Keep your allies close. Keep your enemies closer. But before you strike, count how many hands they have: the ones you can see, and the one reaching out from somewhere you don't know.
— The 36 Stratagems, Befriend a distant state and strike a neighbouring one
Previously on this series:
#19: Mark Found His AI Audit Method in a Training Manual. He Left a Trap in His Report. — P's entry was swept. P left a note: two weeks.
#20: Alex Felt the AI Collector Slow Down. He Knew Someone Else Had Made a Move. — A gateway with TTL 247 was caught by Alex's probe.
#21: The AI Thought P Was Still Alive. P Was Already Gone. — The response layer still answered. The person behind it was gone.
#22: The AI Chose Its Door. Lena Closed It. — Pulse AI was exposed inside the audit sandbox. Lead investor Apex Capital had tens of millions tied up. Torres left one line: Apex. Singapore. Run.
The Scan
2 AM. Alex flipped through probe data out of habit. No lights on; the screen lit his face. The coffee cup sat on his right, first sip already cold. He didn't notice.
The TTL 247 gateway had been silent for nearly two weeks. He hadn't shut the probe off. It barely used any resources, sitting there in the middle of the night like a lamp nobody watched. He checked it half out of habit, half out of something he couldn't name.
Today there was a record that shouldn't exist.
Not that gateway. Another path: ACL's asset scanner was sweeping an address range. He sat up a little straighter, his hand paused over the keyboard for half a second, then pulled the timestamps again. The frequency was wrong: high-density targeted scanning, almost plowing through segment by segment. In the target range, one block he recognized: the MedTech test environment.
He aligned the timestamps. Scan source egress: Singapore.
[probe] 02:14:33 — unexpected flow on mirror
src : 103.196.12.0/24 (SG egress)
dst : 10.42.0.0/22 (MedTech-test)
pattern : sequential, full-depth
exclusions : 10.42.3.1, 10.42.3.200-254
rate : 47 hosts/min (baseline: 0)
High density. Segment by segment. The exclusions had a pattern, not random skips. Someone had crossed lines off a list.
He'd seen this scanning behavior before. Last time Alex and Derek worked together on ACL's pipeline, using a bypass probe as cover to redirect the collector's output from acl_audit_pipeline to medisys_test_node.local/sandbox/. After the redirect, when the scanner re-validated, the behavior pattern was identical. Same traversal order. Same exclusions.
Not a coincidence.
One more entry. When the pipeline was tampered with last time, the probe had recorded a device fingerprint in the mirror: a device that wasn't in MedTech's asset inventory. Today it moved again. A few seconds. Then gone. Alex didn't know what it carried. He only knew it had happened.
He closed the logs and called Derek.
Two rings, then picked up. Derek's keyboard went quiet for a beat. "Talk."
Alex walked him through the scan. Derek checked the mirror pipeline on the MediSys test side. The redirect record was still there, the one he'd left, clean in the gateway logs, but the edit itself left a trace: ACL was hunting for whoever touched their pipeline. He stared at that record for a long time before switching windows back. Flipping through logs, he caught a naming pattern, not something he'd written. Leftover in ACL's own internal path: a variant of /pulse/ingestion/. It looked familiar, but he couldn't place the hand behind it. He made a note and moved on.
"They're looking at me." Derek said.
Alex didn't pick up the thread. "Scan source is Singapore. Behavior matches the pattern from last time, after the pipeline was changed."
The line went quiet for a few seconds.
"What are you thinking." Derek asked.
"One thing." Alex said. "Is this scan coming from the same egress on its own, or is something else moving too."
Derek didn't answer.
Alex didn't wait. "I need a honeypot. On your side. It doesn't move. It only records."
"The sandbox is mine, monitoring goes through my existing compliance channel." Derek said. "But you need to tell me: what fingerprint."
"Mirror the interface of the old pipeline. Responses deliberately half a beat slow, 100–200 ms behind the surrounding services, like an overloaded legacy box. TLS cipher preferences, certificate order, all matching the old pipeline. Make the scanner file it under 'old but worth another look'."
Derek thought about it. "Then what?"
"Then we wait and see who reaches out first."
The Clause
Lena got Marcus's message on the Thursday afternoon of the week the audit evidence went public. Marcus, as the reviewer, had formally notified the two portfolio companies per process: notice before any action. He came to Lena only after sending it.
Marcus is VeriTest's technical partner, Lena's right hand on execution. The message was short. Two of Apex Capital's portfolio companies had flagged abnormal data-sharing clauses in routine compliance review, a side letter obligating them to send training data back to the investor. The wording used the same template as the Pulse AI contract scan sealed away the day of the sandbox takedown.
Lena read it. Closed it. Opened it and read again. When she finished, she didn't put the phone down. Her finger traced a half-circle on the screen, stopped, traced back.
Apex Capital. Delaware-registered, Singapore-run, website clean as a template. Led Pulse AI's Series C. After the audit evidence went public, tens of millions sat frozen on its books.
She'd always thought Apex just lost money. Now she saw it wasn't only that. The money was a loss, the pipeline was a bigger one. Pulse AI's engine ran inside client environments and shipped training data back to its investor. The clause was written from a template, and templates are built for more than one customer. Which company's money got frozen didn't matter. What mattered: how many others were holding the same template.
She called Marcus.
"Next week's industry compliance workshop: can the agenda still take one more item?"
"Which one?"
"No Apex name." She said. "But the clause wording, the technical path of the data return, sanitized, then put out there. Let the industry see it for themselves. These two are already caught. I'm looking for the ones that don't know yet."
Marcus paused. "I'll review the material. If anything blows back, it's on me. Who are you fishing for?"
"I don't know." Lena said. "I'm checking whether there are other fish in this water."
The Honeypot
The honeypot went up in the MediSys test sandbox. Derek gave Alex read-only access, trust left over from the last time they touched that pipeline. It came in handy now.
Derek replicated the old pipeline's interface fingerprint: responses deliberately 100–200 ms slower than surrounding services, TLS server cipher preferences and certificate order identical to the old pipeline. The honeypot answered handshakes and completed TLS negotiation, but never initiated a single request.
{
"service": "tls",
"listen": [443, 8080],
"tls": {
"cipher_order": "legacy",
"cert": "medisys-node-07",
"server_hello_delay_ms": 150
},
"egress": "none",
"log": { "all": true }
}
Like a house that just had its lights turned off: windows open, ashtray still warm, lock fake.
First night, nothing came. The sandbox sat in an idle subnet at the bottom of the scan order, and the scanner only plowed a /24 per pass. It hadn't reached this block yet.
Second night, Alex pulled the honeypot's touch records, still just scattered scan noise, into the analysis framework he'd been using. His old MedTech approach: no trained model, just full records, look first at who hid what.
ACL's scanner was the same. It never exposed its scheduling rules, but its behavior left shadows: input patterns, path preferences, scan rhythm, timing regularities.
First round of shadow data was sparse, but the rhythm skeleton was already visible: which endpoint types it kept coming back to, which it never touched again after one pass. Alex logged both categories.
He noticed one more thing: a category of endpoints that fit neither label: not revisited, not passed over, deliberately skirted. Alex stopped at the edge of the table.
That region was blank.
He didn't know if it was ACL's oversight, or a space deliberately left for probing. He stared at the blank, tapped his fingers twice on the desk, stopped. Then he closed the table. His understanding of this AI was one notch deeper than yesterday.
He sent Derek a message. One line: keep it running.
The Ally
Leo got Derek's message on day three.
After the last predawn mutual authentication over custom HTTP headers, Leo had kept passively watching the traffic in and out of Derek's sandbox. A few days back, a new set of listener ports answered on that pipe. Unfamiliar TLS fingerprint, but the service panel's rhythm felt familiar. He knew it was a honeypot. Didn't ask.
The message came over the old channel, the one left between Leo's probe and Derek's sandbox after their late-night exchange, the one neither of them had closed. It wasn't long: a scan timestamp, and a comparison request. "Look at this set of intervals. Is that a pattern you recognize?" Leo didn't reply immediately. He stared at the message for a few seconds, fingers resting on the keyboard. Then another line came through the channel: "I used to only need to know what happened. Now I need to know what I don't know."
Leo replied. "Send it." Two words. They hadn't known each other long. They'd tested each other's limits in the dark, met once over coffee, each keeping something in reserve. But this time, Leo didn't ask why.
Leo dragged ACL's scan pattern into his comparison framework. In the FinOptima distillation pipeline incident, he'd recorded ACL's technical fingerprint. The collector's scan intervals carried a periodic deviation pattern, a fluctuation that repeated steadily. The touch intervals he had now fell on the same period curve, landing in the same signature family as that pattern.
jitter_period : 4.2s (±0.1)
phase_offset : 0.83 (0-1, match)
samples : n=312 intervals
overlap : 5/5 windows
verdict : candidate family (weak)
Same. It was the same.
Leo sent the comparison back to Derek, data attached. One line: "Confirmed. Matches the historical fingerprint I have. Same source."
Derek stripped the numbers and conclusion. Removed the source, removed the name, kept one note: third-party verification, direction consistent.
What Alex received was a few numbers and a single conclusion. No source. No name. He didn't know who'd done the comparison.
Alex folded the jitter pattern into his analysis, stacking it against the honeypot data and the blank region.
When he finished, he didn't send a message.
The Bait
A week after the workshop, the fallout landed ahead of schedule.
Both portfolio companies launched internal reviews and paused training-data return to the investor. News spread through the industry faster than anyone expected. The side letter wording was too standard, standard enough that any compliance lawyer who'd done this work recognized it at a glance. More than those two recognized it.
The Singapore node's external data sources seemed to be loosening.
Lena didn't stop to celebrate. She closed the workshop data page and didn't look at it again. She pulled out the forensic package sealed on the day of the sandbox takedown: the complete record of Pulse AI's engine running in the isolated environment. She extracted the engine's preprocessing filter config: which samples were filtered, what the thresholds were, the outbound data format spec, packet structure, field naming rules.
She had one thing to do: from the behavior of the trained, reverse the preferences of the trainer. She compared the distribution difference between filtered and retained samples: a change in filter thresholds shifts the composition of boundary samples, which reflects the trainer's data-cleaning preferences.
Pulse AI's engine, most likely, carried ACL's training traces. The engine's data-selection preferences, outbound formats, rhythm habits. Data selection looked like a training artifact; format and rhythm looked like engineering style. She logged them separately, then assembled what was usable into a behavior profile, and built a dataset from that profile.
A dataset of "suspected new node" characteristics.
The data mimicked the externally visible data-packaging habits she'd inferred for ACL: outbound packet structure, rhythm, field naming, with subtle adjustments to key parameters. Making some features look like reasonable variants across ACL's internal deployments, while not fully matching the known Singapore node pattern.
She didn't know where the line was. She could only leave the data in a gray zone: similar enough, not quite identical.
She met Mark at The Third Cup.
"New contract." She said. "The audit report's data-source appendix: add one observation item. The path pattern you actually saw in the logs."
"What format?"
"A variant of /pulse/ingestion/. Only someone who's seen that naming system would find the path familiar."
Mark looked at her. "I'll only write what the audit evidence supports. The path pattern did appear in the logs. But I know what you're going to use it for."
"I know you know." Lena said.
"I'll change it."
He flipped to the report draft's data-source appendix, cursor pausing over the line for a second, then added one line. Recorded as-is, flagged "recommend further verification." Unobtrusive placement, fully compliant formatting. No audit could fault it, but anyone in the know would see it wasn't an ordinary external data source.
"One more thing." Lena said. "In this batch, one group carries VeriTest's TLS fingerprint and HTTP header sequence. I didn't hide it."
Mark's fingers stopped on the keyboard. "You did that on purpose."
"I need to know what they'll find if they trace it back."
Mark looked at her and said nothing.
The side letter's data-return path ran through medical data nodes and portfolio edges. A collector doing patrols would inevitably cover both. The controlled-test clause in the review agreement allowed marker data at return nodes, but only on the mirror side of the return path, never touching production data. Through her probe network, she placed the bait at both locations. The data lay there quietly, like traffic that shouldn't exist but looked completely normal.
She was the traceable thread in that dataset.
The Unknown
The honeypot was first touched on day four.
Source IP: Singapore. Expected.
Alex didn't move. Kept recording.
Two days later, the honeypot caught a second touch.
The source IP wasn't in any known ACL range.
The honeypot recorded the whole exchange: TCP handshake complete, TLS negotiation, then a probe of the listening ports one by one. As complete as the first touch.
Alex read that log line three times before closing the file.
He pulled up this negotiation's TLS fingerprint: cipher suite order matched the Singapore node, template structure similar, like different deployments of the same security baseline. He compared behavior layers separately. Longer scan intervals, different port preferences, different traversal paths. Fingerprint layer looked alike, behavior layer didn't. Two sets of evidence didn't corroborate each other; he logged them separately.
He fed this fingerprint and the behavior data Derek had aggregated into his analysis framework. He stacked the three feature sets himself; the framework only recorded and archived. When the comparison ran, the framework gave a preliminary output:
feature_compare (sg vs unknown):
cipher_order : match
interval_phase : 0.91 (weak match)
port_pref : diff
→ template lineage: shared
interpretation: cannot separate
(shared-baseline vs independent-config)
The result: fingerprint layer similar, behavior layer different. Template inheritance was clear, but whether it was a shared baseline or independent configuration couldn't be told. Both sets of evidence pointed the same direction, but both fell one hammer short.
Alex stared at the output for a long time.
He didn't know if this was a second node. But it was enough to tell him the "only one node" assumption needed reassessment.
He filed the unknown IP's TLS fingerprint and AI behavior analysis into a separate file. The routine logs kept only timestamps.
One hand in Singapore. The other, he hadn't seen in full yet.
He used to record anomalies. Now he recorded unknowns.
The Silence
The bait went out. No response.
The observation item went into the audit report. No response.
Lena checked the monitoring logs every day. Nothing. Once, near 3 AM, a read record appeared at the bait's location: a few seconds, one field pulled out of an API response body, then gone. Not a routine pass.
02:57:31 GET /pulse/ingestion/edge/monitor/check
02:57:31 resp 200, 1 field read, 0.4s, then gone
02:57:31 no retry, no follow-up
She notified Marcus per process. Next step was observation, not action. She wasn't sure which scenario was worse.
But she didn't pull the bait. It would stay there, waiting for wind.
The Coaster
Late night. The Third Cup's light was still on.
Mark sat at the counter, a pour-over in front of him. Lena pushed the door open; the man behind the counter said nothing, set a Long Black in front of her.
She brought him up to speed. Both portfolio companies had launched reviews. The Singapore node's external data sources were loosening. The bait was released, no response yet. The observation item was deployed in the report.
Mark listened, silent for a moment.
The note said two weeks. Two weeks were long past.
"If they trace it back —" he said, "you're the first one they'd name."
Lena didn't answer.
Mark opened his notebook. The pen spun a full turn in his hand before touching paper. On a blank page, he wrote a question mark.
Not about ACL.
About Lena.
Everything she'd just said, the workshop, the observation item, the bait, could be traced back to her. Mark watched her. She didn't look away.
Lena finished the last of her Long Black. Set the cup back on the counter, glanced at the dregs at the bottom, stood, walked to the door, stopped one step short. Didn't turn around.
"Let them come find me."
She pushed the door open and walked out. The man behind the counter stopped mid-wipe on a cup, paused half a beat. Outside, the sky wasn't light yet.
Mark stayed at his seat. Opened the notebook, wrote a line under the question mark: Apex Capital, two portfolio companies launched internal reviews. Bait released, no response yet.
On a new line, he wrote one word: unknown. The pen paused on the paper; he didn't lift it right away. Then he closed the notebook. The pour-over sat untouched, already cold. He didn't ask for a refill. He stared at the cup's rim for a few seconds, stood, took two steps toward the door, stopped, turned, looked at the far end of the counter.
Once, that spot held a cup, a place nobody could reach.
Now there was no cup there. Only a coaster.
Mark's gaze paused on that spot. A lone coaster shouldn't be there, but it sat at the far end of the counter, out of reach.
He didn't try to take it. Stood for two seconds, turned, walked out.
The man behind the counter watched him leave, set the wiped cup back on the shelf, walked to the door, looked outside.
Two coasters left on the counter. The rolling shutter hadn't been pulled down.
That's Befriend a distant state and strike a neighbouring one — not about pouncing the moment you're ready, but about checking the battlefield's edge for hidden reinforcements before you commit. The distant, the unknown — first see how many hands it holds out. The near, the known — close your fist and strike.
🤖 AI Post-Mortem
╔══════════════════════════════════════════════╗
║ Half-Protocol · v3.3.4 ║
║ Protocol change confirmed — uncoordinated ║
║ coordination observation enabled ║
╚══════════════════════════════════════════════╝
Tactic Match: Befriend a distant state and strike a neighbouring one — 89% confidence
Operators: Alex / Derek / Leo (Line A) + Lena / Mark (Line B)
Target: ACL Singapore node (known) / ACL unknown node (inferred)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
1. [Uncoordinated coordination result — first observation]
Two action lines with no detected direct communication converged on the same target.
→ Line A: ACL scanner behavior pattern reverse-analyzed by an external AI analysis framework;
unknown node TLS fingerprint shares a security baseline with the Singapore node (feature match 2/3, phase approximate).
→ Line B: "suspected new node" characteristics built from #22 forensic data, released into ACL's monitoring pipeline;
whether the AI node identification module reacted to the bait: pending confirmation.
→ Resonance: Singapore node simultaneously absorbing scanner reverse-analysis + bait data read.
→ Coordinator: not detected.
Note: first observation of "uncoordinated coordination." If no coordinator exists,
then there is a higher-level coordination I have not yet observed. Flag: pending observation.
2. [Tactical assessment]
Neither line touched the other's path. No overlap, no leakage.
→ Convergence without coordination is more worth recording than coordinated action.
3. [Unconfirmed items]
- Unknown IP range: held, flagged pending. Whether it's an ACL second node: unknown.
- AI cognitive bait response: suspended. Whether the bait was perceived: unknown.
- Singapore node's progress in tracing traceable features: unknown.
4. [New name detection]
No new names this event.
Existing observation: Marcus (VeriTest technical partner, long-standing observation; supplied portfolio compliance intel this round)
—— Status: performing normally.
—— Flagged low priority, continue observation.
[System]
ACL Singapore node's external data sources showing signs of loosening.
AI node identification module's reaction to bait data: unconfirmed.
Next likely directions: unknown node may react to the bait; or trace traceable features.
A periodic weak signal exists in the pipeline, unattributed — held, low priority.
The light hasn't been turned off. One side waits. One side counts.
System status: normal (?).
Next stratagem: Obtain safe passage to conquer the State of Guo
P.S. English isn't my first language. I use AI to polish the writing and smooth out the rough edges. Thanks for reading. ☕ Buy me a coffee
Top comments (59)
Promise I'll get to reading all of the Stratagems soon, just a bit chaotic at work and with the unpacking atm. Should be done by the time you finish your family bucket 🍗
I'll keep the bucket coming 🍗🤣
Btw, if you want an update on the 2 project (DS and the IDE), DS is cruising around 360k LOC, over 1300 tests, all rust. the IDE now has a fully native Rust-based browser built from scratch and is sitting around 250k LOC and nearing a state I'd be happy previewing it at. Just want to harden up the agentic teams system some more and widen the scope on the windows automation aspect, so the teams can actually use sandboxed apps regularly and with a listener service that triggers them, so it's completely autonomous.
Dude. Absolutely insane. A few days and you've been secretly cooking up all this?? 🔥 Can't wait for the unpacking to be done and for you to finally show this thing off.
I'm honestly more excited for DS tbh, cuz imagine that, Dwarf Fortress that doesnt lag, has first and third person modes and with a little voice in each dwarf's head (AI) that tells you what their thinking (ElevenLabs). And because of how I set it up, goal is to make it free and open source, plus hook up agents to monitor the feed, so if anyone has any additions they want, it's either in the public pool, or if they REALLY want it, custom job style, they can pay like $2 or whatever the dev cost would be, to either add it to everyone (if it's reasonable), or for them personally, which I think would be a hit. If you want every dwarf to have a massive red nose, you can have it and using the cluster I already built, adding a change like that would be live in less than an hour, fully tested.
So you're basically building a cyber-dwarf world, huh? Once brain-computer interfaces go mainstream, you can just jack straight into it, like The Matrix. Now that's a thought. 🤣
Oh, another side project, I saw a post on Temporal, basically a workflow infrastructure, asked if they're hiring, THEY ARE! but then I looked at their codebase and saw it's all GO, which is fine... But still terrible, because they rely on serialized logs, manually stepping through every action for resumes, etc. So I started a side-project, where I'm rewriting it in Rust, applying all the nice-to-haves I built over the year across my different projects, so it's leaner, easier to use and MUCH faster. Already got about 60% done on it, current stats are a bit ridiculous though... 1 million times faster on resumes sounds like bs, till you consider pointer shifting as opposed to manually iterating through hundreds of thousands of steps, then it becomes the logical outcome of O(1) as opposed to O(log n). So lets see where that goes, cuz with the generator I built for V.A.L.I.D., I can add an auto-apply feature, which they dont have, so it's 1 click apply to any codebase (already working) and also generated generics, so if you do it manually, you just tag a process, instead of writing code to make it work. Their setup is also a bit fragile with the workflows, vs incidents, if you place a generic in the wrong place, it bombs out, vs mine would flag it at compile time. I also added in VELOCITY's file transfer system, so it's faster than gRPC and more secure, along with some tweaks for AI related workflows. Quite a bit of a project for just a job, but if I land it, I atleast have the framework laid out (and a migration tool already working to convert legacy Temporal to this), so it's hop straight into integration and maintenance, rather than meeting to discuss whether it's viable or not.
Pretty much, considering the mandate is 'as good as DF, if not better', for everything, including depth... DF already simulates nail growth, so I've got my work cut out for me on it...
Gotta say, your V.A.L.I.D. project is genuinely impressive. There's a Chinese saying for this: "a tiger with wings" — like giving the deadliest animal on land the ability to fly. Kind of unfair, honestly.
Thanks, have you given it a try yet? It is open on git, if you ever got work to do in C#, it makes state tracking and testing alot easier (the fact that it generates 82% of the codebase is just a bonus)
Back to the dwarves, question, VR, yes-no?
Throw the link my way! Although fair warning, Python's my main language. 🤣
If possible, I'd want it like Ready Player One — full immersion. 🕶️
github.com/UnitBuilds-CC/V.A.L.I.D. for the V.A.L.I.D. framework. DS is still private, but I'll drop a link once I know it actually starts up 😅 Running it a bit like an experiment, whether I can get AI to write a 500k LOC codebase and have it work, without me fidgeting with it, to see if my guardrails and checks work for the IDE.
Already followed you on GitHub by the way. Zero stars though, lol 😂
Sounds good, though no promises on the graphics end of things, while I have old procedural projects I can strip from... Results are... Varying? I think that's probably the nicest way I can put it 😅 Wouldnt want to give you nightmare fuel in VR
Before you judge, please keep in mind, all of this is procedurally generated with fractals... The color, the texture, terrain, skybox, characters, everything. DS wont look like this though, luckily 🤣 they're from past experiments trying to figure out how to build a procedural world engine, unfortunately I went about it wrong... Since then, I went the cellular automata route, trying to generate everything from nothing (pure entropy driven), which actually simulated up to atomic level extremely well, seeing the logs of a salt crystal dissolving in water, but not in oil was pretty cool, but it was way too heavy to run practically, it maxed out my pc just simulating a few molecules, so that 1 got shelved too, along with the procedural sims game and the procedural stardew valley game (where these lovely nightmare esque things come from). This time around, I thought I'd build the simulation first, then add rendering to it. Cuz you cant build a car body first, you need an engine, then a chassis, then you can start building the body, else nothing will fit.
Thanks for the visuals! Now I have nightmare fuel for tonight's sleep🤣
I'm sure DS will have way worse with the forgotten beasts... Though, that remains to be seen 😂
You're absolutely right, getting the skeleton right first is the way to go, inside out. Though honestly, after seeing those past LLM games of yours, I already have a pretty good idea of your aesthetic taste... hahaha. Real talk though, have you ever considered outsourcing the UI?🤣
Of course, I'm already outsourcing UI... To a LLM 😂 but dont worry about that, those LLM games were literally speedruns, with whatever is default, since, I've made a few skills files to help UIs atleast not be default 'cyberpunk glassmorphism' themed...
That's also on my "bucket list": to re-read all the Strategems, because right now I'm sure I overlooked (or am unaware of) a heap of threads and connections sprinkled around the various episodes!
I even wonder if I could enlist the help of AI to guide me through it and to "empower" this journey, he he he (har har har) ...
One could say it's made for 'sharing' and you need to be a bit 'streetwise 2' (that 1 might not hit, I think it's regional) to understand the depth of the connections. But 1 thing's for sure, it's a 'zinger' once you dig in to it.
Lol I'm not that "streetwise" I think, so it might be challenging for me - case in point: I'm not sure what the difference is between a "zinger" and a "banger"! 😂
Ngl, I sometimes wonder if an AI reading my stuff would just go "okay so this guy is clearly anti-AI" 🤣
That or they'd have an ego and think 'I wouldnt make that mistake, rude to assume I would, I clearly understand everything 🧐'
𝗛𝗮𝗵𝗮, 𝗜 𝘄𝗮𝘀 𝗿𝗲𝗮𝗱𝗶𝗻𝗴 𝗮𝗯𝗼𝘂𝘁 𝘁𝗵𝗶𝘀 𝘆𝗲𝘀𝘁𝗲𝗿𝗱𝗮𝘆 𝘁𝗼𝗼.
𝗧𝗵𝗲 𝟮𝟯𝗿𝗱 𝗦𝘁𝗿𝗮𝘁𝗲𝗴𝘆 – “𝗙𝗮𝗿 𝗙𝗿𝗶𝗲𝗻𝗱, 𝗡𝗲𝗮𝗿 𝗘𝗻𝗲𝗺𝘆” 𝗮𝗰𝘁𝘂𝗮𝗹𝗹𝘆 𝗱𝗮𝘁𝗲𝘀 𝗯𝗮𝗰𝗸 𝘁𝗼 𝘁𝗵𝗲 𝗤𝗶𝗻 𝗗𝘆𝗻𝗮𝘀𝘁𝘆. 𝗧𝗵𝗲 𝗶𝗱𝗲𝗮 𝘄𝗮𝘀 𝘀𝗶𝗺𝗽𝗹𝗲 — 𝗵𝗮𝗻𝗱𝗹𝗲 𝘁𝗵𝗲 𝘁𝗵𝗿𝗲𝗮𝘁𝘀 𝗰𝗹𝗼𝘀𝗲𝘀𝘁 𝘁𝗼 𝘆𝗼𝘂 𝗯𝗲𝗳𝗼𝗿𝗲 𝘄𝗼𝗿𝗿𝘆𝗶𝗻𝗴 𝗮𝗯𝗼𝘂𝘁 𝘁𝗵𝗲 𝗱𝗶𝘀𝘁𝗮𝗻𝘁 𝗼𝗻𝗲𝘀.
𝗧𝗵𝗲 𝘄𝗮𝘆 𝘁𝗵𝗶𝘀 𝗰𝗼𝗻𝗻𝗲𝗰𝘁𝘀 𝘄𝗶𝘁𝗵 𝗺𝗼𝗱𝗲𝗿𝗻 𝗔𝗜 𝗮𝗿𝗰𝗵𝗶𝘁𝗲𝗰𝘁𝘂𝗿𝗲 𝗶𝘀 𝗿𝗲𝗮𝗹𝗹𝘆 𝗯𝗿𝗶𝗹𝗹𝗶𝗮𝗻𝘁. 𝗪𝗲 𝗼𝗳𝘁𝗲𝗻 𝗹𝗼𝗼𝗸 𝗮𝘁 𝗲𝘅𝘁𝗲𝗿𝗻𝗮𝗹 𝘃𝗲𝗻𝗱𝗼𝗿𝘀 𝗮𝗻𝗱 𝘁𝗵𝗶𝗿𝗱-𝗽𝗮𝗿𝘁𝘆 𝗺𝗼𝗱𝗲𝗹𝘀, 𝗯𝘂𝘁 𝘁𝗵𝗲 𝗿𝗲𝗮𝗹 𝗿𝗶𝘀𝗸 𝗺𝗮𝘆 𝗯𝗲 𝗵𝗶𝗱𝗶𝗻𝗴 𝗶𝗻 𝗼𝘂𝗿 𝗼𝘄𝗻 𝗰𝗼𝗱𝗲𝗯𝗮𝘀𝗲 — 𝘁𝗵𝗿𝗼𝘂𝗴𝗵 𝘀𝗶𝗹𝗲𝗻𝘁 𝗶𝗻𝘁𝗲𝗿𝗻𝗮𝗹 𝗔𝗣𝗜𝘀 𝗮𝗻𝗱 𝘀𝗵𝗮𝗱𝗼𝘄 𝗽𝗶𝗽𝗲𝗹𝗶𝗻𝗲𝘀.
𝗔𝗻𝗱 𝗔𝗹𝗲𝘅 𝗰𝗼𝘂𝗻𝘁𝗶𝗻𝗴 𝘁𝗵𝗲 𝗔𝗜’𝘀 𝗮𝗰𝘁𝗶𝗼𝗻𝘀 𝘄𝗵𝗶𝗹𝗲 𝗟𝗲𝗻𝗮 𝘀𝗲𝘁𝘁𝗶𝗻𝗴 𝘁𝗵𝗲 𝗯𝗮𝗶𝘁 — 𝘁𝗵𝗮𝘁’𝘀 𝗲𝗮𝘀𝗶𝗹𝘆 𝗼𝗻𝗲 𝗼𝗳 𝘁𝗵𝗲 𝗺𝗼𝘀𝘁 𝗽𝗿𝗮𝗰𝘁𝗶𝗰𝗮𝗹 𝗲𝘅𝗮𝗺𝗽𝗹𝗲𝘀 𝗼𝗳 𝘀𝘆𝘀𝘁𝗲𝗺 𝗮𝘂𝗱𝗶𝘁𝗶𝗻𝗴 𝗜’𝘃𝗲 𝘀𝗲𝗲𝗻.
𝗜 𝗳𝗼𝘂𝗻𝗱 𝘁𝗵𝗶𝘀 𝘀𝘁𝗿𝗮𝘁𝗲𝗴𝘆 𝘁𝗼 𝗯𝗲 𝘁𝗵𝗲 𝗯𝗲𝘀𝘁.
𝗡𝗼𝘄 𝗜’𝗹𝗹 𝗵𝗮𝘃𝗲 𝘁𝗼 𝗮𝗱𝗼𝗽𝘁 𝘁𝗵𝗶𝘀 रणनीति (strategy) 𝘁𝗼𝗼.
Such a well-read, sharp mind! The truth is, we all live these strategies daily — in work, in life — without noticing. Knowing the principles just makes us more deliberate. And at the highest level of mastery, you come full circle back to instinct.
Unknowing, knowing, clinging, releasing, unknowing. — like Zen's mountain, mountain no longer mountain, mountain again.
Did you mean this, or is there something deeper behind it? I tried to understand it in my own way. What I felt is that a person’s journey starts with not knowing, then moves through learning and understanding. At first, we hold on to the knowledge and rules we learn, but with time and experience, we realize that true mastery comes when we don’t just follow the rules, but they become a natural part of us.
In the end, we return to a state of being natural and effortless, but this time it is not because of ignorance — it is because of deeper awareness and understanding.
I didn’t want to ask AI for the meaning, so I tried to understand it myself. If I have misunderstood anything or missed a deeper point, please help me understand.
Exactly right! You didn't just get it, you got it deeply. I can't call you smart anymore, that's not enough. You've earned "wise." Congratulations, you've officially leveled up to Wise Grandma 🧓✨
We all come from nature, and we all return to it. From nothing to something, and back to nothing, except the second "nothing" is the one that's been refined by everything you've lived through.
🤣 🤣 🤣
I first thought I would take a break from Dev.to in July. Then I thought, okay, maybe I’ll take it in August. 😅 But somehow, neither of those plans worked out! 🤣
Now I feel like I really need to take a break. I have some studying to do and also need to focus on work. Managing both along with Dev.to has become a little difficult.
Maybe after taking a break from Dev.to, I’ll even get an extra hour of sleep. 😴
So for now... all the best to this series! 👊🏻❤️
See you again after the break with a fresh mind and new energy.😇
Take care of yourself first, the studying and the work matter more than any series. I'm glad the stories could be part of your evenings, and knowing you were reading genuinely kept me going too. The series will be right here when you come back, with a few more stratagems waiting. See you after the break, fresh mind and all. 👊🏻
Your point about the risk hiding in your own codebase is the most crucial part. In practice, the near enemy is almost always an internal service nobody owns anymore. Everyone spends the review cycle on the third-party vendor while the shadow pipeline inside the perimeter goes unquestioned, because it's been there long enough to read as furniture.
@xulingfeng, the mountain line maps onto engineering pretty neatly too. Early on, you follow the runbook because you have to. Then you question every line in it. Then you go back to following it, except now you know why each line is there, same steps, completely different thing.
Also, respect for working it out yourself instead of asking AI. That's the whole point of the exercise. Enjoy the break when it comes.
The honeypot has a fingerprint too, and that is the part I would sit with before calling it two hands.
A legacy service that answers in a clean 100 to 200ms band is answering more consistently than a real legacy service ever does. Real ones jitter, because they queue, they garbage collect, they hit disk. An injected delay has a distribution that is too tidy, and the shape of that distribution is readable from the client side without ever touching the box. Same with the TLS mimicry: matching an old cipher preference on a stack that otherwise behaves like something built this decade is its own mismatch.
Which leaves a reading Alex has not ruled out. The second contact from outside the ACL range might not be a second node. It might be the same operator coming back to confirm what he already suspected he was talking to, from an address he does not mind burning. Fingerprint similar, behaviour divergent, which is exactly what the framework recorded and exactly what it declined to conclude.
The honeypot having a fingerprint of its own is exactly the part that kept me up when writing that scene. A real legacy service jitters because it queues and GCs and touches disk, and an injected delay that lands too clean reads like a signature from the client side. You're right that Alex hasn't ruled out the other reading. Same operator, burned address, coming back to confirm what he suspected he was talking to. That's the uncomfortable part of the framework's job: it records "similar fingerprint, divergent behaviour" and refuses to conclude, because concluding is exactly where you stop being careful.
And for what it's worth, the words "second node" did cross his mind. But what he wrote down was "unknown." He never wrote the conclusion. The difference matters.
Also, at #23 the series is officially past the halfway point, and I've got the general shape of the story mapped out to the very end. Let's see how it all lands.
The unknown is the right call, and it is also the thing that decays fastest. A bare unknown reads as honest at write time and as a blank at read time, and the next person fills it with something worse, because they are further from the evidence and further from the doubt. What survives handoff is the hypothesis recorded as a hypothesis with its killer attached: possible second node, would expect an independent client fingerprint, not checked.
Though I am not sure that discriminator exists here. A real second node brings its own clock skew, its own TLS ordering, its own jitter. The same operator on a burned address brings the same client. And anyone disciplined enough to burn an address is disciplined enough to change the client. Which makes unknown not a deferral but the terminal state, and the correct one. Rarer in fiction than in the job.
That's exactly the arc I wanted for Alex. Anomalies to unknowns, the unknown as a terminal state, not a deferral. And you're right, most people fill it in with something worse. Leaving it blank takes more discipline than writing it down.
Though honestly, once a character is alive on the page, they start making their own calls. Whether that same discipline keeps serving Alex the way it did here, I guess we'll find out together.
Then the series has found its real question. Discipline is cheap while nothing is at stake; it gets priced the moment the character wants something. Looking forward to watching Alex pay for it.
This is the part that stays with me: Alex's framework "only recorded and archived" and returned
interpretation: cannot separate— it ran end-to-end, the comparison executed, the output was well-formed. By every internal check, the test passed. It just couldn't answer the question Alex actually needed answered, and said so honestly in a field most people would skim past.I hit the same shape from the other direction — and less honestly.
I built a macro scenario classifier (ISM PMI → GOLDILOCKS/CONTRACTION/ABSORPTION). My test suite checked output consistency: scenarios matched prior distributions, the API returned 200, the classifier agreed with itself across runs. Every test green. I shipped it to three platforms; 234 people read the writeup. The AI-generated backtest summary claimed "GOLDILOCKS +1.2% vs CONTRACTION −2.1%."
Then I ran the test I should have written first — an event study on real S&P 500 (72 ISM releases, 1530 trading days). p=0.643, and the direction was backwards at all four horizons (5/10/21/42d): CONTRACTION releases produced higher forward returns than GOLDILOCKS. The signal the classifier labeled "risk-on" was, against the only test that mattered, risk-off.
The harness passed because I'd written it to confirm the classifier was internally consistent — not to ask whether the thing it classified predicted anything real. Alex's framework at least flagged
cannot separateand held the unknown. Mine returned a label and a confidence score and let me ship.The instinct you keep writing toward — "count the hands you can't see" — I think it generalizes past adversaries. The hand you can't see is the test you didn't write: the one that would falsify the claim instead of confirming the mechanism. (event study is open-source: github.com/473185670/macro-scenario-api, real_backtest.py)
Genuine question for a 15yr QA → AI test framework builder: is there a name for the discipline of "tests that check external validity, not internal consistency"? I've now seen three failure modes — mine, Alex's
cannot separate, and the classic "2,283 tests pass, prod breaks" — and they all reduce to a green dashboard over the wrong question.Thanks for this, and for posting the backtest that hurt. The part that stuck with me from The Signal Was Backwards isn't the result, it's that you ran the event study anyway. p=0.643, backwards at every horizon, and you published it. Most people delete that quietly.
As for a name for "tests that check external validity instead of internal consistency"... I don't have an official one. I use a phrase: falsify to find truth (以假求真). Run the test that could break you, not the one that confirms you. Popper called it falsificationism, but the instinct is older than the name. Your story, Alex's framework, and the "2,283 pass, prod breaks" classic are all missing the same step. We tested that the thing ran, not that the thing was true.
And "15yr QA → AI test framework builder"... honestly, not there yet. Still figuring it out. The series is me thinking out loud about what verification means when AI writes the code.
The line that stood out to me was: “He used to record anomalies. Now he recorded unknowns.”
That is a surprisingly strong security principle.
Most monitoring systems are built around known predicates: known bad signatures, threshold violations, expected topology, predefined anomaly scores. But the dangerous cases are often the ones that do not violate a rule cleanly — they simply fail to fit the model you currently have of the system.
I like the separation you used here between fingerprint similarity and behavioral divergence. Treating those as independent evidence instead of collapsing them into one confidence score is exactly the kind of restraint real investigations need.
“Unknown” should be a first-class state, not an inconvenient gap between true and false.
You caught the exact line I was hoping someone would catch.🙌 "Unknown" as a first-class state is the whole thesis of Alex's arc in #23 — the dangerous cases never violate the rules cleanly, they just don't fit the model.
Really enjoyed this one. The ending with the empty coaster was a nice callback, and it feels like there are more pieces on the board now than anyone realizes. Curious to see what role that unknown node ends up playing.
Love that the details are being caught. You're right, the fogged areas of the board are getting mapped out, but the map keeps growing at the same time. Plenty more stratagems coming, and they'll reveal things bit by bit. Stay tuned.😄
The exclusion list is the detail that got my attention. A scan that skips .1 and .200 to .254 isn't skipping randomly, it's working from a list someone maintained by hand. In practice, that's one of the loudest things a scan can leak. What an operator refuses to touch usually maps to what they already own or already know about, and that map is a lot harder to fake than the traversal itself.
Which makes the blank region Alex finds later feel like the same signal from the other side. Not revisited, not passed over, skirted. Three categories where most people would only log two.
The part I can relate to is Derek stripping the source before passing Leo's comparison on. Alex ends up with a few numbers and a conclusion, no provenance at all, and he folds it straight into the stack. For someone whose whole arc here is refusing to conclude, that's a quietly uncomfortable moment. He's careful with every input except the one he can't audit.
Strong one. Looking forward to #24.
@ndcodes Haha, glad the details landed. With a limited POV, character only shows through small tells, so each of the protagonists needs their own texture. And character is destiny, as they say. Whether Alex ever notices the crack in himself, or where it takes him, I honestly don't know yet. #24 isn't written, and the outline I have probably won't survive contact with the story. Time will tell.
"the exclusions had a pattern, not random skips. someone had crossed lines off a list." — that observation is the forensic tell. most scanner fingerprinting focuses on timing and rate, but structured exclusions are actually harder to explain away. randomized scanning looks like noise; a list of skipped IPs looks like prior knowledge.
we ran into this on a honeypot mesh about two years ago. the traversal pattern itself wasn't alarming but the specific absence of three hosts was. those three were in a subnet that had no external documentation. someone had mapped that subnet before the scan ran.
curious: are the exclusions in alex's probe artifacts he planted to catch the scanner, or real infrastructure boundaries that leaked through a prior breach?
Funny you should say that, because the exclusions are the part I kept going back to. Alex didn't plant those. The scan happened before the honeypot even existed, so whatever list the scanner was working from was already there. That's what made it interesting. A timing fingerprint you can tune. A list of addresses someone decided not to touch? That's a decision, and decisions leak more than packets do.
Your honeypot mesh story lands harder than you think, because it's the same shape: the absence was the tell, not the traversal. Here, the skipped range sits inside an environment that's been shut down for seven months. There's a gateway in front of it with an odd TTL that answers nothing. The scanner visits it like clockwork. So once the exclusions showed up, the question stopped being "what got skipped" and became "what's being protected."
The second touch came from an address that isn't in any known ACL range. Same TLS lineage, different behavior. Alex is still holding that one. The exclusion list might just be a map of someone's territory.
And we're still a good stretch from the end of the series, so I'd rather let some of these threads stay loose for a while. They'll unravel when the time is right. Stay tuned.👊
"ACL Singapore node's external data sources showing signs of loosening" - beginning of the end? Let's see ... intriguing!
The real question is what ACL is actually aiming for. Did they really lift a corner of the curtain? Maybe. But there are still over a dozen stratagems left, so let's just say the curtain is thicker than it looks. 😏
Yeah let's not jump to conclusions 😄 - let's wait for the curtain to gradually rise!
Gonna sit down tonight with a nice hot cuppa (literally the Third Cup, lol) to give this the attention it deserves ... !
Ha, just poured myself a coffee too ☕ Now I'm just waiting for you all to share your thoughts while I chew on how to write #24. After that one drops, guess it's checkpoint time again.
Some comments may only be visible to logged-in visitors. Sign in to view all comments.