https://josephcall.dev Notes on security, agents, and research. https://josephcall.dev/writing/column-embeddings https://josephcall.dev/writing/column-embeddings I wanted to know whether embedding spreadsheet cells recovers what a column is for. The table understanding literature has been answering this for seven years, and the answer is mostly no, with a useful exception. Sun, 02 Aug 2026 00:00:00 GMT https://josephcall.dev/writing/sandboxing-agents https://josephcall.dev/writing/sandboxing-agents eBPF tooling like Tetragon is excellent at seeing what a workload does. For sandboxing an agent, seeing is the wrong verb. Here is why the enforcement point has to sit in the syscall path itself. Sun, 05 Jul 2026 00:00:00 GMT https://josephcall.dev/writing/perhop-detection https://josephcall.dev/writing/perhop-detection Agent frameworks catch prompt injection at each hop. Do the arithmetic across five hops and the end-to-end detection rate collapses to about 17%. The problem is structural, not a tuning issue. Sat, 13 Jun 2026 00:00:00 GMT https://josephcall.dev/writing/codestellation-evoqd https://josephcall.dev/writing/codestellation-evoqd Class-level code summarization is bottlenecked by data quality, not model capacity. Filtering with a single similarity score does not fix it. Here is the case for treating dataset selection as a search problem. Thu, 16 Apr 2026 00:00:00 GMT https://josephcall.dev/writing/lisbon https://josephcall.dev/writing/lisbon I moved to Lisbon for a while and learned the language on the way. The language was not the point. The people were. Tue, 22 Jul 2025 00:00:00 GMT https://josephcall.dev/writing/qlora-finetuning https://josephcall.dev/writing/qlora-finetuning We fine-tuned code models two ways and the cheap method won on quality, not just cost. Here is what that means for anyone choosing a training strategy. Thu, 08 May 2025 00:00:00 GMT https://josephcall.dev/writing/business-development https://josephcall.dev/writing/business-development I spent a while assuming that being good at the work was the hard part of getting the work. It is not, and figuring out why changed how I approach every conversation. Wed, 06 Nov 2024 00:00:00 GMT https://josephcall.dev/writing/dns-sd-privacy-leaks https://josephcall.dev/writing/dns-sd-privacy-leaks We scanned the Tranco Top 1 Million for service discovery records. Around 91% of domains advertising a service do it without working DNSSEC, and a lot of what they advertise is unencrypted. Wed, 14 Aug 2024 00:00:00 GMT https://josephcall.dev/writing/solo-travel https://josephcall.dev/writing/solo-travel I travel alone more than most people think is sensible. The reason is not the places. It's what happens to you when nobody around you knows who you are. Thu, 14 Sep 2023 00:00:00 GMT