Protocols, security incidents, and how the internet actually works. 147 posts.
In October 2021 Facebook didn't get hacked or DDoSed. It ran one maintenance command, and its own safety mechanisms erased it from the internet's map — then locked the engineers out of the room where the fix lived.
The most sophisticated supply-chain attack in years wasn't caught by a scanner, an SBOM, or a security team. It was caught by one engineer annoyed that his SSH logins felt half a second slow.
DNSSEC's proof that a name doesn't exist accidentally leaks the names that do. NSEC3 hashed them to stop zone walking — and offline cracking walked right through it. Here's why RFC 9276 tells you to set iterations to zero, and what actually works.
ICANN finally reserved .internal for private networks in July 2024. It kills the name-collision risk that haunted .corp and .home — but it's a reservation, not a special-use domain, so the query leaks are still your problem.
The logo in your inbox costs four figures a year — not because the protocol is expensive, but because two mailbox providers decided a certificate authority should stand between you and a picture.
For most of its life Chrome trusted whatever the OS trusted. In September 2022 it began to stop asking — and in November 2024 it dropped a CA that Windows still trusted.
Turning on Secure DNS in Chrome encrypts the pipe to your resolver. It does nothing to prove the answer coming back is true. Encryption and authentication are different problems, and browsers quietly picked one.
Publishing a DMARC record is the easy 5%. The advice skips the part that actually stops spoofing: alignment, reading the reports, and the slow walk to enforcement.
DNSSEC's real problem isn't cryptography. It's a two-party handshake between your DNS host and your registrar that almost nobody completes — and automation already fixes it.
Every public CA has been required by the CA/Browser Forum Baseline Requirements to honor CAA records since 2017. It's free, it's one line of DNS, and after nine years barely 15% of sites use it.
A site can pass every header scanner with a green A+ and still be trivially exploitable. The checklist grades the envelope, not the letter — and the gap is where the attacks live.
In September 2026, Chrome started warning on plain HTTP by default. A fifteen-year campaign finished — and it turns out we solved the tractable problem, not the hard one.