A Clean Audit Is Not a Safe Version
Two days after a Critical Next.js RCE shipped, npm audit still called the affected version clean.
RoamingPigs Field Manual · Independent technical publication
Computing, after the marketing has worn off.
Postmortems, contrarian takes, and the patterns that actually hold up in production. Written by Cisco Caceres. Navy veteran. MSNBC CMS in 1995. ECHO push platform at 3,000 instances in 2014. Building Abundera now.
- 189 articles
- 7 categories
- Sunday digest, weekly
- 0 ads, vendors, or trackers
Latest
Your Server Has More Than One Trust Store
My Ubuntu server installed the eMudhra fix and said done. Its Java keystore had not changed in a year.
Recent articles
Browse all →
The Door Was Patched. The Room Was Not.
Langflow's critical RCE was marked fixed in 1.9.0. A second advisory says that only locked the front door.
The Attestation Was Valid. The Source Wasn't.
Attackers keep shipping malicious npm releases with valid provenance. I tried to break the popular fix, and it broke.
Nobody Stole the Keys
Bitget's forensic reports describe a tool that filled in its own risk checks. The first fix I tried broke.
Your Dashboard Shows a Request Nobody Makes
A per-service p99 describes one backend. A request that fans out to a hundred of them meets the slowest of the hundred.
Read the Reconciliation, Not the Metric
A $1.37 billion half-year loss became a $141.8 million margin in one S-1 table. How to read any such bridge.
Recently updated
Full archive →These articles were revised after publication. They keep their original dates in the archive and the feed; this is where the revisions surface.
Noise Processing for ASR: Test the Recognition Effect
Scoped acoustic claims and added a registered front-end and context evaluation protocol; no new recognizer measurements.
Domain-Specific ASR: Evaluate Vocabulary Before Adapting
Distinguished domain examples from measured outputs and clarified held-out adaptation and task-acceptance evaluation; no new model results.
What ASR Accuracy Benchmarks Leave Out
Added a reproducible word-error scorer, evaluation registry and procurement examples, and discussed the limited third-party ASR comparison. The benchmark was not rerun for this revision.
Voice AI: From Demonstration to an Evaluated Deployment
Scoped deployment examples, labelled the scorecard as editorial guidance and added a whole-pipeline pilot protocol; no measured deployment sequence is claimed.
The Sunday digest
One email Sunday morning. The week's contrarian tech essay, in your inbox.
Double opt-in. One-click unsubscribe at the bottom of every issue.
Editor and publisher
Cisco Caceres
His first program went into an Altair through front-panel switches in the late 1970s. Served aboard the USS Missouri through Desert Shield and Desert Storm. Built the CMS behind MSNBC in the 1990s, ran 60 servers in his basement before AWS existed, and scaled a push platform to 3,000 cloud instances in the 2010s. Built voice AI for federal agencies in the 2020s. The Field Manual is independent of his current ventures, all of which are listed in disclosures.