Home on camel4.dev

AI Is Killing the Zero-Day and Stalking You Instead

Mon, 27 Jul 2026 00:00:00 +0000

AI Code Security

According to CVE.org, there have been 35,872 new CVEs published so far in 2026. Comparing that to 48,244 for all of 2025, we can do some advanced statistical analysis and determine that if this trend holds there will be roughly 415,146 new CVEs published in 2027. I’ve made a graph of my analysis:

Now, obviously that’s not going to happen. Anyone who has spent time in the security industry knows that graphs and metrics like this are great at raising shareholder value, but not actually how the world works. This graph is a little better, and is closer to what will actually happen:

camel4.dev

Sun, 07 Jun 2026 00:00:00 +0000

This is my personal site and blog. I write about cybersecurity, CTFs, programming, and whatever else I feel like. The design is very human.

Stack

Hugo - static site generator. Go-based, fast, with no runtime dependencies. Originally tried to roll my own but uh, that was a bad idea.
Markdown + TOML - all content is plain markdown with TOML front matter. I think needing a database for your blog that gets 10 readers a month is way overkill.
Custom CSS - hand-rolled dark theme. IBM Plex Mono is my favorite font, so I’m locally hosting it for my code blocks to avoid additional fetching.
Umami - self-hosted analytics. No cookies or tracking. I like Umami.
Hetzner VPS - I’ve had a Hetzner VPS (or many) for a few years now. I migrated over there a long time ago and never looked back. The value is crazy, and Hetzner is a great organization.

Why Hugo

I’ve tried a few different static site generators, and even tried to make my own, and wasn’t a super big fan of any of them. Hugo has been good though. It’s a single binary with no dependencies, and it’s been the same single binary for years. The templating is occasionally frustrating, but the tradeoff is worth it in my opinion. My hot take is that if your personal website or blog needs a runtime like Node or a framework like Vue just to function, you are making WAY too much work for yourself. Its also nice for your site to just load instantly on any device that visits it.

We Had to Ban 65 Teams to Get a Top 10 Leaderboard

Sun, 07 Jun 2026 00:00:00 +0000

official BYUCTF 2026 participation certificate (self-issued)
Every year we hand out the same participation cert. Made it in MS Paint in 2024. Just felt like a waste to not reuse it.

This year marks the third year I’ve been helping run BYUCTF and the BYU Cyberia CTF team. Over the last few years, I’ve built dozens of challenges, hosted 10+ CTFs, and competed in dozens more both alone and as part of BYU Cyberia. I’ve written most of the OSINT challenges for BYUCTF during that time, which means I get to enjoy watching people crash out over things I built. It’s great.

About

Mon, 01 Jan 0001 00:00:00 +0000

I’m Cameron. I study cybersecurity at BYU, work as a Linux sysadmin, and write challenges for (and compete in) CTFs with BYU Cyberia. There are other things I do, but honestly I’ve rewritten this like three times because it was too cringey. Stop reading please.

Currently

Finishing my degree right now. Spending a lot of time working on personal projects. Mostly Linux, homelab stuff, and whatever security topic interests me at the moment. I’ll make this more descriptive in the future, but right now this is low on my priority list.

Privacy

Mon, 01 Jan 0001 00:00:00 +0000

This site uses Umami for analytics. Umami is open-source, self-hostable, and designed to be privacy-respecting by default.

What is collected

When you visit a page, Umami records:

The URL you visited
The referring URL (where you came from)
Your browser name and version
Your operating system
Your device type (desktop, mobile, tablet)
Your country, derived from your IP address at request time

What is not collected

Your IP address is never stored
No cookies are set
No cross-site tracking
No fingerprinting
No personal information of any kind

Why?

I want to know which posts people find useful and roughly where readers come from. That’s it. The data stays with me and is not shared with or sold to anyone.