Protocols, security incidents, and how the internet actually works. 147 posts.
Four years after a patch shipped, Sonatype found roughly one in eight Log4j downloads was still a vulnerable version. We got very good at listing our broken dependencies and barely better at not shipping them.
A bug bounty pays per accepted report, so it optimizes for accepted reports — not for security. That gap was quietly draining maintainers for years before AI slop made it impossible to ignore.
A DDoS attack that knocks a small site offline for an afternoon costs about as much as a pizza. The interesting question isn't that it's cheap — it's who's actually paying, because it isn't the attacker.
Port scanning is supposed to be step one of reconnaissance. In 2026 a full scan of a target mostly tells you it's behind a firewall and a load balancer. The map of the internet stopped being drawn by scanners.
How DNS rebinding crosses a hostname-based boundary, where browser and resolver defenses apply, and what internal service operators should verify.
In 2017 a researcher registered a domain that displayed as apple.com in three major browsers, served over valid HTTPS. Every character was Cyrillic. The reason it's hard to fix is older and stranger than the bug itself.
You can type any browser you like into your User-Agent string. It's the one field nobody trusts — because everything underneath it, the TLS handshake and the HTTP/2 settings, was written by your libraries, not by you.
Every messaging app claims E2EE. Most users think it means total privacy. The reality is more nuanced, and the marketing oversells it.
Model Context Protocol gives AI agents a standard way to call security tools. The recon workflow is about to change. The judgment part isn't.
Passkeys are technically superior in every way — phishing-resistant, no shared secrets, biometric-friendly. Apple, Google, and Microsoft all support them. Passwords are still the default almost everywhere.
I build security scoring systems. I know better than anyone that they don't measure actual security. Here's why I keep building them anyway.