Let's Encrypt Turned Off OCSP. Nobody Noticed.
In August 2025 the largest CA on the internet shut down its OCSP responders. Almost nothing broke — because online certificate revocation checking was already theater.
Blog
Protocols, security incidents, and how the internet actually works. 147 posts.
SMTP Smuggling: Forged Email That Passed SPF and DMARC
In December 2023 a researcher sent forged email from domains like microsoft.com that still passed SPF and DMARC. He didn't break the authentication. He made the receiving server read one message as two.
Encrypted Client Hello Hides Less Than You Think
ECH finally encrypts the one field HTTPS always leaked — the site name. But your IP, your DNS lookup, and the size of the crowd you hide in decide whether it means anything.
HTTP/2 Server Push Is Dead. Early Hints Won by Doing Less
Server Push was HTTP/2's marquee feature: send files before the browser asks. Chrome ripped it out in 2022 after finding it used on 0.7% of sites and often making things slower. What replaced it did the opposite thing, and that's why it worked.
HTTP/2 Rapid Reset: How One Feature Broke the DDoS Record
In August 2023 Google, Cloudflare, and AWS all logged record DDoS attacks, and Cloudflare's came from a botnet of only about 20,000 machines. The weapon wasn't bandwidth. It was an HTTP/2 feature working exactly as designed.
Happy Eyeballs: The Algorithm That Hides Broken IPv6
Dual-stack clients race IPv4 and IPv6 and use whichever answers first. RFC 8305 made connections feel instant — and made broken IPv6 invisible to the people running it.
Chrome Encrypted Your DNS. It Never Checked It.
Turning on Secure DNS in Chrome encrypts the pipe to your resolver. It does nothing to prove the answer coming back is true. Encryption and authentication are different problems, and browsers quietly picked one.
"Just Add DMARC" Is Terrible Advice
Publishing a DMARC record is the easy 5%. The advice skips the part that actually stops spoofing: alignment, reading the reports, and the slow walk to enforcement.
GREASE: The TLS Values That Mean Nothing on Purpose
Your browser offers servers a cipher that isn't a cipher and an extension that does nothing, billions of times a day. It's called GREASE, and it's the only thing keeping TLS able to change.
We Moved TLS Setup into DNS, and DNS Isn't Signed
The HTTPS DNS record hands your browser connection parameters — which protocol, which IPs, even the key that encrypts your ClientHello — before the handshake starts. For most domains, it arrives over a layer nobody signed.
Every DNS Provider Should Turn On DNSSEC by Default
DNSSEC's real problem isn't cryptography. It's a two-party handshake between your DNS host and your registrar that almost nobody completes — and automation already fixes it.
CAA Records: The Certificate Restriction Nobody Sets
Every public CA has been required by the CA/Browser Forum Baseline Requirements to honor CAA records since 2017. It's free, it's one line of DNS, and after nine years barely 15% of sites use it.