Protocols, security incidents, and how the internet actually works. 147 posts.
On February 28, 2018, GitHub absorbed a 1.35 Tbps DDoS — the largest ever recorded at the time. No botnet built it. It was assembled from open memcached servers and a routing flaw the internet has refused to fix since 2000.
In September 1996 a SYN flood took a New York ISP offline. Within weeks, two people worked out a defense that stores no state at all — it hides the connection inside a number the attacker can't forge. Linux has shipped it switched on by default since 2009, and it's still a little bit lossy on purpose.
Before TLS encrypts anything, your client announces exactly what it is. The particular way it says hello is a fingerprint — and the story of JA3 and JA4 is the story of how identity leaks from the parts of a protocol nobody thought to hide.
The Slowloris attack is from 2009. It fits in one small script, needs one machine and no bandwidth, and will still stall a thread-per-connection server left without request timeouts. It wins by going slow — and the fix is the same one HTTP/2's record-breaking floods needed.
DNS has no memory — every answer overwrites the last. Passive DNS is the accidental surveillance database that remembers every answer the internet ever gave, going back years, without ever recording who asked.
In 2006 OpenSSH killed a remote-root hole in its signal handler. In late 2020 a logging rewrite quietly deleted the fix, and the same bug shipped to millions of servers for three years — because nothing tested that it stayed dead.
In 2008 a single researcher found a way to forge any domain on the internet in seconds. The fix wasn't a new protocol — it was 16 bits of randomness bolted onto a 25-year-old design, and we're still leaning on it.
In 2016 a botnet built from home cameras and DVRs knocked a chunk of the internet offline. It didn't exploit anything clever. It logged in with the factory password.
The most sophisticated supply-chain attack in years wasn't caught by a scanner, an SBOM, or a security team. It was caught by one engineer annoyed that his SSH logins felt half a second slow.
In April 2024 a researcher showed a single TCP connection could crash Apache, Node.js, and Tomcat with HTTP/2 frames that never appear in an access log. The bug was everywhere at once — because it lived in the spec's seams, not the code.
In December 2023 a researcher sent forged email from domains like microsoft.com that still passed SPF and DMARC. He didn't break the authentication. He made the receiving server read one message as two.
In August 2023 Google, Cloudflare, and AWS all logged record DDoS attacks, and Cloudflare's came from a botnet of only about 20,000 machines. The weapon wasn't bandwidth. It was an HTTP/2 feature working exactly as designed.