Protocols, security incidents, and how the internet actually works. 147 posts.
To save a round trip, your browser lets a server recognize it on the next visit — at the TLS layer, below the cookie jar. For years that optimization was a supercookie, and the story of how it got fixed is a lesson in where identity really leaks.
No password was stolen and the registrar record never changed. Yet tens of thousands of domains were taken over — because they pointed their DNS at a provider that would hand the zone to anyone who asked.
No server was breached. In February 2024 a company bought the polyfill.io domain, and four months later it was quietly serving malware to over 100,000 sites. The attack was the purchase.
For twenty years SPF, DKIM, and DMARC were advice you could ignore. Then in fourteen months Gmail, Yahoo, and Outlook made them the price of admission — without changing SMTP by a single byte.
TLS 1.3 made almost everything safer. Then it added 0-RTT early data, which is replayable by design — and the standard way to make it 'safe' rests on a promise most apps break.
Plenty of HTTPS sites serve an incomplete certificate chain. They work in Chrome anyway — because Chrome quietly downloads the missing piece. Every client that doesn't is where the bug surfaces.
In 2024, DigiCert found an underscore missing from a validation step and had to revoke 83,000 certificates in 24 hours. One customer went to court to stop it. The real story isn't the typo.
Why do about 60% of .nl domains sign with DNSSEC and only about 4% of .com? Not the protocol. Follow the money: adoption tracks which registries pay registrars to sign.
To find example.com you have to ask its nameserver — which lives inside example.com. That's a circular dependency at the root of every domain, and the fix is a small, fragile hack called a glue record that most people never see until it breaks.
Firefox 137 turned on CRLite for every user: the whole web's certificate revocations, a few megabytes checked locally with no lookup. The trick that makes a probabilistic filter exact.
For nearly two years, every key generated with OpenSSL on Debian and Ubuntu could be picked from a list of 32,767 — because a cleanup meant to silence a memory-checker warning deleted the line that stirred in the randomness.
DNS makes you know a name before you can ask about it — you can't list a zone. Except there's one operation that lists the whole thing, AXFR, and when it's left open a stranger can ask a nameserver to mail them the phone book.