#security
6 articles
01
·Inference & Serving·★ MEMBER·PAPER·11 min read
Paper walkthrough: CyberFactory — turning wild CVEs into runnable training problems
An open-source pipeline that converts real CVEs into executable, verifiable tasks and uses a reusable vulnerability-analysis skill to synthesize teacher trajectories the student then internalizes. 58.1% Pass@1 on CyberGym.
02
·Agents·FREE·11 min read
MCP and Tool Protocols — The Standard That Connects an Agent's Hands
When an LLM touches your calendar or your database, what is actually wired to what? From what a tool call really is, to the N×M problem MCP solves, to designing tool definitions, to the security boundary you cannot design around — starting from zero.
03
·Security·★ MEMBER·10 min read
TLS from Scratch — Key Exchange and Certificates
Behind the padlock icon, your browser pulls off something strange: it agrees on a secret with a stranger, over a wire everyone can read. This walks through key exchange, certificates, and the TLS 1.3 handshake from zero, ending with why a man in the middle cannot win.
04
·Security·★ MEMBER·PAPER·9 min read
LLM Security — Prompt Injection and How to Actually Defend Against It
A language model cannot tell your instructions apart from words printed on a document it was asked to read. This article works from that single fact to direct injection, indirect injection, the tool boundary that decides your blast radius, and the layered defence that actually holds.
05
·Security·FREE·13 min read
Cryptography from Scratch — Symmetric Keys, Public Keys, and Hashes
Cryptography isn't about producing unreadable text — it's about engineering an extreme gap in effort between people who hold the key and people who don't. We build up the three tools (symmetric, public-key, hashing) from zero, explain why factoring shows up at all, what a signature actually promises, and how every widely deployed cipher has eventually broken.
06
·Security·★ MEMBER·14 min read
Authentication and Authorization — From Passwords to OAuth and Passkeys
"Who are you?" and "what are you allowed to do?" are two different questions. This piece builds up password storage, sessions and tokens, the four actors in OAuth, and why passkeys resist phishing — assuming nothing to start with.