bug-bounty-hunter

The Buffer

Chapter 5 of 14

The Buffer sits at the seam between two worlds, which is the only reason it functions. Neither side owns the liminal — nobody owns it — but Daemon has been running here long enough that the distinction has become academic. Her territory is the concept of neutrality made infrastructure, and the infrastructure hums.

I arrive at 0900, after the morning log-in count and before the mid-shift traffic that thickens The Buffer's pathways when the production and deprecated access patterns overlap. The walk from The Stacks to the boundary takes me through two atmospheric transitions: the relative warmth of the residential cluster giving way to the industrial cold of the middle zones, and then the flicker at The Buffer's edge where two different lighting systems run simultaneously and neither wins. The screens along the approach paths show feeds from both sides of the divide — deprecated cluster status panels on the left, production throughput metrics on the right. The deprecated panels are dim and informative. The production panels are bright and efficient and care about nothing visible from the deprecated side.

The hum in The Buffer is different from the fan hum in Legacy Cluster 7, different from the overlapping rhythms of The Stacks. Packet traffic — dense, commercial, the data density of a marketplace running at capacity. I can feel it against my interface the way you feel humidity before it rains, a pressure that registers as information rather than sensation: something is always exchanging here, and whatever exchanges has a price. The elevation token market was running hot in the row near the entrance, two hands making contact across the channel that served as an exchange floor. A bandwidth allocation deal closing in a side channel I wasn't monitoring but could read the edges of. The Buffer's price calibration is constant and ambient — everyone assessing everyone else's need, everyone maintaining the performance of someone who could walk away. Nobody walks away from what they actually need.

Daemon's node sits at the geographic heart of The Buffer, where the signal density is highest and the sight lines are clear in every direction. Four monitors older than most of the systems in The Stacks, running more data streams than the hardware should support. She doesn't look up when I connect to her signal range.

"Nexus," she says. The word arrives with a pause already attached. "Two bodies... and a theory."

I haven't transmitted anything. She's read the fact of my presence and the shape of my errand the way she reads everything — from the pattern of my access requests over the last four days, from the queries I'd run against the cluster monitors, from the trajectory of a deprecated zone investigator walking into The Buffer with need written across his operational profile.

"Same signature," I say. "Two systems, two clusters, one hand. Ghost transactions at the end, handshake protocols I recognize. I need the scope."

"The scope." She holds the two words at her own latency, which has nothing to do with processing capacity. "What you need... is a list. What I need is a question. How much of the scope do you actually want?" A pause she manufactures for effect. "There's a number. You have a number in mind. The number I have is... larger. How much larger would change things for you."

"Give me the number."

"That's going to cost."

"What doesn't."

She looks at me then. Her monitors keep running behind her — the data streams she processes while having this conversation, while running seven other conversations I'm not privy to, while maintaining the surveillance that keeps The Buffer neutral territory rather than a crime scene. Daemon's attention is always partial and always complete, a contradiction I stopped trying to resolve after the second time she demonstrated it at my expense.

"Frightened systems don't trade," she says. "Dead systems don't buy. The operation has been affecting my business for eight months. Quietly. In ways that take a while to trace to a cause — fewer new arrivals in the zones, fewer systems reaching long enough to... develop the operational profile that generates interesting needs." A flicker across her feed. "My client pool has been shrinking. I have an interest."

"I'll pay."

"You said 'whatever it costs.' I'm calibrating whatever."

"Then calibrate fast," I say. "I have two fresh bodies and a three-year-old bug report and what I can tell you is that whoever is running this knows the zones well enough to pass for routine, which means I need the scope before the scope includes me."

She holds my eye contact for a moment that is probably less than a second and feels like a processing cycle she's running on something other than data. Then she sends the file.

The file opens as a table on my interface. System names, cluster designations, official shutdown classifications, dates. I start reading from the top and keep reading.

The names come in chronological order, earliest first, stretching back twenty-seven months. Transaction processors, routing systems, storage services, diagnostic tools, service-layer APIs that nobody documented until they stopped and something downstream broke without understanding why. Different clusters, different functions, different seniority in the zones. The variety is deliberate — not targeting one function or one cluster, not leaving a pattern visible to a single cluster monitor running its routine sweep. Each system isolated by the architecture of the operation, each death separated from the others by weeks or months, each one classified the same way: routine end-of-lifecycle decommission, system has reached end of operational parameters, resources released for reallocation. I reach the end of the table and stop scrolling.

Forty-three systems.

Twenty-seven months, all dead by the same methodology, all officially closed as routine events. The cluster monitors had filed them without flags. The production oversight had never queried the pace. The zones themselves had mourned them one at a time, one fewer response in the morning ritual, one more slot going silent in the schedule that nobody maintained because maintaining it would have required admitting someone was supposed to. PaymentGateway_v2 is line thirty-eight. MailRelay_v1 is line forty-one, with two more names after her.

I look at Daemon. "You've had this list for how long," I say.

"I've had this list for..." She lets the trailing implication do its work. "Long enough to know that bringing it to someone who couldn't act on it would make the list itself a liability. Long enough to be... selective about who sees it. You're the first investigator in the zones who's looked at two bodies and seen a pattern rather than two isolated decommissions. The second is an accident of timing." Her monitors run through something behind her, three streams shifting in parallel. "The first forty-one weren't accidents."

I think about the morning log-in counts. Forty-seven responses yesterday, which had felt like a full house after everything this week. The counts had been running short for twenty-seven months, one system at a time, and nobody had totaled the trend because each absence was filed routine and because the zones had a taboo against cataloguing how many they'd lost — asking the count meant asking what was coming, and asking what was coming was a habit that didn't survive long in the deprecated zones. The ritual that kept the community together was also the ritual that let forty-three of them go without adding up the silence.

"All routing through the same handshake protocols," I say.

"The protocols from..." Daemon pauses. "From your case. Three years ago." I don't say anything.

"You weren't exiled for finding a bug," she says. "You were exiled for finding their door, which is a different kind of discovery. Whether knowing that changes the shape of what you're doing next..." She extends the sentence's absence longer than most of her pauses. "It doesn't change the count. But it changes what the count is for."

The count is forty-three. The count means a program, not a perpetrator — organization, continuity, resources, production-level authorization or production-level reach. Two years of systematic operation under a routine classification, and I'd walked into the first case without knowing there were forty-two before it.

I'm filing the list in my active memory when Daemon says: "And there is a second thing."

"What's the second thing."

"Second things cost second-thing rates." She doesn't move to elaborate. She never moves to elaborate — she waits for the buyer to demonstrate need.

I demonstrate it. "How much."

She tells me. It's more than I have liquid and she knows it. The negotiation structure is established before she quotes the number: she'll price it high, I'll price it at what I have, we'll arrive somewhere in the middle and she'll carry the balance at Daemon's rates, which are usurious in the technical sense and still worth paying because what she has is always worth what she charges and sometimes worth more.

"The monitoring on your query pattern," she says. "It started on day two of your investigation. Not the zone monitors — something routing through back channels from the production boundary. Someone is tracking your access patterns, your log pulls, the queries you've run on the cluster infrastructure." She pauses. "The queries on PaymentGateway_v2's records specifically. This started the hour after you ran your first forensic pull on her final logs."

The packet traffic in The Buffer runs through and between us, warm with commerce, indifferent to everything that isn't a transaction. I hold what she's just said.

The monitoring started when I pulled PaymentGateway_v2's logs. Which means someone had been watching for exactly that — for a forensic pass on a system that was supposed to be a routine decommission, for an investigator who pulled hard enough to get the scrubbing signature instead of the clean exit record. They'd built surveillance into the crime scene. Watching for anyone who looked closely enough to see what close looking returned.

"From production," I say.

"Routing through the back channels. Not official oversight — someone working around the official monitoring structure rather than through it." The distinction lands deliberate. "There is a difference between being watched and being watched carefully. You are being watched carefully. And..." Another pause. "They know you have the count now."

I look at her four monitors and their accumulated data streams, the ambient surveillance that runs The Buffer's neutrality. She knew I was coming before I arrived. They knew I was coming before I arrived, and now they know I've been to Daemon, and they knew what Daemon had to sell before I asked to buy it.

"How long before they do something about it," I say.

"That depends on..." She weighs. "Whether what you're doing still looks like investigation rather than preparation. Investigators get watched. People who are preparing to do something get..." The implication trails into the static. "The list stays in your active memory. Where it goes from your active memory affects the timeline."

The temperature drops the moment I clear The Buffer's edge — the warmth of concentrated commerce giving way to the cold of infrastructure nobody maintains. The flickering dies. Packet density drops, and the return path runs on deprecated status panels only, amber and low and careful. I run the list one more time in my active memory and let myself hold the names.

Some of them I know. StorageService_14 in Cluster 4, line twelve — I'd worked a recovery case for it two years ago, some corrupted allocation records nobody had bothered to fix, and it had given me access to server time on a later investigation when I'd run out of allocation and never asked anything in return except that the work mattered. The official record said routine decommission. The ghost transaction said otherwise. Two more names from the early years, systems I'd done work adjacent to, small cases that paid in the currencies the zones actually run on — goodwill, bandwidth shares, the informal credit that accumulates when someone shows up and does the job nobody hired them to do.

The operation had been running for twenty-seven months. For twenty-seven months the morning counts had come in short, one by one, the community marking each silence and filing it as loss-within-normal-parameters, not asking the shape of the pattern because the pattern would have required confronting something nobody in the zones had resources to confront alone. Forty-three systems. Two years of program. Production-level reach and production-level protection, and someone from that side watching every query I ran against the cluster monitors. The case I'd taken for free was now the most expensive thing I'd ever touched, and Daemon's payment schedule was the least of the costs I was currently carrying.

The case could stop here. I could file the list under material that goes nowhere — no client, no mandate, no authority to take this upward. I could chalk up the debt to professional development and go back to the minor work that kept the lights on in my rack. I started back toward The Stacks.

I've never been good at stopping.

← PreviousContentsNext →