Toss out a brick to lure a jade gem.
— The 36 Stratagems, Throw Out a Brick to Get a Jade
Previously on this series:
#8: Alex Watched an AI ...
For further actions, you may consider blocking this person and/or reporting abuse
The 1.5% weekly decline - "Someone was pressing the metric down on a schedule" - yeah that was the proverbial "canary", or else he wouldn't even have started looking at it ... looking forward to the next episode, there's always a new twist!
Leob, you liked those first few articles I posted when I first came to Dev.to — the ones nobody read. I always cringe looking back at them. Hahaha.😂
Would have to re-read those to see whether they're that much more poorly written - I think they were a bit less "subtle" and refined, but not necessarily bad ...
Haha, I've thought about deleting those black-history posts before. But then I figured I'd keep them — consider it a routine backup habit 😅
Nah definitely don't, they're also a fun read, they require just that little bit less mental effort to digest ;-)
Promise I won't delete them. They're the trail of growth🤣
This is the one I was hoping someone would catch — "confidence as attack surface." Most people read #17 and just see the extraction pipeline.
What I liked about your read is you picked up on what makes it two layers. Alex tosses a brick, gets two jades back. One is ACL's extraction pipeline (five months of silent siphoning, deployed under a departed SRE's account, nobody noticed). Second one is trickier — someone planted four services alongside ACL in the same week ACL deployed. Resource footprint just under cost-scan thresholds. ACL had a neighbor and didn't know.
But P was also throwing a brick. That PGP key sat in a config file for five months — betting someone smart enough would find it and use it the right way. Alex was P's jade. So you've got one stratagem running in both directions, and both operators thought they were the one throwing the brick. Turns out they were each other's jade too.
Also — you mentioned Doraemon last time, and I've been sitting on this question: Anywhere Door or Bamboo Copter, which one is more useful for a test engineer? I'm voting Anywhere Door. Copying logs across network segments beats flying there 🚪🤣
Anywhere Door is still #1, but Pass Through Hoop deserves second place. Why wait for firewall approvals when you can just walk through the wall?
Fair point. Pass Through Hoop is underrated. I'd still take Anywhere Door for log shipping across VPCs, but for firewall evasion? Hoop wins.😂
"An alert tells you what broke. A pattern tells you what's changing" is the line that carries this one, and the 1.5% weekly decline is a sharper detail than the story lets on. Natural degradation is noisy: it mean-reverts, jumps with deploys and data shifts, wanders. A metric that declines linearly, week after week, is being managed by something that wants to stay under the alert threshold. The smoothness itself is the tell. In monitoring terms: alert on trend discipline, not just on level. A degradation that is too polite deserves more suspicion than one that is loud.
The other thing Alex got right is that his watermark carried identity, not just presence. A tripwire canary tells you that something leaked. A watermark unique per path tells you which route it left through, so the artifact itself testifies about the exfiltration channel. That distinction, presence versus identity, is the difference between knowing you have a problem and knowing where it lives.
"Alert on trend discipline, not just on level" — that's pretty much exactly what Alex was doing. Most people see a 1.5% weekly drop, check data quality once, move on. He was looking at how clean the curve was.
The watermark identity vs presence thing — a tripwire tells you the door opened. Different watermarks on each exit tell you which door. Anyone who's done full-path tracing knows the difference. It's the gap between "something leaked" and "here's exactly where."
Mike walking past, two words, then gone, is a nice touch, whoever he's meant to be. Small moments like that do more to sell "someone else is watching" than another paragraph of exposition would.
The detail that actually stuck with me technically: watermarking via the LSB of float32 mantissas, negligible enough to survive training, but present enough to trace. That's a real technique dressed as a plot device, and it's the right kind of real for this series, the kind a reader who knows the domain can check instead of just accept.
Two comments, two different episodes — love the commitment 🙏
The Mike walking-past beat was the shortest thing in the draft and the one I re-read the most times. Glad it read the way it was meant to.
On the LSB watermark — that one took a few rounds of back-and-forth with a friend who actually works on ML pipeline security to make sure the error tolerance math held up. The fact that you called it out by the bit-level detail means it passed.
And you're right to flag Mike — he's the CTO who brought Alex over at 2x salary from the old series. The trust between them is something I've been trying to carry forward. Appreciate you calling it out — still feels like the stitch between the old series and this one could be cleaner. Something to work on.