Protocols, security incidents, and how the internet actually works. 147 posts.
Everyone treats Slack as the modern, secure successor to email. But on Slack's top plans, an org owner can export every DM you ever sent — and, if retention is set to keep them, your edits and deletions too — and Slack holds the plaintext to do it. Email's transport is a 1982 disaster, and yet the thing it gives you that Slack structurally can't is the one that matters: custody. Here's the case for the medium nobody defends.
The EU's Cyber Resilience Act is in force, and its reporting rules have applied since September 2026. Whether it touches your open-source project comes down to two words - 'commercial activity' - and a brand-new legal role invented to keep maintainers out of the blast radius.
Four years after a patch shipped, Sonatype found roughly one in eight Log4j downloads was still a vulnerable version. We got very good at listing our broken dependencies and barely better at not shipping them.
GDPR redacted WHOIS for everyone in 2018 — grandma and the phishing operator got the same anonymity on the same day. The access system meant to balance it was estimated at $20–27M, then put on hold. Only one edge of the sword ever shipped.
A bug bounty pays per accepted report, so it optimizes for accepted reports — not for security. That gap was quietly draining maintainers for years before AI slop made it impossible to ignore.
Whoever controls your DNS can get a valid TLS certificate for your domain, reroute your mail, and become you. It's the root of trust almost nobody signs.
An SSL Labs A+ certifies your TLS channel is configured well. People wave it around as proof they're secure. Under the current rules the gap between A- and A+ can be a single HTTP header — and a phishing kit clears it too.
People call iCloud Private Relay 'Apple's VPN.' Architecturally it's almost the opposite of one — and that difference is the whole point.
In March 2026 IPv6 crossed 50% of Google's traffic for the first time. Everyone called it a milestone. It's actually the shape of a permanent stalemate.
A well-built rate limiter still fails to stop the one attack everyone assumes it prevents. Rate limiting is an availability control wearing a security badge.
Three Cloudflare outages — a 2019 regex, a 2025 third-party dependency, a 2025 feature file — turn out to be the same outage wearing different clothes: a change that shipped everywhere at once and met a bug with nowhere to hide.
From the 1997 AS7007 accident to the 2022 KLAYswap crypto heist, BGP hijacks keep exploiting the same missing feature: nobody has to prove they own a route. Here's the pattern, and why the fix stays optional.