OCSP Stapling vs CRL: Why OCSP Lost the Revocation Fight
When a certificate is compromised, it needs to be revoked. CRLs and OCSP both failed browsers in different ways, and in 2025 the industry quietly picked the one everyone had written off.
Blog
Protocols, security incidents, and how the internet actually works. 147 posts.
Post-Quantum Cryptography: What Needs to Change in TLS
Quantum computers will break RSA and elliptic curve crypto. The transition has already started — not because quantum computers are here, but because 'harvest now, decrypt later' is a real threat.
SNI: The Field That Leaks Your Destination
HTTPS encrypts everything — except which website you're visiting. The Server Name Indication field travels in plaintext before encryption starts.
TLS 1.0/1.1 in 2026: Who's Still Serving?
TLS 1.0 and 1.1 are formally deprecated and rejected by every browser. And yet servers still offer them. How many, and why?
VPNs Don't Make You Anonymous
A VPN shifts who can see your traffic from your ISP to the VPN provider. You're trusting a different entity, not eliminating trust.
We Stopped Teaching People How the Internet Works
Abstraction made the internet usable. It also made it opaque. The cost shows up in bad security decisions, helplessness during outages, and cargo-cult configuration.
What "End-to-End Encryption" Actually Means (and Doesn't)
Every messaging app claims E2EE. Most users think it means total privacy. The reality is more nuanced, and the marketing oversells it.
BGP: The Protocol That Runs on Trust
BGP routes the internet with no built-in authentication. Any autonomous system can announce any prefix. Route hijacking is trivially possible. Here's how it works and what RPKI is trying to fix.
Certificate Transparency: Why Every Cert Is Public
Every TLS certificate issued by a public CA is logged in a publicly searchable, append-only log. This happened because of DigiNotar. Here's how CT works and why it matters.
Compliance Is Not Security
SOC 2, ISO 27001, PCI DSS — organizations treat compliance as proof of security. It isn't. Compliance is a floor. Security is the actual state of your defenses.
DMARC Adoption: Still Decorative in 2026
More than half of the domains that 'have' DMARC don't enforce it — usually they sit at p=none, which means monitor but don't enforce. It's a smoke detector without a siren.
What Happens in the First 50 Milliseconds of a DNS Query
You type a URL and the page loads. In between, your computer may have talked to four servers, walked a hierarchy designed in 1983, and relied on caching so aggressive most queries never leave the first resolver.