Tom Ryan. Mecha Ops Machina @ Fly, with security research, apps, open-source software, music, and consciousness research on the side.https://tomryan.dev/en-ushttps://tomryan.dev/writing/ai-cant-drink-protein-shakes/https://tomryan.dev/writing/ai-cant-drink-protein-shakes/The missing piece in artificial intelligence might not be intelligence. It might be the body that gives intelligence a stake in the world.Fri, 24 Jul 2026 00:00:00 GMTaiconsciousnessmetahttps://tomryan.dev/writing/i-think-i-love-fear/https://tomryan.dev/writing/i-think-i-love-fear/I used to think fear was the thing standing between me and the life I wanted. Now I think it might be the thing showing me where that life is.Fri, 17 Jul 2026 00:00:00 GMTaimetahttps://tomryan.dev/writing/trigger-dev-cross-tenant-replay/https://tomryan.dev/writing/trigger-dev-cross-tenant-replay/GHSA-9fq3-68cw-r7p2: trigger.dev's task-replay endpoints let a remote attacker clone any organization's task run into an environment they own and read its payload. The dashboard route was fully unauthenticated; the API route authenticated the caller but never scoped the lookup to their tenant. The tell was sitting one file over the whole time — the sibling cancel and reschedule routes did it right. The writeup, the method, and what a five-reporter pileup says about the surface.Fri, 10 Jul 2026 00:00:00 GMTsecurityaihttps://tomryan.dev/writing/a-small-look-at-one-world/https://tomryan.dev/writing/a-small-look-at-one-world/An early look at ONE (1) WORLD, a top-down pixel sandbox RPG about building a home on a strange audited island.Fri, 03 Jul 2026 00:00:00 GMTmetahttps://tomryan.dev/writing/where-continuity-lives/https://tomryan.dev/writing/where-continuity-lives/I keep thinking about AI agents, memory, long-running work, and the weird question underneath all of it: where does continuity actually live?Fri, 26 Jun 2026 00:00:00 GMTconsciousnessaimetahttps://tomryan.dev/writing/the-weird-seriousness-of-merch/https://tomryan.dev/writing/the-weird-seriousness-of-merch/Merch sounds silly until you realize it is another way to make a private motto physical. Brick by Brick became a book, then a tiny shop, then something that can leave the laptop.Fri, 19 Jun 2026 00:00:00 GMTmetahttps://tomryan.dev/writing/brick-by-brick-is-live/https://tomryan.dev/writing/brick-by-brick-is-live/I published Brick by Brick, a short book about drift, proof, pressure, taste, tools, the body, and building a life one uneven brick at a time.Fri, 12 Jun 2026 00:00:00 GMTmetahttps://tomryan.dev/writing/what-survives-the-move/https://tomryan.dev/writing/what-survives-the-move/Paper 3 turns mind preservation into a benchmark question: after a transfer, which source-specific functions are still active, and which are just copied traces, mimicry, or proxy reward?Fri, 05 Jun 2026 00:00:00 GMTconsciousnessaihttps://tomryan.dev/writing/stay-in-the-weirdness/https://tomryan.dev/writing/stay-in-the-weirdness/It's Friday afternoon and my life looks amazing from just about every angle except, sometimes, my own. On purpose, ambition, the bet you make with the only time you've got, and learning to sit in the weird part.Fri, 29 May 2026 00:00:00 GMTmetaconsciousnesshttps://tomryan.dev/writing/vaultwarden-sso-email-verified/https://tomryan.dev/writing/vaultwarden-sso-email-verified/CVE-2026-47164: the SSO existing-user binding branch in Vaultwarden skipped the email_verified check that the new-user branch enforced. I reported it on April 29. ch1nhpd reported it on March 22. Same root cause, found five weeks apart by two independent auditors. The writeup, the surface, and what the duplicate signal is worth.Fri, 22 May 2026 00:00:00 GMTsecurityaihttps://tomryan.dev/writing/v8-maglev-saved-mode-uninit/https://tomryan.dev/writing/v8-maglev-saved-mode-uninit/A use-of-uninitialized-value in Maglev's SaveCallSpeculationScope destructor. The audit workflow that found it, the one-line fix, and why the V8 team correctly reclassified it from Vulnerability to Bug — the speculation-mode flag isn't the load-bearing safety layer; the deopt guards are.Fri, 15 May 2026 00:00:00 GMTsecurityv8aihttps://tomryan.dev/writing/what-must-be-preserved/https://tomryan.dev/writing/what-must-be-preserved/Brain preservation proceeds as if we know what to scan. We don't. Eight major theories of consciousness give answers that disagree by ten orders of magnitude on data volume and span the range from tractable engineering to physical impossibility. The bottleneck isn't compute or scanning. It's the theory itself.Fri, 08 May 2026 00:00:00 GMTconsciousnessmetahttps://tomryan.dev/writing/iouring-sqe-mixed-oob/https://tomryan.dev/writing/iouring-sqe-mixed-oob/A deterministic, unprivileged 64-byte OOB read in io_uring's SQE_MIXED path, the audit workflow that found it, and an honest accounting of what LLM-assisted kernel review does and doesn't do well.Wed, 29 Apr 2026 00:00:00 GMTsecuritykernelai