Kyeson: Notes on Securityhttps://kyeson.com/Essays by Kyeson Blake Utley on application security, the software supply chain and cryptographic engineering.Seed-phrase phishing: the five-second mistake that empties a wallethttps://kyeson.com/notes/seed-phrase-phishing/https://kyeson.com/notes/seed-phrase-phishing/No exploit, no malware, no broken cryptography. Just twelve words typed into the wrong box.Fri, 09 Oct 2026 12:00:00 GMTPig butchering: how the scam works, and the trail it leaves on-chainhttps://kyeson.com/notes/pig-butchering-on-chain-trail/https://kyeson.com/notes/pig-butchering-on-chain-trail/The fraud is patient, personal and industrial. The money still has to move, and that is where it shows.Tue, 06 Oct 2026 12:00:00 GMTA web application firewall is a speed bump, not a wallhttps://kyeson.com/notes/waf-is-a-speed-bump/https://kyeson.com/notes/waf-is-a-speed-bump/WAFs buy you log lines and minutes. Treating one as your security boundary is how breaches happen.Fri, 02 Oct 2026 12:00:00 GMTYour dependency tree is your real attack surfacehttps://kyeson.com/notes/dependency-tree-attack-surface/https://kyeson.com/notes/dependency-tree-attack-surface/You reviewed the code you wrote. The code you didn't write is most of what you ship.Fri, 02 Oct 2026 11:00:00 GMTConstant-time is a property of the binary, not the sourcehttps://kyeson.com/notes/constant-time-is-a-property-of-the-binary/https://kyeson.com/notes/constant-time-is-a-property-of-the-binary/You can write perfectly branch-free crypto code and still ship a timing leak. The compiler gets the last word.Fri, 02 Oct 2026 10:00:00 GMT