UncleSp1d3r

A defender-oriented tour of IoT and OT security for smart cities and critical infrastructure. Covers the architecture as deployed, the protocol footguns, the botnets and campaigns that keep showing up, the Flock license plate reader fight, and the regulatory pressure reshaping the market in 2026.

The CD-ROM took an audio format built for classical music and turned it into the substrate of the multimedia PC. This post traces the technology across five phases, from the videodisc wars to DVD, digs into the physics and error correction that made it work, and covers the security lessons (autorun, bootable media, physical supply chain) it left behind.

Rust’s memory model is the reason it’s showing up everywhere from Linux kernel drivers to security tooling. This post covers the parts of Rust’s memory story that go beyond ownership 101: lifetimes and borrowing subtleties, interior mutability (Cell, RefCell, RwLock), shared ownership (Rc, Arc), unsafe and raw pointers, custom allocators via GlobalAlloc, and secure zeroization for cryptographic material.

SSRF (OWASP A10:2021) is the vulnerability that gave attackers Capital One’s IAM credentials and 106 million customer records. This post covers what SSRF is, the URL parser tricks and DNS rebinding techniques that get past naive defenses, cloud metadata service targeting, and the defenses (IMDSv2, allowlists, DNS pinning) that actually work.

How ICS and SCADA environments actually get breached, network segmentation, weak authentication, unpatched legacy software, thin monitoring, and vulnerable remote access, paired with the real incidents (Triton, Mirai, WannaCry, Stuxnet, Oldsmar, the Ukrainian grid attack) that show each failure mode in production.