Tom RyanTom Ryan. Security researcher and engineer.https://tomryan.dev/en-usWhat survives the move? A benchmark for mind preservation claimshttps://tomryan.dev/writing/what-survives-the-move/https://tomryan.dev/writing/what-survives-the-move/Paper 3 turns mind preservation into a benchmark question: after a transfer, which source-specific functions are still active, and which are just copied traces, mimicry, or proxy reward?Fri, 05 Jun 2026 00:00:00 GMTconsciousnessaiStay in the Weirdnesshttps://tomryan.dev/writing/stay-in-the-weirdness/https://tomryan.dev/writing/stay-in-the-weirdness/It's Friday afternoon and my life looks amazing from just about every angle except, sometimes, my own. On purpose, ambition, the bet you make with the only time you've got, and learning to sit in the weird part.Fri, 29 May 2026 00:00:00 GMTmetaconsciousnessA Vaultwarden SSO bug found five weeks after someone else found it, and what the duplicate tells youhttps://tomryan.dev/writing/vaultwarden-sso-email-verified/https://tomryan.dev/writing/vaultwarden-sso-email-verified/CVE-2026-47164: the SSO existing-user binding branch in Vaultwarden skipped the email_verified check that the new-user branch enforced. I reported it on April 29. ch1nhpd reported it on March 22. Same root cause, found five weeks apart by two independent auditors. The writeup, the surface, and what the duplicate signal is worth.Fri, 22 May 2026 00:00:00 GMTsecurityaiAn uninitialized read in V8's Maglev JIT, and what made it a P2 instead of a vulnerabilityhttps://tomryan.dev/writing/v8-maglev-saved-mode-uninit/https://tomryan.dev/writing/v8-maglev-saved-mode-uninit/A use-of-uninitialized-value in Maglev's SaveCallSpeculationScope destructor. The audit workflow that found it, the one-line fix, and why the V8 team correctly reclassified it from Vulnerability to Bug — the speculation-mode flag isn't the load-bearing safety layer; the deopt guards are.Fri, 15 May 2026 00:00:00 GMTsecurityv8aiWhat must be preserved? An audit of eight theories of consciousness from the engineering sidehttps://tomryan.dev/writing/what-must-be-preserved/https://tomryan.dev/writing/what-must-be-preserved/Brain preservation proceeds as if we know what to scan. We don't. Eight major theories of consciousness give answers that disagree by ten orders of magnitude on data volume and span the range from tractable engineering to physical impossibility. The bottleneck isn't compute or scanning. It's the theory itself.Fri, 08 May 2026 00:00:00 GMTconsciousnessmetaFinding an io_uring OOB read with Claude, and the limits of LLM-assisted kernel auditinghttps://tomryan.dev/writing/iouring-sqe-mixed-oob/https://tomryan.dev/writing/iouring-sqe-mixed-oob/A deterministic, unprivileged 64-byte OOB read in io_uring's SQE_MIXED path, the audit workflow that found it, and an honest accounting of what LLM-assisted kernel review does and doesn't do well.Wed, 29 Apr 2026 00:00:00 GMTsecuritykernelai