Protocols, security incidents, and how the internet actually works. 147 posts.
In 2008 a single researcher found a way to forge any domain on the internet in seconds. The fix wasn't a new protocol — it was 16 bits of randomness bolted onto a 25-year-old design, and we're still leaning on it.
In 2016 a botnet built from home cameras and DVRs knocked a chunk of the internet offline. It didn't exploit anything clever. It logged in with the factory password.
In October 2021 Facebook didn't get hacked or DDoSed. It ran one maintenance command, and its own safety mechanisms erased it from the internet's map — then locked the engineers out of the room where the fix lived.
The most sophisticated supply-chain attack in years wasn't caught by a scanner, an SBOM, or a security team. It was caught by one engineer annoyed that his SSH logins felt half a second slow.
A great many domains end their SPF record with ~all, which tells receivers to accept mail that fails. It's the safe default that quietly guarantees SPF can't stop spoofing on its own.
In April 2025, phishing emails arrived from no-reply@google.com with a valid Google DKIM signature and a DMARC pass. Nothing was forged. That's the problem with DKIM.
DNSSEC's proof that a name doesn't exist accidentally leaks the names that do. NSEC3 hashed them to stop zone walking — and offline cracking walked right through it. Here's why RFC 9276 tells you to set iterations to zero, and what actually works.
ICANN finally reserved .internal for private networks in July 2024. It kills the name-collision risk that haunted .corp and .home — but it's a reservation, not a special-use domain, so the query leaks are still your problem.
The logo in your inbox costs four figures a year — not because the protocol is expensive, but because two mailbox providers decided a certificate authority should stand between you and a picture.
Nothing in DNS tells a browser where a registry stops and someone's website begins. So the entire web leans on a single hand-maintained text file to draw that line — for cookies, for certificates, for who can impersonate whom.
For most of its life Chrome trusted whatever the OS trusted. In September 2022 it began to stop asking — and in November 2024 it dropped a CA that Windows still trusted.
In 2020 Let's Encrypt faced revoking 3 million certificates with no way to tell their servers to renew. ACME Renewal Information — now RFC 9773 — hands the CA a dial on your schedule.