Rate Limiting Is Not a Security Strategy
A well-built rate limiter still fails to stop the one attack everyone assumes it prevents. Rate limiting is an availability control wearing a security badge.
Blog
Protocols, security incidents, and how the internet actually works. 147 posts.
Cloudflare's Outages Keep Rhyming
Three Cloudflare outages — a 2019 regex, a 2025 third-party dependency, a 2025 feature file — turn out to be the same outage wearing different clothes: a change that shipped everywhere at once and met a bug with nowhere to hide.
BGP Hijacks: A History of the Same Mistake
From the 1997 AS7007 accident to the 2022 KLAYswap crypto heist, BGP hijacks keep exploiting the same missing feature: nobody has to prove they own a route. Here's the pattern, and why the fix stays optional.
Why Registrars Keep Getting Hacked
In 2016, attackers owned a Brazilian bank's entire online presence for five hours without touching one of its servers. They logged into its domain registrar.
The .io TLD Has a Political Problem
Startups treat .io as shorthand for input/output. The two letters actually stand for a contested colonial territory that is now being handed away — and the domain rides on its existence.
NIST's New Password Rules Are Final. Almost Nobody Follows Them.
NIST finalized SP 800-63B-4 in 2025: no forced resets, no complexity rules, 15-character minimums, mandatory breach blocklists. Your IT department still makes you rotate P@ssw0rd1 every 90 days. The standard changed. Behavior didn't.
Email Is Unfixable
SMTP was designed in 1982 for a network where everyone trusted everyone. Every security property we've wanted since — knowing who sent a message, encrypting it in transit — has been bolted on as an optional patch on top of a protocol that can't be replaced. That's not a bug we haven't fixed yet. It's the shape of the thing.
The Economics of DDoS: Why It Costs $10 to Attack
A DDoS attack that knocks a small site offline for an afternoon costs about as much as a pizza. The interesting question isn't that it's cheap — it's who's actually paying, because it isn't the attacker.
Port Scanning in 2026: What You Can and Can't Learn
Port scanning is supposed to be step one of reconnaissance. In 2026 a full scan of a target mostly tells you it's behind a firewall and a load balancer. The map of the internet stopped being drawn by scanners.
Free SSL Certificates Made Phishing Easier
When HTTPS cost money, phishing sites mostly ran on plain HTTP. Free certificates didn't break TLS — they dissolved the one accidental signal users had been leaning on.
RDAP Is Replacing WHOIS (Slowly)
WHOIS is a protocol from 1982 that returns unparseable text. RDAP fixed all of that in 2015. It took contracts — not better engineering — to move the industry: RDAP mandated in 2019, WHOIS sunset in 2025.
Your TLS Certificates Already Got Shorter
Everyone panicked about the 47-day certificate landing in 2029. Nobody noticed the first cut already happened: 200 days, mandatory since March 2026. The real story isn't validity — it's the revalidation clock dropping to 10 days.