Protocols, security incidents, and how the internet actually works. 147 posts.
GDPR redacted WHOIS for everyone in 2018 — grandma and the phishing operator got the same anonymity on the same day. The access system meant to balance it was estimated at $20–27M, then put on hold. Only one edge of the sword ever shipped.
Whoever controls your DNS can get a valid TLS certificate for your domain, reroute your mail, and become you. It's the root of trust almost nobody signs.
Google spent five years promising to kill third-party cookies, then quietly gave up. It barely mattered. Tracking had already escaped into the DNS layer — and it took your session cookies with it.
In 2016, attackers owned a Brazilian bank's entire online presence for five hours without touching one of its servers. They logged into its domain registrar.
WHOIS is a protocol from 1982 that returns unparseable text. RDAP fixed all of that in 2015. It took contracts — not better engineering — to move the industry: RDAP mandated in 2019, WHOIS sunset in 2025.
Reverse DNS is the one record you can't set yourself, no RFC makes it mandatory, and your mail still gets rejected without it. Here's how a courtesy convention became a gatekeeper.
A wildcard DNS record reads like 'match everything below this name.' It doesn't. It never touches names that already exist — and it dies quietly the moment you add one record deep in the tree.
You add a DNS record and the world keeps saying it doesn't exist. Nothing is wrong with your record. DNS cached its absence — under a TTL you never set, governed by a field in the SOA that nobody touches.
How DNS rebinding crosses a hostname-based boundary, where browser and resolver defenses apply, and what internal service operators should verify.
You set a TTL of 300 expecting changes in five minutes. Then traffic keeps hitting the old IP for an hour. TTL is not a schedule — it's a hint passed down a chain of caches that each reserve the right to ignore you.
In 2017 a researcher registered a domain that displayed as apple.com in three major browsers, served over valid HTTPS. Every character was Cyrillic. The reason it's hard to fix is older and stranger than the bug itself.
Everyone says there are 13 DNS root servers. There are about 2,000. The number 13 is frozen into the internet because of a packet-size limit nobody worries about anymore — and the way that contradiction got resolved is one of the better infrastructure hacks ever shipped.