The .io TLD Has a Political Problem
Startups treat .io as shorthand for input/output. The two letters actually stand for a contested colonial territory that is now being handed away — and the domain rides on its existence.
Blog
Protocols, security incidents, and how the internet actually works. 147 posts.
NIST's New Password Rules Are Final. Almost Nobody Follows Them.
NIST finalized SP 800-63B-4 in 2025: no forced resets, no complexity rules, 15-character minimums, mandatory breach blocklists. Your IT department still makes you rotate P@ssw0rd1 every 90 days. The standard changed. Behavior didn't.
Email Is Unfixable
SMTP was designed in 1982 for a network where everyone trusted everyone. Every security property we've wanted since — knowing who sent a message, encrypting it in transit — has been bolted on as an optional patch on top of a protocol that can't be replaced. That's not a bug we haven't fixed yet. It's the shape of the thing.
The Economics of DDoS: Why It Costs $10 to Attack
A DDoS attack that knocks a small site offline for an afternoon costs about as much as a pizza. The interesting question isn't that it's cheap — it's who's actually paying, because it isn't the attacker.
Free SSL Certificates Made Phishing Easier
When HTTPS cost money, phishing sites mostly ran on plain HTTP. Free certificates didn't break TLS — they dissolved the one accidental signal users had been leaning on.
Wildcard Certificates Are a Security Antipattern
One private key on every server, covering every subdomain you'll ever name. Wildcard certificates trade a small convenience for a blast radius you can't see — and the current standard spells out the risk.
CDNs Are a Single Point of Failure
CDN consolidation means a single outage takes down thousands of sites. We traded distributed resilience for centralized convenience.
TLS 1.0/1.1 in 2026: Who's Still Serving?
TLS 1.0 and 1.1 are formally deprecated and rejected by every browser. And yet servers still offer them. How many, and why?
VPNs Don't Make You Anonymous
A VPN shifts who can see your traffic from your ISP to the VPN provider. You're trusting a different entity, not eliminating trust.
We Stopped Teaching People How the Internet Works
Abstraction made the internet usable. It also made it opaque. The cost shows up in bad security decisions, helplessness during outages, and cargo-cult configuration.
Compliance Is Not Security
SOC 2, ISO 27001, PCI DSS — organizations treat compliance as proof of security. It isn't. Compliance is a floor. Security is the actual state of your defenses.
DMARC Adoption: Still Decorative in 2026
More than half of the domains that 'have' DMARC don't enforce it — usually they sit at p=none, which means monitor but don't enforce. It's a smoke detector without a siren.