Protocols, security incidents, and how the internet actually works. 147 posts.
In 2012 an espionage toolkit pushed itself onto machines as a signed Windows Update. To sign it, the operators forged a Microsoft certificate with an MD5 collision no academic had published yet — the last link in a chain of institutional mistakes that all had to line up.
In 2023 researchers showed they could silently delete a message from the start of an SSH session — and the cipher that made it cleanest was chacha20-poly1305, the one every hardening guide told you to prefer. The bug wasn't in any server. It was in the seam the protocol never checked.
In 2014 a Google team broke SSL 3.0 — a protocol from 1996 that nobody chose anymore. POODLE didn't attack the crypto in use. It attacked the polite reflex that let a browser fall back to crypto from eighteen years earlier.
On February 28, 2018, GitHub absorbed a 1.35 Tbps DDoS — the largest ever recorded at the time. No botnet built it. It was assembled from open memcached servers and a routing flaw the internet has refused to fix since 2000.
In September 1996 a SYN flood took a New York ISP offline. Within weeks, two people worked out a defense that stores no state at all — it hides the connection inside a number the attacker can't forge. Linux has shipped it switched on by default since 2009, and it's still a little bit lossy on purpose.
Before TLS encrypts anything, your client announces exactly what it is. The particular way it says hello is a fingerprint — and the story of JA3 and JA4 is the story of how identity leaks from the parts of a protocol nobody thought to hide.
The Slowloris attack is from 2009. It fits in one small script, needs one machine and no bandwidth, and will still stall a thread-per-connection server left without request timeouts. It wins by going slow — and the fix is the same one HTTP/2's record-breaking floods needed.
DNS has no memory — every answer overwrites the last. Passive DNS is the accidental surveillance database that remembers every answer the internet ever gave, going back years, without ever recording who asked.
In 1994 NAT was pitched as a short-term patch to buy time until IPv6 shipped. Thirty years later it's load-bearing infrastructure, it quietly deleted the internet's founding design principle, and by working too well it delayed its own replacement.
In 2006 OpenSSH killed a remote-root hole in its signal handler. In late 2020 a logging rewrite quietly deleted the fix, and the same bug shipped to millions of servers for three years — because nothing tested that it stayed dead.
In the 1990s the US government made companies ship deliberately breakable encryption abroad. The weak ciphers outlived the law by fifteen years — and in 2015, FREAK and Logjam switched them back on across a third of the web.
In 2017 Google and CWI published two different PDFs with the same SHA-1 hash. The interesting part isn't that they did it — it's that everyone saw it coming for twelve years and the industry still waited for the proof.