DNS Flag Day: The Day the Internet Stopped Being Polite
On February 1, 2019, DNS resolvers agreed to stop working around broken servers. The workaround had been quietly running for two decades.
Blog
Protocols, security incidents, and how the internet actually works. 147 posts.
Heartbleed: The Leak That Left No Fingerprints
In 2014 a missing bounds check in OpenSSL let anyone ask a server for 64KB of its own memory — private keys, passwords, session cookies — and the request looked exactly like a normal heartbeat, so no server could tell whether it had been robbed.
The Internet Doesn't Route Around Damage Anymore
99% of the data between continents rides a few hundred undersea cables through a handful of chokepoints. When one is cut, there's no rerouting your way out — you wait for a ship.
security.txt: The Standard Nobody Reads
Four years after RFC 9116, roughly one in a hundred sites publishes a security.txt — and many of those files skip the mandatory expiry date or let it lapse. The standard didn't fail because it's bad. It failed because a text file can't manufacture the thing it's standing in for: a human who will read the report.
The Trailing Dot: Why example.com. Is the Real Name
The trailing dot is the most technically correct way to write a domain name — it spells out the DNS root. Every layer above DNS disagrees about what it means, and those disagreements keep turning into security bugs.
How National Firewalls Poison DNS
A national firewall doesn't block a censored DNS lookup — it answers it, with a forged reply that wins a race against the truth. Sometimes the lie points at a real company's server, and sometimes it leaks to people the censor never meant to reach.
Port 25: The Day ISPs Gave Up on Email Federation
You cannot run a mail server from your home internet connection. The port SMTP was born on in 1982 is blocked on most consumer networks — and that quiet, entirely justified defense is also the thing that killed email as a peer-to-peer system.
ROBOT: The 19-Year-Old Attack That Came Back
In 1998 Bleichenbacher broke RSA in TLS. The fix was a fragile workaround — so in 2017 it broke again, on 27 of the top 100 domains.
Path MTU Black Holes: The Bug That Only Hits Big Packets
The connection establishes. Small requests work. Then a large transfer stalls forever, and everyone blames the app. It's usually a router silently dropping oversized packets and an ICMP message a firewall ate — a failure mode baked so deep into the internet that 'the network works' and 'the network passes large packets' are two different claims.
How Video Calls Punch Through NAT
A machine behind NAT can't accept incoming connections — that's the whole definition of NAT. Yet video calls connect two such machines directly all the time. The trick is hole punching: both sides fire packets at the same instant, each drilling a temporary opening the other slips through. Here's the mechanism, why one NAT type defeats it, and the relay you pay rent on when it does.
The First Time the Root Key Changed
For eight years the security of signed DNS hung from a single key that had never once changed. When they finally rolled it in 2018, the terrifying part wasn't the cryptography — it was that nobody could see which resolvers were ready to follow.
Cloudbleed: When a Buffer Leaked Everyone's Secrets
In 2017 a single wrong comparison in a Cloudflare parser let a pointer run off the end of a buffer and dump adjacent memory into web pages — so one site's requests could surface another site's passwords, and search engines cached the spills.