Unintended Computations#

Nicolas Seriot (independent security engineer)

• Why: Not about your stack, but a genuinely reusable capability-discovery lens that will change how you read any system description — including network protocols and policy engines where "what can this actually compute?" is underasked.
• What: A tour of systems whose real computational power exceeds their description: PostScript printers as remotely-reachable persistent execution environments, five lines of AWK as an acoustic modem, an XNU IPC bug giving any sandboxed process a system-wide effect, Jira automation mapped to a Minsky register machine, Unicode UTS #35 transliteration as a universal string-rewriting system, and ncurses terminfo composed with top as a programmable computer with top supplying the clock.
• How: The heuristic: look for state, conditional choice, and repetition — those three reveal an unexpected machine even when every component behaves as designed. Then the security question is not "can it compute?" but what I/O it exposes, what it can reach, and whose authority it inherits.
• Where applicable: General security-review methodology, explicitly not tied to a vulnerability class; connects to the weird-machines literature. (from abstract only)