Security Header Checklists Are Not Security
A site can pass every header scanner with a green A+ and still be trivially exploitable. The checklist grades the envelope, not the letter — and the gap is where the attacks live.
Blog
Protocols, security incidents, and how the internet actually works. 147 posts.
HTTPS Everywhere Won. That Was the Easy Part.
In September 2026, Chrome started warning on plain HTTP by default. A fifteen-year campaign finished — and it turns out we solved the tractable problem, not the hard one.
Email Is More Secure Than Slack
Everyone treats Slack as the modern, secure successor to email. But on Slack's top plans, an org owner can export every DM you ever sent — and, if retention is set to keep them, your edits and deletions too — and Slack holds the plaintext to do it. Email's transport is a 1982 disaster, and yet the thing it gives you that Slack structurally can't is the one that matters: custody. Here's the case for the medium nobody defends.
You Publish a Free npm Package. Does the Cyber Resilience Act Apply?
The EU's Cyber Resilience Act is in force, and its reporting rules have applied since September 2026. Whether it touches your open-source project comes down to two words - 'commercial activity' - and a brand-new legal role invented to keep maintainers out of the blast radius.
Log4Shell Fixed Our Paperwork, Not Our Dependencies
Four years after a patch shipped, Sonatype found roughly one in eight Log4j downloads was still a vulnerable version. We got very good at listing our broken dependencies and barely better at not shipping them.
WHOIS Privacy Is a Double-Edged Sword
GDPR redacted WHOIS for everyone in 2018 — grandma and the phishing operator got the same anonymity on the same day. The access system meant to balance it was estimated at $20–27M, then put on hold. Only one edge of the sword ever shipped.
Bug Bounties Created Perverse Incentives
A bug bounty pays per accepted report, so it optimizes for accepted reports — not for security. That gap was quietly draining maintainers for years before AI slop made it impossible to ignore.
DNS Is the Internet's Weakest Link
Whoever controls your DNS can get a valid TLS certificate for your domain, reroute your mail, and become you. It's the root of trust almost nobody signs.
The SSL Labs A+ Grade Is Too Easy to Get
An SSL Labs A+ certifies your TLS channel is configured well. People wave it around as proof they're secure. Under the current rules the gap between A- and A+ can be a single HTTP header — and a phishing kit clears it too.
Apple's Private Relay vs VPNs: Different Problems
People call iCloud Private Relay 'Apple's VPN.' Architecturally it's almost the opposite of one — and that difference is the whole point.
IPv6 Adoption Is Never Going to Happen (Fully)
In March 2026 IPv6 crossed 50% of Google's traffic for the first time. Everyone called it a milestone. It's actually the shape of a permanent stalemate.
Third-Party Cookies Didn't Die. They Moved Into DNS.
Google spent five years promising to kill third-party cookies, then quietly gave up. It barely mattered. Tracking had already escaped into the DNS layer — and it took your session cookies with it.