-
2026-09-15
A distributed key-value store where the application chooses, per row, between plaintext (scannable, countable) and encrypted (blinded names, AEAD values, key rotation). How the consensus, key distribution, and both storage modes work, and where it fits in the lockboot stack.
-
2026-06-24
EC2's UEFI firmware has no driver for the network card AWS put in the instance, so a firmware-level netboot has no network at all. Here is a clean-room Rust UEFI driver for the ENA adapter, the 24-reboot hunt for the one undocumented register that gates it, and the pile of confident theories that were all wrong.
-
2026-06-13
A ~150 KB UEFI loader that pulls, verifies, measures and boots a signed payload over HTTP. Configure a fleet once, publish new builds to a signed release channel, and machines roll forward on the next boot — no re-imaging, no metadata changes.
-
2026-02-11
How lockboot establishes trust using cloud vTPMs — the generic boot model, provider-specific trust chains for AWS Nitro and GCP, and what this doesn't protect against.
-
2026-02-10
Dynamic VMA calculation, aarch64 PE vmlinuz support, and QEMU test harness improvements.
