Protocols, security incidents, and how the internet actually works. 147 posts.
For a decade, every TLS certificate was published to live, append-only cryptographic databases that had to merge each entry within 24 hours and answer queries around the clock. By early 2026 Let's Encrypt had replaced its own with folders of static files in a bucket. It's a better design.
A CA doesn't usually die from a hack. Entrust died the modern way — from paperwork: late revocations, missed deadlines, and a browser root program that finally stopped believing the promises.
HTTP Public Key Pinning let any site pin its TLS keys in a header. It also let you permanently brick your own domain — or let an attacker hold it hostage. Browsers killed it.
Certificate validity, HSTS, DNSSEC signatures, TOTP codes — a surprising amount of your security is really an assertion about what time it is. And the protocol that decides what time it is spent forty years believing whoever answered first.
In 2023 Google's resolver quietly started asking for wIKiPEDiA.oRG instead of wikipedia.org. It's not a bug — it's a 15-year-old anti-spoofing hack that never became a standard, works anyway, and shipped because it needs permission from absolutely no one.
A decade ago DNS got a cheap defense against spoofed answers and reflection attacks. Your resolver almost certainly supports it. It almost certainly doesn't require it — and that gap between 'supports' and 'requires' is the whole story.
ACME orders, domain challenges and renewal: choosing a validation route and checking that an issued certificate reaches the server.
One crafted DNS packet could freeze a validating resolver for hours. KeyTrap wasn't a coding mistake — it was a requirement in the DNSSEC spec whose roots go back to 1999.
In April 2024 a researcher showed a single TCP connection could crash Apache, Node.js, and Tomcat with HTTP/2 frames that never appear in an access log. The bug was everywhere at once — because it lived in the spec's seams, not the code.
For years, an attacker who could bend a BGP route near a certificate authority could pass its domain validation and get a real, browser-trusted cert for a domain they didn't own. In 2025 the industry finally made that much harder. Here's how MPIC works and what it doesn't fix.
Every CDN wants you to point your root domain at a hostname. DNS has forbidden exactly that since 1987 — so the industry built a pile of non-standard hacks, and the one real fix still doesn't work in your browser.
Every DNS server between you and a site used to see the full name you typed — even the ones that only needed the TLD. One resolver-side change fixed most of that, and unlike DNSSEC, it shipped without asking anyone's permission.