I've had this blog for a while, and I still find it hard to say what it's about. Not because I don't know — the topics just don't fit into one neat box.
I work on AI systems. I like to see what they really do, not only what they look like on the surface. I spent years in cybersecurity, so that habit stuck: what a system shows you and what it does inside are often not the same thing.
I build things, but I also care about the ideas behind them. If you only copy solutions, you never really learn why they work. So I write about pipelines and architectures — and also about stuff that has nothing to do with either.
I write about my own projects. About things that annoy me. About small notes that don't fit anywhere else.
Is this a blog about tech? About people? A bit of both? I don't know. Mostly it's for someone who can't stop asking how things actually work.
The entire Hermes Agent project is unresponsive, unintuitive, unsafe, vibe-coded — do not entrust it with any confidential information, I advise against buying a subscription or hosting it locally. It is a really poor project.
Eliminate the overhead and lack of idempotency of a full Windows system in automated testing. A practical guide to configuring WinPE and QEMU for lightning-fast boot, automating kernel debugging, and avoiding KDNET pitfalls.
I present a practical demonstration of how the integrity of a language model can be compromised during inference by modifying quantized weights in a GGUF file without restarting the server or injecting code. This highlights the importance of considering model storage and memory mapping in LLM security.
I write about how I discovered a vulnerability in the Wirtualna Polska (WP) mail service, which allowed me to execute stored XSS in user session. I explain the technical details of the bug, how I exploited it, and the response from WP's security team.
I write about how publicly exposed AI features can be exploited to extract models and perform free inference, highlighting the risks of model theft and the potential for systematic misuse of AI APIs.