SPF ~all vs -all: The Softfail Epidemic
Most domains end their SPF record with ~all, which tells receivers to accept mail that fails. It's the safe default that quietly guarantees SPF can't stop spoofing on its own.
Read moreBlog
On protocols, security, and how the internet actually works.
DKIM Replay: A Valid Signature Is Not Consent
In April 2025, phishing emails arrived from no-reply@google.com with a valid Google DKIM signature and a DMARC pass. Nothing was forged. That's the problem with DKIM.
Read moreNSEC3 Was Supposed to Hide Your DNS Zone. It Doesn't.
DNSSEC's proof that a name doesn't exist accidentally leaks the names that do. NSEC3 hashed them to stop zone walking — and offline cracking walked right through it. Here's why RFC 9276 tells you to set iterations to zero, and what actually works.
Read moreThe .internal TLD Took a Decade, and It's Only Half a Fix
ICANN finally reserved .internal for private networks in July 2024. It kills the name-collision risk that haunted .corp and .home — but it's a reservation, not a special-use domain, so the query leaks are still your problem.
Read moreBIMI: Is the Brand Logo Worth $1,000 a Year?
The logo in your inbox costs four figures a year — not because the protocol is expensive, but because two mailbox providers decided a certificate authority should stand between you and a picture.
Read moreThe Public Suffix List: The File That Decides Where a Cookie Can Go
Nothing in DNS tells a browser where a registry stops and someone's website begins. So the entire web leans on a single hand-maintained text file to draw that line — for cookies, for certificates, for who can impersonate whom.
Read moreChrome Runs Its Own Root Store Now, and the OS Lost a Job
For 25 years your browser trusted whatever the OS trusted. In September 2022 Chrome quietly stopped asking — and in November 2024 it dropped a CA the OS still trusts.
Read moreYour CA Now Decides When Your Certificate Renews
In 2020 Let's Encrypt had to revoke 3 million certificates with no way to tell them to renew. ACME Renewal Information — now RFC 9773 — hands the CA a dial on your schedule.
Read moreCertificate Transparency Runs on Static Files Now
For a decade, every TLS certificate was published to a live, append-only cryptographic database that browsers forced operators to keep online within 24 hours. In 2025 that machine got torn out and replaced with a folder of static files in a bucket. It's a better design.
Read moreHow a Certificate Authority Dies
A CA doesn't usually die from a hack. Entrust died the modern way — from paperwork: late revocations, missed deadlines, and a browser root program that finally stopped believing the promises.
Read moreHPKP: The Security Header Too Dangerous to Keep
HTTP Public Key Pinning let any site pin its TLS keys in a header. It also let you permanently brick your own domain — or let an attacker hold it hostage. Browsers killed it.
Read moreYour Clock Is a Security Dependency
Certificate validity, HSTS, DNSSEC signatures, TOTP codes — a surprising amount of your security is really an assertion about what time it is. And the protocol that decides what time it is spent forty years believing whoever answered first.
Read moreDNS 0x20: The Spoofing Fix Written in Random Capitals
In 2023 Google's resolver quietly started asking for wIKiPEDiA.oRG instead of wikipedia.org. It's not a bug — it's a 15-year-old anti-spoofing hack that never became a standard, works anyway, and shipped because it needs permission from absolutely no one.
Read moreDNS Cookies: The Anti-Spoofing Fix Nobody Turned On
A decade ago DNS got a cheap defense against spoofed answers and reflection attacks. Your resolver almost certainly supports it. It almost certainly doesn't require it — and that gap between 'supports' and 'requires' is the whole story.
Read moreACME: How Certificate Issuance Became an API Call
Getting a TLS certificate used to mean email, paperwork, and pasting a CSR into a web form. ACME turned it into a protocol a script runs at 3am. Here's the mechanism — and what we traded for it.
Read moreKeyTrap: DNSSEC's 'Try Every Key' Rule Was the Bug
One crafted DNS packet could freeze a validating resolver for hours. KeyTrap wasn't a coding mistake — it was a MUST in the DNSSEC spec, untouched since 2000.
Read moreHTTP/2 CONTINUATION Flood: The DoS That Never Reaches Your Logs
In April 2024 a researcher showed a single TCP connection could crash Apache, Node.js, and Tomcat with HTTP/2 frames that never appear in an access log. The bug was everywhere at once — because it lived in the spec's seams, not the code.
Read moreA BGP Hijack Could Forge Your TLS Certificate. Now It's Harder.
For years, an attacker who could bend a BGP route near a certificate authority could pass its domain validation and get a real, browser-trusted cert for a domain they didn't own. In 2025 the industry finally made that much harder. Here's how MPIC works and what it doesn't fix.
Read moreYou Can't Put a CNAME on the Apex (Here's Why)
Every CDN wants you to point your root domain at a hostname. DNS has forbidden exactly that since 1987 — so the industry built a pile of non-standard hacks, and the one real fix still doesn't work in your browser.
Read moreQNAME Minimization: The DNS Privacy Fix That Shipped
Every DNS server between you and a site used to see the full name you typed — even the ones that only needed the TLD. One resolver-side change fixed most of that, and unlike DNSSEC, it shipped without asking anyone's permission.
Read moreLet's Encrypt Turned Off OCSP. Nobody Noticed.
In August 2025 the largest CA on the internet shut down its OCSP responders. Almost nothing broke — because online certificate revocation checking was already theater.
Read moreSMTP Smuggling: One Bug That Spoofed Past SPF, DKIM, and DMARC
In December 2023 a researcher sent email that impersonated anyone he liked and still passed SPF, DKIM, and DMARC. He didn't break the authentication. He made the receiving server read one connection as two messages.
Read moreEncrypted Client Hello Hides Less Than You Think
ECH finally encrypts the one field HTTPS always leaked — the site name. But your IP, your DNS lookup, and the size of the crowd you hide in decide whether it means anything.
Read moreHTTP/2 Server Push Is Dead. Early Hints Won by Doing Less
Server Push was HTTP/2's marquee feature: send files before the browser asks. Chrome ripped it out in 2022 after finding it used on 0.7% of sites and often making things slower. What replaced it did the opposite thing, and that's why it worked.
Read moreHTTP/2 Rapid Reset: How One Feature Broke the DDoS Record
In late 2023 a botnet of 20,000 machines set a DDoS record against Google, Cloudflare, and AWS. The weapon wasn't bandwidth. It was an HTTP/2 feature working exactly as designed.
Read moreHappy Eyeballs: The Algorithm That Hides Broken IPv6
Dual-stack clients race IPv4 and IPv6 and use whichever answers first. RFC 8305 made connections feel instant — and made broken IPv6 invisible to the people running it.
Read moreChrome Encrypted Your DNS. It Never Checked It.
Turning on Secure DNS in Chrome encrypts the pipe to your resolver. It does nothing to prove the answer coming back is true. Encryption and authentication are different problems, and browsers quietly picked one.
Read more"Just Add DMARC" Is Terrible Advice
Publishing a DMARC record is the easy 5%. The advice skips the part that actually stops spoofing: alignment, reading the reports, and the slow walk to enforcement.
Read moreGREASE: The TLS Values That Mean Nothing on Purpose
Your browser offers servers a cipher that isn't a cipher and an extension that does nothing, billions of times a day. It's called GREASE, and it's the only thing keeping TLS able to change.
Read moreWe Moved TLS Setup into DNS, and DNS Isn't Signed
The HTTPS DNS record hands your browser connection parameters — which protocol, which IPs, even the key that encrypts your ClientHello — before the handshake starts. For most domains, it arrives over a layer nobody signed.
Read moreEvery DNS Provider Should Turn On DNSSEC by Default
DNSSEC's real problem isn't cryptography. It's a two-party handshake between your DNS host and your registrar that almost nobody completes — and automation already fixes it.
Read moreCAA Records: The Certificate Restriction Nobody Sets
Every public CA has been legally required to honor CAA records since 2017. It's free, it's one line of DNS, and after nine years barely 15% of sites use it.
Read moreSecurity Header Checklists Are Not Security
A site can pass every header scanner with a green A+ and still be trivially exploitable. The checklist grades the envelope, not the letter — and the gap is where the attacks live.
Read moreHTTPS Everywhere Won. That Was the Easy Part.
In October 2026, Chrome starts warning on plain HTTP by default. A fifteen-year campaign finished — and it turns out we solved the tractable problem, not the hard one.
Read moreEmail Is More Secure Than Slack
Everyone treats Slack as the modern, secure successor to email. But on Enterprise Grid, an org owner can export every DM you ever sent — including the ones you edited and deleted — and Slack holds the plaintext to do it. Email's transport is a 1982 disaster, and yet the thing it gives you that Slack structurally can't is the one that matters: custody. Here's the case for the medium nobody defends.
Read moreI Publish a Free npm Package. Does the Cyber Resilience Act Apply?
The EU's Cyber Resilience Act is in force, and its reporting rules bite in September 2026. Whether it touches your open-source project comes down to two words - 'commercial activity' - and a brand-new legal role invented to keep maintainers out of the blast radius.
Read moreLog4Shell Fixed Our Paperwork, Not Our Dependencies
Four years after a patch shipped, Sonatype found roughly one in eight Log4j downloads was still a vulnerable version. We got very good at listing our broken dependencies and barely better at not shipping them.
Read moreWHOIS Privacy Is a Double-Edged Sword
GDPR redacted WHOIS for everyone in 2018 — grandma and the phishing operator got the same anonymity on the same day. The access system meant to balance it was estimated at $27M, then shelved. Only one edge of the sword ever shipped.
Read moreBug Bounties Created Perverse Incentives
A bug bounty pays per accepted report, so it optimizes for accepted reports — not for security. That gap was quietly draining maintainers for years before AI slop made it impossible to ignore.
Read moreDNS Is the Internet's Weakest Link
Whoever controls your DNS can get a valid TLS certificate for your domain, reroute your mail, and become you. It's the root of trust almost nobody signs.
Read moreThe SSL Labs A+ Grade Is Too Easy to Get
An SSL Labs A+ certifies your TLS channel is configured well. People wave it around as proof they're secure. The gap between A and A+ is one HTTP header — and a phishing kit clears it too.
Read moreApple's Private Relay vs VPNs: Different Problems
People call iCloud Private Relay 'Apple's VPN.' Architecturally it's almost the opposite of one — and that difference is the whole point.
Read moreIPv6 Adoption Is Never Going to Happen (Fully)
In March 2026 IPv6 crossed 50% of Google's traffic for the first time. Everyone called it a milestone. It's actually the shape of a permanent stalemate.
Read moreThird-Party Cookies Didn't Die. They Moved Into DNS.
Google spent five years promising to kill third-party cookies, then quietly gave up. It barely mattered. Tracking had already escaped into the DNS layer — and it took your session cookies with it.
Read moreRate Limiting Is Not a Security Strategy
I built a rate limiter and then watched it fail to stop the one attack everyone assumed it prevented. Rate limiting is an availability control wearing a security badge.
Read moreCloudflare's Outages Keep Rhyming
Three Cloudflare outages — a 2019 regex, a 2025 third-party dependency, a 2025 feature file — turn out to be the same outage wearing different clothes: a change that shipped everywhere at once and met a bug with nowhere to hide.
Read moreBGP Hijacks: A History of the Same Mistake
From the 1997 AS7007 accident to the 2022 KLAYswap crypto heist, BGP hijacks keep exploiting the same missing feature: nobody has to prove they own a route. Here's the pattern, and why the fix stays optional.
Read moreWhy Registrars Keep Getting Hacked
In 2016, attackers owned a Brazilian bank's entire online presence for five hours without touching one of its servers. They logged into its domain registrar.
Read moreThe .io TLD Has a Political Problem
Startups treat .io as shorthand for input/output. The two letters actually stand for a contested colonial territory that is now being handed away — and the domain rides on its existence.
Read moreNIST's New Password Rules Are Final. Almost Nobody Follows Them.
NIST finalized SP 800-63B-4 in 2025: no forced resets, no complexity rules, 15-character minimums, mandatory breach blocklists. Your IT department still makes you rotate P@ssw0rd1 every 90 days. The standard changed. Behavior didn't.
Read moreEmail Is Unfixable
SMTP was designed in 1982 for a network where everyone trusted everyone. Every security property we've wanted since — knowing who sent a message, encrypting it in transit — has been bolted on as an optional patch on top of a protocol that can't be replaced. That's not a bug we haven't fixed yet. It's the shape of the thing.
Read moreThe Economics of DDoS: Why It Costs $10 to Attack
A DDoS attack that knocks a small site offline for an afternoon costs about as much as a pizza. The interesting question isn't that it's cheap — it's who's actually paying, because it isn't the attacker.
Read morePort Scanning in 2026: What You Can and Can't Learn
Port scanning is supposed to be step one of reconnaissance. In 2026 a full scan of a target mostly tells you it's behind a firewall and a load balancer. The map of the internet stopped being drawn by scanners.
Read moreFree SSL Certificates Made Phishing Easier
When HTTPS cost money, phishing sites mostly ran on plain HTTP. Free certificates didn't break TLS — they dissolved the one accidental signal users had been leaning on.
Read moreRDAP Is Replacing WHOIS (Slowly)
WHOIS is a protocol from 1982 that returns unparseable text. RDAP fixed all of that in 2015. It took a contractual deadline in 2025 — not better engineering — to finally move the industry.
Read moreYour TLS Certificates Already Got Shorter
Everyone panicked about the 47-day certificate landing in 2029. Nobody noticed the first cut already happened: 200 days, mandatory since March 2026. The real story isn't validity — it's the revalidation clock dropping to 10 days.
Read more301 vs 302: The Redirect That Breaks Everything
The difference between 301 and 302 isn't 'permanent vs temporary.' It's two unrelated decisions the codes quietly bundle together — and a 301 you set by accident can live in a stranger's browser cache forever.
Read moreHow Reverse DNS Works (and Why FCrDNS Matters)
Reverse DNS is the one record you can't set yourself, no RFC makes it mandatory, and your mail still gets rejected without it. Here's how a courtesy convention became a gatekeeper.
Read moreHSTS Preload: Handing Your Security to Browser Vendors
Adding your domain to the HSTS preload list is a one-way door. The list lives inside the browser binary, not on your servers, so undoing it means waiting months for a Chrome release you don't control — and that's the part nobody mentions when they tell you to preload.
Read moreDANE: The Protocol That Failed on the Web and Won in Email
Everyone agrees DANE is dead — a beautiful protocol stranded behind DNSSEC that nobody deployed. That verdict is American. In the Netherlands it's mandatory, in 2026 Microsoft shipped it, and on the web it really is dead. Same protocol, three fates.
Read moreContent-Security-Policy Is the Hardest Header to Get Right
Most deployed CSPs do nothing. Google measured it: 94.7% of script-limiting policies are bypassable. The syntax is easy. The header is hard for a different reason.
Read moreMTA-STS: The Email Security Protocol Nobody Knows
SMTP encryption has a hole you can drive a truck through: any attacker in the path can strip STARTTLS and read the mail in cleartext. MTA-STS closes it. Then it makes you host a web page to do so, which is why almost nobody bothered.
Read moreHow SMTP Relay Actually Works in 2026
In 1982 every mail server relayed for anyone — that was the design. Now relaying for a stranger gets you blocklisted before lunch. The word 'relay' survived. Everything underneath it inverted.
Read moreWildcard Certificates Are a Security Antipattern
One private key on every server, covering every subdomain you'll ever name. Wildcard certificates trade a small convenience for a blast radius you can't see — and the standards body finally agrees.
Read moreWildcard DNS Records: The Footgun That Keeps Firing
A wildcard DNS record reads like 'match everything below this name.' It doesn't. It never touches names that already exist — and it dies quietly the moment you add one record deep in the tree.
Read moreNegative Caching: How DNS Remembers a Domain Doesn't Exist
You add a DNS record and the world keeps saying it doesn't exist. Nothing is wrong with your record. DNS cached its absence — under a TTL you never set, governed by a field in the SOA that nobody touches.
Read moreDNS Rebinding Turns Your Browser Into an Insider
A web page you open can reach the router, printer, and smart speaker on your home network — through your own browser. DNS rebinding has worked for over two decades, and why it still works says something uncomfortable about how we built local networks.
Read moreAnycast: One IP, Many Servers
The same IP address answers you in Seoul and someone else in São Paulo, from two different machines, and neither of you can tell. That's anycast — a lie told to BGP that the whole internet agreed to believe, and the trick that quietly made TCP work in hundreds of places at once.
Read moreWhy Email Forwarding Breaks Everything
SPF dies on the first relay. DKIM survives until a mailing list edits the message. Then DMARC turns a 40-year-old nuisance into bounced mail. A tour of email's most reliably broken feature.
Read moreDNS TTL: What It Promises vs What Resolvers Actually Do
You set a TTL of 300 expecting changes in five minutes. Then traffic keeps hitting the old IP for an hour. TTL is not a schedule — it's a hint passed down a chain of caches that each reserve the right to ignore you.
Read moreDKIM Alignment: The Part Everyone Gets Wrong
A valid DKIM signature does not mean DMARC passes. The signature proves a domain signed the mail — alignment decides whether that domain is allowed to speak for your From address.
Read moreHomograph Attacks: When the Domain Name Is a Lie
In 2017 a researcher registered a domain that displayed as apple.com in three major browsers, served over valid HTTPS. Every character was Cyrillic. The reason it's hard to fix is older and stranger than the bug itself.
Read moreWhy Your Browser Trusts 150 Certificate Authorities
Any one of ~150 certificate authorities can mint a valid cert for your domain. Your security is the weakest of all of them. Here's why it mostly works anyway.
Read moreWe Rebuilt TCP on Top of UDP and Called It QUIC
QUIC is reliable, ordered, congestion-controlled, and encrypted — everything UDP refuses to be. So why build it on UDP? Because UDP was the only new-protocol-shaped hole left in the internet's plumbing.
Read moreThe 13 Root Servers Myth
Everyone says there are 13 DNS root servers. There are more than 1,900. The number 13 is frozen into the internet because of a packet-size limit nobody worries about anymore — and the way that contradiction got resolved is one of the better infrastructure hacks ever shipped.
Read moreWhy DNS Uses UDP (and When It Doesn't)
DNS runs the busiest request-response system on the internet on top of a transport that doesn't promise your packet will arrive. That wasn't a shortcut. It was the right call — until the answers got too big.
Read moreHow They Know You're a Bot
You can type any browser you like into your User-Agent string. It's the one field nobody trusts — because everything underneath it, the TLS handshake and the HTTP/2 settings, was written by your libraries, not by you.
Read moreCDNs Are a Single Point of Failure
CDN consolidation means a single outage takes down thousands of sites. We traded distributed resilience for centralized convenience.
Read moreDNS-over-HTTPS Changed Nothing (and Everything)
DoH wraps DNS queries in HTTPS. Same questions, same answers, different transport. The technical change is simple. The political implications are enormous.
Read moreHow CDN Cache Poisoning Works
CDN cache poisoning tricks a CDN into caching a malicious response and serving it to all subsequent visitors. One weird request, a lot of collateral.
Read moreOCSP Stapling vs CRL: Two Bad Options for Revocation
When a certificate is compromised, it needs to be revoked. Both mechanisms for checking revocation are fundamentally broken. Here's why.
Read morePost-Quantum Cryptography: What Needs to Change in TLS
Quantum computers will break RSA and elliptic curve crypto. The transition has already started — not because quantum computers are here, but because 'harvest now, decrypt later' is a real threat.
Read moreSNI: The Field That Leaks Your Destination
HTTPS encrypts everything — except which website you're visiting. The Server Name Indication field travels in plaintext before encryption starts.
Read moreTLS 1.0/1.1 in 2026: Who's Still Serving?
TLS 1.0 and 1.1 are formally deprecated and rejected by every browser. And yet servers still offer them. How many, and why?
Read moreVPNs Don't Make You Anonymous
A VPN shifts who can see your traffic from your ISP to the VPN provider. You're trusting a different entity, not eliminating trust.
Read moreWe Stopped Teaching People How the Internet Works
Abstraction made the internet usable. It also made it opaque. The cost shows up in bad security decisions, helplessness during outages, and cargo-cult configuration.
Read moreWhat "End-to-End Encryption" Actually Means (and Doesn't)
Every messaging app claims E2EE. Most users think it means total privacy. The reality is more nuanced, and the marketing oversells it.
Read moreBGP: The Protocol That Runs on Trust
BGP routes the internet with no built-in authentication. Any autonomous system can announce any prefix. Route hijacking is trivially possible. Here's how it works and what RPKI is trying to fix.
Read moreCertificate Transparency: Why Every Cert Is Public
Every TLS certificate issued by a public CA is logged in a publicly searchable, append-only log. This happened because of DigiNotar. Here's how CT works and why it matters.
Read moreCompliance Is Not Security
SOC 2, ISO 27001, PCI DSS — organizations treat compliance as proof of security. It isn't. Compliance is a floor. Security is the actual state of your defenses.
Read moreDMARC Adoption: Still Decorative in 2026
Most domains that 'have' DMARC set it to p=none, which means monitor but don't enforce. It's a smoke detector without a siren.
Read moreWhat Happens in the First 50 Milliseconds of a DNS Query
You type a URL and the page loads. In between, your computer talked to at least four servers, traversed a hierarchy from 1983, and relied on caching so aggressive most queries never reach their destination.
Read moreHow DNSSEC Works (and Why Nobody Uses It)
DNSSEC is elegant cryptography with brutal operational reality. Two decades in, adoption is still under 20%. The protocol isn't the problem.
Read moreEmail Authentication: How Many Domains Actually Have All Five?
SPF, DKIM, DMARC, MTA-STS, BIMI — five standards, twenty years, and the percentage of domains that have all of them could fit in a margin of error.
Read moreThe 14 HTTP Security Headers (and Which Actually Matter)
Not all security headers are equal. Some prevent real attacks daily. Some are legacy relics browsers ignore. Here's an honest priority list.
Read moreHTTP Security Headers: Who Actually Has CSP?
The gap between easy headers and hard headers is enormous. Most sites set X-Content-Type-Options and skip Content-Security-Policy. The data shows exactly how wide the gap is.
Read moreLet's Encrypt Changed the Internet (for Better and Worse)
Before 2015, HTTPS meant someone cared. After Let's Encrypt, HTTPS means the server exists. We got encryption everywhere and lost a trust signal nobody has replaced.
Read moreMCP: What It Means for Security Tools
Model Context Protocol gives AI agents a standard way to call security tools. The recon workflow is about to change. The judgment part isn't.
Read moreThe Padlock Icon Should Be Removed from Browsers
The browser padlock creates false trust in hundreds of millions of users. HTTPS means encrypted, not safe. The icon should go.
Read morePasskeys vs Passwords: The Transition Nobody's Making
Passkeys are technically superior in every way — phishing-resistant, no shared secrets, biometric-friendly. Apple, Google, and Microsoft all support them. Adoption is still negligible.
Read moreSecurity Scores Are Meaningless
I build security scoring systems. I know better than anyone that they don't measure actual security. Here's why I keep building them anyway.
Read moreThe SPF 10-Lookup Limit: A 20-Year-Old Mistake
RFC 7208 limits SPF to 10 DNS lookups. Exceed it and your email authentication silently breaks. The limit made sense in 2003. It doesn't anymore.
Read moreThe TLS Handshake in 7 Steps
Every HTTPS connection starts with a negotiation most developers never think about. Here's exactly what happens in TLS 1.3, step by step.
Read moreTwo-Factor Authentication Doesn't Solve Phishing
2FA stops credential stuffing. It barely slows down the real-time phishing proxies that are actually stealing sessions in 2026.
Read moreWhat Happens When a Root CA Gets Compromised
In 2011, DigiNotar was hacked and 500+ fraudulent certificates were issued, including *.google.com. The aftermath reshaped the entire PKI ecosystem.
Read moreWhy Email Authentication Needs Five Protocols
SPF, DKIM, DMARC, BIMI, MTA-STS — email keeps stacking protocols on a 50-year-old system instead of replacing it. Here's why.
Read more"Zero Trust" Is a Marketing Term
Zero Trust started as a legitimate security architecture principle. It has been co-opted by every vendor to mean 'buy our product.' The original idea deserves better.
Read more