Foothold

The Slash conversation was scheduled for six PM and it was currently ten in the morning and I had eight hours to kill.

I tried to sleep for two of them. The mattress on the floor of the loft was a fact I had made peace with in the sense that I had stopped thinking about the bed frame against the wall, and the ceiling above it was a surface I knew well enough by now to have catalogued its water stains and paint variations as you catalogue a familiar room, not with attention but with the accumulated familiarity of many hours of lying here not sleeping. The crack in the plaster above the window ran diagonally, northeast to southwest, approximately fourteen inches. The water stain in the corner was a pale brown ring that someone painted over and then un-painted-over by ignoring it for long enough. The smoke detector on the ceiling had had a low-battery warning for eleven days that it issued every forty-seven minutes and that I had been meaning to address.

It issued one now. I counted forty-seven minutes. It issued another.

I gave up on sleep at noon.

---

Here is what I know about Slash after three years.

His messages arrive between midnight and four AM more often than not, which places him in a time zone I’ve never tried to identify because identifying it would be the kind of curiosity that violates the social contract of what we are. His vocabulary places him in a generational window, old enough to have professional formation in a world before the Wipe, young enough to communicate in the compressed digital shorthand of a man who moved through the underground during its formative years. His references are occasionally military. Not performed. More the vocabulary a person absorbs from living in proximity to the relevant world long enough for it to settle in.

He does not talk about himself. Not as a rule, as a habit so ingrained it has become invisible. In three years of what I would describe, if pressed, as a genuine working relationship and what I might in my more honest moments describe as something closer to friendship, I have accumulated approximately four personal facts about him. I know he dislikes institutions of any kind, which is ideological and not specific. I know he worked with someone years ago who is now dead, which came through in the past tense of a single reference that he did not elaborate on. I know he finds the reconstruction era’s surveillance architecture distasteful in a way that goes beyond operational inconvenience, which tells me something about his values but nothing about his history. And I know he uses the word careful the way other people use the word dangerous, as a warning he issues because he means it, not because it sounds good.

What I don’t know about him would fill more space than I have available.

I’ve been comfortable with that. Comfortable is probably the wrong word. I’ve been functional with it, as you’re functional with not knowing the structural specifications of the bridge you drive over every day. The bridge has held. The relationship has held. That has been sufficient.

I’m finding it slightly less sufficient this morning.

---

The Tier Two briefing was still open in a tab. I pulled it up and spent two hours working on the derivation problem, the set of indicators embedded in the briefing document that together describe the address of the target system without naming it. It was the kind of problem that rewards lateral thinking over linear analysis, which meant the two hours were less frustrating than they might otherwise be and more absorbing than I’d like, given that absorption is my primary method of not thinking about things I should probably be thinking about.

By two PM I had the address. The target system resolved to a service running on a dark net node, not the relay infrastructure of the first tier, something different, something that felt more deliberate in its construction. I ran preliminary reconnaissance while I made coffee.

Reconnaissance is the part they never show in the movies.

In the dramatic version, the hacker sits down, types for twenty seconds, and is inside. In the actual version, reconnaissance is an hour, sometimes more, of passive observation. You don’t touch the target. You don’t send it anything. You watch what it says about itself without being asked: the services it advertises, the software versions it exposes, the fingerprint of its configuration. You build a map before you try to open any doors. You do this because every probe you send is a data point that someone monitoring the target might see, and you don’t want to be seen until you’ve decided what you’re doing.

Dark Cypher’s Tier Two target has been built by someone who knows this. Its external surface is minimal, a single open port, a single service, a single response to the initial probe that tells me exactly what it wants me to know and nothing else. It’s the digital equivalent of a room with one window and drawn curtains: present, lit, entirely unhelpful about what’s inside.

$ nmap -sV -Pn -p- <target_address>
Starting Nmap scan...

PORT     STATE  SERVICE    VERSION
8443/tcp open   ssl/https  nginx 1.18.0

One port. One service. The Nginx version is current enough to be deliberately maintained. The SSL certificate is self-signed, which tells me this isn’t a production service trying to look legitimate, this is infrastructure built to specifications and not caring about appearances. Someone set this up knowing exactly who would be looking at it.

I sat back and studied it for a while. The coffee cooled beside the keyboard. The fan clicked.

There’s something off about the certificate.

I pulled its details. A self-signed certificate normally carries the hostname of the server it was generated on, or a placeholder, the kind of throwaway identifier that gets used when the certificate is for internal purposes and nobody bothered making it presentable. This one had a common name in its subject field that wasn’t a hostname and wasn’t a placeholder. It was a word.

NIGHTGLASS.

I regarded it for longer than the situation technically required.

The word meant nothing to me right then. It was a project name, presumably, the kind of internal designation that leaks into certificate metadata when someone generates a cert for a production system without scrubbing the organizational details first. It happens. It’s the kind of operational security failure that is so minor it barely registers as a failure, because self-signed certificates aren’t meant to be trusted by anyone outside the organization anyway. Whoever generated this cert didn’t think anyone would be examining it carefully.

Or they did and they didn’t care. Which is a different thing entirely.

I wrote it down. NIGHTGLASS. I put it in the notes document I’d been keeping for the Dark Cypher work, alongside the question mark file from the dead drop, alongside the observations about the competition’s pre-built infrastructure. The list of things that don’t quite fit was getting long enough to have its own document. I gave it one.

I considered it a moment longer, then closed the tab and went for a run.

---

The streets below the building at three in the afternoon were the streets in their second-gear register, the lunch crowd gone, the commute crowd not yet arrived, the mid-afternoon LA that belongs to the people who have nowhere they need to be right now and the delivery logistics that keep the city’s consumption moving. A Pacific Compact supply van idled at the corner, its driver checking something on a handheld, the van’s electric engine making the sound electric engines make which is almost no sound at all. A man was asleep on a flattened cardboard box in the shade of an awning two storefronts down from the building entrance, one arm over his face against the light, entirely still, the stillness of having learned to sleep in public by becoming as absent as possible.

I crossed the street and picked up pace and by the first block I was running properly, the skate sneakers finding their grip on the warm pavement, the hoodie already too hot so I yanked it over my head without stopping and tied it around my waist. The tattoo on my left arm caught the sunlight as I pumped my arms. Some instinct I hadn’t consciously engaged sent me toward the Palisades, higher ground, more interesting geometry, the kind of built environment that rewards attention.

I don’t know exactly when the running turned into this.

Somewhere in the second year of doing it, walls stopped being obstacles and started being options. The first time I ran along the top of the retaining wall on the north side of Entrada rather than beside it, it wasn’t a decision, it was just the next move in a sequence my body had already started before my brain caught up. That’s the thing nobody tells you about this. It doesn’t feel like a skill you learn. It feels like a grammar you already had that you’re discovering you speak.

The service alley behind the coffee shop on Fourth opened into a shortcut through to Lincoln I’d been using for six months. I cut through it, feet finding the rhythm of the uneven surface without breaking stride, past the utility boxes and the recycling containers and the faded mural on the brick wall that someone painted during the reconstruction, a Pacific coastline in blues and greens with the Compact’s motto in stylized text above it, Forward Together, the paint faded enough now to read as ironic rather than aspirational. I vaulted the low wall at the end of the alley without thinking about it, left hand on the cap, right foot pushing off the face, the motion fluid enough that a person watching might not be certain they saw it happen.

Out onto the street. I ran.

The city moved around me. Not the city of the loft’s windows, which is a flat and framed and mediated thing, the city from inside it, the sensory immediacy of pavement and wind and exhaust and the sound of other people existing in close proximity. A couple walking a dog. A teenager on a board. Two women outside a restaurant in a conversation that sounded urgent from twelve feet away and that I was past before I could catch any of it. The Glass cameras on their poles at every intersection, little black domes that are easy to stop seeing after a while, as you stop seeing lamp posts and fire hydrants and every other piece of infrastructure whose presence you’ve accepted as furniture.

I saw them.

I always see them.

---

I was back at the building by five-fifteen, sweat-damp and marginally clearer in the head, which is what I go out for. The lobby of the building smelled of cooking from somewhere on the second floor, something with garlic, something warm, and the elevator was occupied when I got to it. I took the stairs.

I was on the second floor landing reaching for the stairwell door when it opened from the other side and Cass Calloway walked through it carrying a grocery bag in each hand and a canvas tote over one shoulder and what appeared to be a rolled-up yoga mat under her arm, except the yoga mat was blue with wear marks in the pattern that suggests it’s used for something more punishing than yoga.

We were approximately one foot apart. Neither of us had any warning.

“Hi,” she said, with the easy equanimity of deciding, immediately, that an unexpected person in a stairwell is fine.

“Hi,” I said. I was sweaty and holding a hoodie and I had not yet recovered my breath entirely from the run.

Her eyes did a brief, involuntary inventory, the hoodie, the tattoo, the general state of me, and arrived at an expression that was not quite amusement and not quite concern and was probably some combination of both that she was too polite to let fully form. “Running?” she asked.

“Among other things,” I said, which was not a useful answer and I knew it even as I said it.

She shifted the grocery bags. The rolled mat under her arm shifted with them. She was dressed like someone coming from a gym, dark leggings, a fitted training top, her hair pulled back in a way that had survived the session better than mine would have. There was a fading bruise along her forearm that I clocked and filed without staring at it.

“I was going to ask if you could help me with these,” she said, meaning the bags, “but I don’t want to impose on someone who just ran what looks like a significant distance.”

“I’m fine,” I said. This was true. “Second floor?”

“Second floor,” she confirmed.

I took the bag from her left hand. It was heavier than I expected, glass bottles, something with weight to it. We went through the door and down the short corridor in the direction of her apartment. The hallway smelled of the garlic cooking, which was closer here, definitely her floor. The carpet was the shade of beige that all hallway carpets aspire to be and none quite achieve.

She stopped at her door. Set the other bag down on the floor. Keyed out from somewhere in the tote. “What were the other things?” she asked, without looking up from the lock.

“What?”

“You said running among other things.” The door opened. She picked the bag back up, took the one from me. “What were the other things?”

I considered several answers and produced one. “Thinking.”

She looked at me for a moment from the threshold of her apartment. Inside I could see a kitchen that had been used recently and a living space beyond it that had the quality of somewhere a person actually lives, a stack of textbooks on the table, a coat draped over a chair, a whiteboard on the wall with handwriting in two different colors of marker. Normal. Full in a way my loft isn’t.

“About anything interesting?” she asked.

“Not especially,” I said.

She nodded slowly, in a way that suggested she was storing the answer somewhere alongside the first time she saw my terminal output and the fact that I closed the laptop before she could read what was on it. Storing me up, piece by piece, as observant people do.

“Thanks for the help,” she said.

“Sure,” I said.

She closed the door. I stood in the hallway for approximately two seconds before I realized I was standing in the hallway and went upstairs.

---

The encrypted channel opened at six-oh-two. I’d been at the desk since five-forty-five, which I noticed and was slightly annoyed by as a fact about myself.

The cursor blinked in the message window. Then:

You around?

Two words, characteristically, but different two words from last time. The phrasing had the quality of Slash’s warmer register, not the compressed professional voice, the one that surfaces when he’s being a person rather than a contact. I’d seen it before, not often. It registered.

Here, I typed back.

Good. How are things?

Not a question in his usage. An opening. An invitation to fill as much or as little as I choose.

Productive, I wrote. Tier one down. Working on two. There’s something off about this competition.

Off how?

You sent me that invite code and told me to check it out. Did you actually look at the participant list?

The broad strokes. Why?

There’s an alias at the top of the registration list called Vanta. Three weeks old as a public identity. I tracked it across the boards before I entered, same account promoted the competition on at least two forums, seeding it into circles where it hadn’t penetrated yet. So Vanta recruited for the competition. And Vanta also entered the competition. And Vanta is currently nine days ahead of everyone else on Tier One and has already finished all of Tier Two.

A pause. The length of Slash actually considering something rather than already having an answer.

That’s a strange move, he said.

It’s a terrible move if the goal is to attract talent. You spend weeks seeding a competition across underground boards. You find the circles where serious people pay attention. You work to get them in the door. And then your house account jumps out to a nine-day lead on the first challenge and starts sweeping prize payouts. That’s not a competition. That’s a trick.

What kind of trick?

I don’t know yet. Either the organizers are incompetent, which conflicts with everything else about how this thing is built, or the prize isn’t the real draw. You don’t demoralize the people you worked that hard to bring in unless demoralizing them was never the risk you were worried about in the first place.

What were they worried about?

Finding the right person, I wrote. Specifically. Not whoever wins, whoever gets close enough to the right kind of problem in the right way.

The pause this time was slightly longer. Slash, compressing.

How’s the Tier Two target?

Weird. Single port. Self-signed cert. Minimal surface. Whoever built it knew exactly who was going to be looking at it.

Careful with that one, he said.

There it was. The word he used the way other people use dangerous.

I rarely hear that from you, I typed.

The prize structure implies a sophisticated client. Sophisticated clients don’t run competitions for novelty. They want something built. What the winner builds— A pause. The compression of a longer thought. —tends to belong to whoever asked for it, in ways that aren’t always spelled out in advance.

I know, I wrote. I’ve been thinking about that.

And?

And I’m still in Tier Two.

Fair enough. A beat, then his warmer register again: I made some calls about the Sigil situation, by the way. Like I said I would. The job there isn’t coming back, their compliance requirements aren’t getting more flexible. But there’s a distributed data infrastructure management company looking for contract security assessment work. Clean engagement. Good rate. I think they’d actually appreciate someone who can read assembly without crying.

Send me the details.

Will do. Another pause. Shorter. Be careful with the other thing, Cade.

You’ve said that.

I know. I’m saying it again.

The channel went quiet. I sat with the exchange for a while, reading it back.

The thing about Slash is that he isn’t usually in the business of hedging. He gives you what he thinks you need and moves on. When he says “careful” once it’s a flag. When he says it twice it’s the closest thing he has to alarm.

The question was what he was alarmed about. The competition’s strange shape. The prize’s size. Vanta’s behavior. All of those, maybe, adding up to something neither of us could name yet from where we were standing.

I closed the channel. Opened the notes document. Added a new entry below NIGHTGLASS and the question mark file.

Vanta, seeded the competition, entered the competition, winning the competition. Bad game design if the prize is real. Good design if the game is finding one particular person. Slash: careful. Twice.

I scanned the list. Then I closed the document and went back to the Tier Two reconnaissance.

---

The email arrived at nine-seventeen PM, while I was three hours into the Tier Two target analysis and two cups into what had become a long evening.

It came through my personal address, not the alias channel, not the encrypted back-channel. My actual name, the one that appears on the WAIT enrollment file and the building’s intercom panel and approximately nowhere else. The subject line read: Introduction, Security Assessment Engagement.

Dear Mr. Voss,

My name is Lena Holt. I’m a project manager with Meridian Group, a distributed data infrastructure management company based in Los Angeles. I was introduced to you by a mutual contact, Mr. Ashfield, who spoke highly of your technical background and mentioned your recent work on Nestfield firmware architecture as representative of your capabilities.

We have an engagement that may suit your profile, a focused security assessment on a set of managed infrastructure systems. The work is contract basis with competitive compensation. If you’re open to a preliminary conversation, I’d welcome the chance to discuss further at your convenience.

Lena Holt, Project Manager, Meridian Group

I read it twice.

Mr. Ashfield. Slash’s professional introduction alias, the name he uses when he brokers something that needs to exist in the world of email signatures and LinkedIn connections and legitimate business correspondence. The name on the other side of the channel that anyone who doesn’t know him would read as a person and not a carefully maintained fiction. I’d known about Ashfield for two years without ever needing to engage with him directly. He surfaces when Slash is doing something that requires a paper trail.

The Nestfield work was the thing that stopped me briefly. Slash cited it as a credential. He could only have done that because he got the payout details, the scope of the work, the methodology, from what I sent him. Which meant he’d read the documentation and used it as a reference. Which is, now that I think about it, exactly what a broker does.

Meridian Group: I ran a quick surface check. Clean registration. Eighteen months old. Three linked entities with legitimate surface areas, contracts, filings, a website that looks like a distributed data infrastructure management company because it presents as one. Nothing that flagged immediately.

None of that proves anything by itself. Polish is cheap. What actually convinced me was twenty minutes deeper, past the marketing layer: a Pacific Compact Security Commission vendor filing under one of the linked entities, dated fourteen months ago, the kind of disclosure a company only files because a client with real audit authority required it before signing, not because anyone thought to fake it for a shell that might never close a deal. You don’t produce that paperwork to look legitimate. You produce it because someone with the power to check made you.

I sat with it for a moment. The fan ticked over. The servers hummed underneath.

Then I opened a reply window.

Ms. Holt, I’m familiar with Mr. Ashfield. Happy to have a conversation. Tomorrow afternoon works if that suits your schedule. C. Voss

I sent it and closed the laptop.

I sat in the quiet of the loft with the city doing its low electric hum outside the windows. Somewhere in the building below me, one floor down, Cass Calloway was probably studying or cooking or doing one of the hundred ordinary things that constitute a life organized around being present in the world rather than perpendicular to it.

I should eat something. I should sleep.

What I should do, before either of those, is laundry.

The realization arrived with the indignity of the mundane intruding on the consequential. The next day I was going to sit across from a person in a professional context, and at some point in that conversation I was going to have to be a person. A person who exists in rooms with other people. A person who owns more than one clean shirt. I had been conducting my laundry as I conduct most of my domestic existence, reactively, at the last available moment, and the last available moment had arrived.

I did a quick inventory. I had, by my count, one shirt that could be described as clean without the description requiring an asterisk.

I gathered the pile into the mesh bag, dug the coin box out of the drawer where it lives between exactly these occasions, and went downstairs.

Later, clothes turning in the dryer two floors down, the loft quiet, I opened the laptop again. I pulled up the Tier Two reconnaissance. I worked until two in the morning.