ZombieMutex is Jeffrey Monica's personal engineering notebook: iOS, Android, backend systems, security research, experiments, practical writing, and life outside code. https://zombiemutex.com en-us Mon, 09 Nov 2026 05:39:59 GMT A trained nonlinear encoder, vector-quantized codebook and decoder are interesting. An idealized low bitrate is not the same thing as good reconstructed speech. https://zombiemutex.com/blog/a-small-neural-audio-codec-and-a-large-reality-check https://zombiemutex.com/blog/a-small-neural-audio-codec-and-a-large-reality-check Jeffrey Monica Mon, 09 Nov 2026 05:39:59 GMT Audio CodecNeural NetworkVector QuantizationVQCompressionMachine LearningPythonSignal Processing I built five small speech and audio implementations and measured their behavior. ASR errors, turn detection, codecs, prosody and classifier ablations each have different ways to mislead you. https://zombiemutex.com/blog/audio-ml-what-the-numbers-actually-mean https://zombiemutex.com/blog/audio-ml-what-the-numbers-actually-mean Jeffrey Monica Mon, 09 Nov 2026 05:39:59 GMT Audio MLSpeech RecognitionASRTTSNeural CodecMachine LearningStreamingAblationInference How I connected Swift and Kotlin clients to agent workflows, built Core ML and TensorFlow Lite integration boundaries, and kept authorization on the backend. https://zombiemutex.com/blog/mobile-voice-agents-keep-the-backend-in-charge https://zombiemutex.com/blog/mobile-voice-agents-keep-the-backend-in-charge Jeffrey Monica Mon, 09 Nov 2026 04:51:49 GMT Voice AgentsiOSAndroidSwiftKotlinCore MLMobile SecurityBackendAIML Building an agent that talks is the easy demo. The harder work is authenticated tools, retries, evaluation, telemetry, CRM synchronization and the people who have to operate it. https://zombiemutex.com/blog/voice-agents-the-real-work-behind-the-conversation https://zombiemutex.com/blog/voice-agents-the-real-work-behind-the-conversation Jeffrey Monica Mon, 09 Nov 2026 04:51:49 GMT Voice AgentsLLMAIBackendAPI IntegrationReliabilitySecurityDistributed SystemsEvaluation Retry logic looks harmless in isolation. When a gateway, application service and SDK each apply their own retry policy, a single failed operation can multiply into a dependency outage. That interaction is the starting point for my retry-storm analysis. https://zombiemutex.com/blog/architecture-retry-storm-jitter https://zombiemutex.com/blog/architecture-retry-storm-jitter Jeffrey Monica Sat, 07 Nov 2026 21:12:00 GMT Software ArchitectureDistributed SystemsRetriesBackoffJitterAPI An encrypted database value can be perfectly unreadable to an attacker and still end up in the wrong record. If a service moves ciphertext between tenants without binding the record's context, the system may de https://zombiemutex.com/blog/aes-gcm-associated-data-tenant-boundaries https://zombiemutex.com/blog/aes-gcm-associated-data-tenant-boundaries Jeffrey Monica Sat, 07 Nov 2026 21:11:00 GMT CryptographyAES GCMAEADArchitectureKey ManagementSecurity When a robotics node starts, I don't want "the process launched" to be confused with "the robot is ready to move." The ROS 2 managed-node design makes this difference explicit with lifecycle states. That's a be https://zombiemutex.com/blog/robotics-ros2-lifecycle-boundaries https://zombiemutex.com/blog/robotics-ros2-lifecycle-boundaries Jeffrey Monica Sat, 07 Nov 2026 21:10:00 GMT RoboticsROS 2ArchitectureLifecycleEmbedded SystemsSafety I traced Stuxnet as a boundary-crossing problem: from Windows software into industrial control commands. Calling it sophisticated Windows malware misses the physical-system risk. The attack path targeted software used to supervise and program indust https://zombiemutex.com/blog/stuxnet-plc-boundary https://zombiemutex.com/blog/stuxnet-plc-boundary Jeffrey Monica Sat, 07 Nov 2026 21:09:00 GMT Malware AnalysisStuxnetIndustrial SecurityRoboticsPLCArchitecture Raspberry Robin showed why incident timelines need separate columns for initial access and what attackers do later. Microsoft's October 2022 research described a USB-propagating worm that was connected to a bro https://zombiemutex.com/blog/raspberry-robin-usb-worm https://zombiemutex.com/blog/raspberry-robin-usb-worm Jeffrey Monica Sat, 07 Nov 2026 21:08:00 GMT Malware AnalysisRaspberry RobinWormsUSBWindowsPersistence Melissa demonstrates why I include document and user-interaction boundaries in propagation analysis, not only remotely exploitable network services. In March 1999, a Microsoft Word document with a malicious macro relied on someone o https://zombiemutex.com/blog/melissa-macro-virus-outbreak https://zombiemutex.com/blog/melissa-macro-virus-outbreak Jeffrey Monica Sat, 07 Nov 2026 21:07:00 GMT Malware AnalysisMelissaVirusMacroEmailWindows In my analysis of Mirai, the failure starts with a simple hardware assumption: devices that ship with weak or default remote-management credentials will eventually be found by automated scanners. In 2016, many cameras, recorders and routers were ex https://zombiemutex.com/blog/mirai-iot-default-password-botnet https://zombiemutex.com/blog/mirai-iot-default-password-botnet Jeffrey Monica Sat, 07 Nov 2026 21:06:00 GMT Malware AnalysisMiraiWormsIoTBotnetRobotics The starting point I emphasized in my NotPetya review is a trusted enterprise distribution path: the update path for Ukrainian accounting software M.E.Doc. It then moved laterally and disrupted organizations well beyond its initial target geography. https://zombiemutex.com/blog/notpetya-medoc-supply-chain https://zombiemutex.com/blog/notpetya-medoc-supply-chain Jeffrey Monica Sat, 07 Nov 2026 21:05:00 GMT Malware AnalysisNotPetyaSupply ChainWiperRansomwareArchitecture In my review of WannaCry's propagation path, the network boundary matters as much as the payload. The May 2017 outbreak combined ransomware with self-propagation across vulnerable Windows SMB services. https://zombiemutex.com/blog/wannacry-smb-worm-2017 https://zombiemutex.com/blog/wannacry-smb-worm-2017 Jeffrey Monica Sat, 07 Nov 2026 21:04:00 GMT Malware AnalysisWannaCryWormsSMBRansomwareWindows The trust failure I examined in Android toll-fraud reporting is the confirmation step: an OTP does not protect a purchase if malicious software on the same device can intercept or submit it. Microsoft documented Android toll-fraud workflows in which malware tried to subscribe victim https://zombiemutex.com/blog/android-toll-fraud-otp-interception https://zombiemutex.com/blog/android-toll-fraud-otp-interception Jeffrey Monica Sat, 07 Nov 2026 21:03:00 GMT AndroidMalware AnalysisToll FraudOTPSubscriptionNetwork Security In reviewing the Joker/Bread campaigns, I focused on the separation between an app doing its advertised job and subscription activity the owner never authorized. Google's 2020 report on Bread—often called Joker—documented that exact billing-fraud problem. The family kept adapting as defenses a https://zombiemutex.com/blog/joker-bread-android-billing-fraud https://zombiemutex.com/blog/joker-bread-android-billing-fraud Jeffrey Monica Sat, 07 Nov 2026 21:02:00 GMT AndroidMalware AnalysisJokerBreadBilling FraudGoogle Play Triada challenges an app-centric mobile threat model in an important way. Google's Android security team described a malware family that moved from rooting attempts into compromised system images. The malicious cod https://zombiemutex.com/blog/triada-android-supply-chain-backdoor https://zombiemutex.com/blog/triada-android-supply-chain-backdoor Jeffrey Monica Sat, 07 Nov 2026 21:01:00 GMT AndroidMalware AnalysisTriadaFirmwareSupply ChainMobile Security The entry point I focused on in FluBot was the delivery-text lure, because the later banking and contact-abuse behavior depended on the permissions granted after that initial deception. But FluBot used exactly that: convince someone to follow a delivery or voicemail lure, install a malicious Android application, and grant it un https://zombiemutex.com/blog/flubot-android-sms-worm https://zombiemutex.com/blog/flubot-android-sms-worm Jeffrey Monica Sat, 07 Nov 2026 21:00:00 GMT AndroidMalware AnalysisFluBotAccessibilitySmishingBanking I scheduled 100 calls against one in-process idempotency key. The side-effect callback ran once; a real crash or a second worker is still untested. https://zombiemutex.com/blog/idempotency-under-one-hundred-competing-requests https://zombiemutex.com/blog/idempotency-under-one-hundred-competing-requests Jeffrey Monica Fri, 06 Nov 2026 04:09:06 GMT BackendAPI ReliabilityIdempotencyDistributed SystemsReproducible Tests I sent 200 scheduled refresh attempts through one local token family. Only one issued a successor; multiple workers would need a different test. https://zombiemutex.com/blog/refresh-token-rotation-under-concurrent-replay https://zombiemutex.com/blog/refresh-token-rotation-under-concurrent-replay Jeffrey Monica Fri, 06 Nov 2026 04:09:06 GMT AuthenticationMobile SecurityBackendConcurrencySession RecoveryReproducible Tests I tried consuming one action-bound challenge 200 times. My single-process guard accepted one call and rejected 199; shared-store races remain untested. https://zombiemutex.com/blog/reproducing-a-one-time-challenge-replay-race https://zombiemutex.com/blog/reproducing-a-one-time-challenge-replay-race Jeffrey Monica Fri, 06 Nov 2026 04:09:06 GMT Mobile SecurityBackendReplay ResistanceTypeScriptReproducible Tests What requestHash protects, what the server must verify, and why an integrity verdict is not a substitute for authorization. https://zombiemutex.com/blog/android-play-integrity-request-binding https://zombiemutex.com/blog/android-play-integrity-request-binding Jeffrey Monica Fri, 06 Nov 2026 01:28:41 GMT AndroidKotlinPlay IntegrityMobile SecurityBackendAuthentication Design privacy-conscious auth decision logs that help explain failures without recording the credentials that caused them. https://zombiemutex.com/blog/authentication-telemetry-without-secret-leaks https://zombiemutex.com/blog/authentication-telemetry-without-secret-leaks Jeffrey Monica Fri, 06 Nov 2026 01:28:41 GMT BackendObservabilityAuthenticationMobile SecurityLogging A valid App Attest or Play Integrity result cannot authorize a user. I walk through the server decisions separately and test them with synthetic inputs. https://zombiemutex.com/blog/device-integrity-is-not-authorization https://zombiemutex.com/blog/device-integrity-is-not-authorization Jeffrey Monica Fri, 06 Nov 2026 01:28:41 GMT iOSAndroidMobile SecurityApp AttestPlay IntegrityAuthentication A timeout does not undo a committed write. Model retries, duplicate operations and correctly scoped idempotency keys. https://zombiemutex.com/blog/idempotency-when-http-timeouts-lie https://zombiemutex.com/blog/idempotency-when-http-timeouts-lie Jeffrey Monica Fri, 06 Nov 2026 01:28:41 GMT BackendAPI ReliabilityIdempotencyHTTPRetriesDistributed Systems Avoid orphaned jobs and stale UI state by understanding cooperative cancellation, scopes, and background work. https://zombiemutex.com/blog/kotlin-coroutines-cancellation-lifecycle https://zombiemutex.com/blog/kotlin-coroutines-cancellation-lifecycle Jeffrey Monica Fri, 06 Nov 2026 01:28:41 GMT AndroidKotlinCoroutinesJetpack ComposeReliability Practical tests for broken object-level authorization in authenticated mobile and backend APIs. https://zombiemutex.com/blog/object-level-api-authorization-review https://zombiemutex.com/blog/object-level-api-authorization-review Jeffrey Monica Fri, 06 Nov 2026 01:28:41 GMT BackendAPI SecurityAuthorizationThreat ModelingMobile Security Model sign-in, refresh rotation, expiry, step-up recovery, and revocation without creating a hidden authentication bypass. https://zombiemutex.com/blog/session-recovery-as-a-state-machine https://zombiemutex.com/blog/session-recovery-as-a-state-machine Jeffrey Monica Fri, 06 Nov 2026 01:28:41 GMT Mobile SecurityAuthenticationSession RecoveryiOSAndroidBackend How Task.checkCancellation, child tasks, stale results, and server-side effects interact in an iOS app. https://zombiemutex.com/blog/swift-concurrency-cancellation-in-real-apps https://zombiemutex.com/blog/swift-concurrency-cancellation-in-real-apps Jeffrey Monica Fri, 06 Nov 2026 01:28:41 GMT iOSSwiftSwift ConcurrencyAsync AwaitReliability Why this corner of the internet isn't going to be only about code. https://zombiemutex.com/blog/a-place-for-work-life-and-everything-in-between https://zombiemutex.com/blog/a-place-for-work-life-and-everything-in-between Jeffrey Monica Thu, 05 Nov 2026 12:00:00 GMT LifePersonalWriting A practical look at building and evaluating device trust signals under jailbreaks, instrumentation, replay, and tampered clients, with emphasis on server-side verification and failure-aware design. https://zombiemutex.com/blog/hardening-ios-device-trust-signals-against-hostile-clients https://zombiemutex.com/blog/hardening-ios-device-trust-signals-against-hostile-clients Jeffrey Monica Sun, 29 Mar 2026 17:00:00 GMT 2026-03-30T03:15:00.000Z iOS SecurityMobile SecurityDevice TrustHostile ClientApp IntegrityFraud DetectionReverse Engineering