000

The oldest computer in my lab is a Raspberry Pi 1 Model B from 2012: one ARMv6 core at 700 MHz, 512 MB of RAM, a 100 Mbit network port. Too slow for almost anything people use a Pi for today, so I wanted to know whether it could still do something useful. It turned out it could: for the last couple of weeks it has been helping people in censored countries reach Tor.