Happy Eyeballs: The Algorithm That Hides Broken IPv6
Dual-stack clients race IPv4 and IPv6 and use whichever answers first. RFC 8305 made connections feel instant — and made broken IPv6 invisible to the people running it.
Blog
Protocols, security incidents, and how the internet actually works. 147 posts.
Rate Limiting Is Not a Security Strategy
A well-built rate limiter still fails to stop the one attack everyone assumes it prevents. Rate limiting is an availability control wearing a security badge.
Cloudflare's Outages Keep Rhyming
Three Cloudflare outages — a 2019 regex, a 2025 third-party dependency, a 2025 feature file — turn out to be the same outage wearing different clothes: a change that shipped everywhere at once and met a bug with nowhere to hide.
BGP Hijacks: A History of the Same Mistake
From the 1997 AS7007 accident to the 2022 KLAYswap crypto heist, BGP hijacks keep exploiting the same missing feature: nobody has to prove they own a route. Here's the pattern, and why the fix stays optional.
The Economics of DDoS: Why It Costs $10 to Attack
A DDoS attack that knocks a small site offline for an afternoon costs about as much as a pizza. The interesting question isn't that it's cheap — it's who's actually paying, because it isn't the attacker.
Port Scanning in 2026: What You Can and Can't Learn
Port scanning is supposed to be step one of reconnaissance. In 2026 a full scan of a target mostly tells you it's behind a firewall and a load balancer. The map of the internet stopped being drawn by scanners.
Anycast: One IP, Many Servers
The same IP address answers you in Seoul and someone else in São Paulo, from two different machines, and neither of you can tell. That's anycast — a lie told to BGP that the whole internet agreed to believe, and the trick that quietly made TCP work in hundreds of places at once.