A CVE triage pipeline that keeps asking, because day one tells you nothing

Sat, 31 Oct 2026 00:00:00 +0000

The pipeline is called Rappaport, after a scientist in Lem’s His Master’s Voice, a novel in which a team of researchers reads meaning into a signal from the stars and slowly learns that the meaning tells them more about themselves than about the signal. That is the failure I kept meeting in the field. A detection stack returns a confident verdict, and the confidence comes from how little it has seen. When partial signal can corrupt the verdict, priority cannot be read off whatever a record claims about its own severity. It has to be computed from signal that actually predicts exploitation, before anything a model could be talked into gets near it.

Counting a Snowflake proxy's users without becoming its honeypot

Fri, 30 Oct 2026 00:00:00 +0000

My Raspberry Pi 1 has been relaying Tor traffic as a Snowflake proxy since 20 October. The first entry covers the setup. This one started with a simple question: where do the people using it come from?

threat-model on HBCC

A CVE triage pipeline that keeps asking, because day one tells you nothing

Counting a Snowflake proxy's users without becoming its honeypot