Protocols, security incidents, and how the internet actually works. 147 posts.
The difference between 301 and 302 isn't 'permanent vs temporary.' It's two unrelated decisions the codes quietly bundle together — and a 301 you set by accident can live in a stranger's browser cache forever.
Reverse DNS is the one record you can't set yourself, no RFC makes it mandatory, and your mail still gets rejected without it. Here's how a courtesy convention became a gatekeeper.
Adding your domain to the HSTS preload list is a one-way door. The list lives inside the browser binary, not on your servers, so undoing it means waiting months for a Chrome release you don't control — and that's the part nobody mentions when they tell you to preload.
Everyone agrees DANE is dead — a beautiful protocol stranded behind DNSSEC that nobody deployed. That verdict is American. In the Netherlands it's mandatory, Microsoft validates it in Exchange Online, and on the web it really is dead. Same protocol, three fates.
Most deployed CSPs do nothing. Google measured it: 94.7% of script-limiting policies are bypassable. The syntax is easy. The header is hard for a different reason.
SMTP encryption has a hole you can drive a truck through: any attacker in the path can strip STARTTLS and read the mail in cleartext. MTA-STS closes it. Then it makes you host a web page to do so, which is why almost nobody bothered.
In 1982 every mail server relayed for anyone — that was the design. Now relaying for a stranger gets you blocklisted before lunch. The word 'relay' survived. Everything underneath it inverted.
One private key on every server, covering every subdomain you'll ever name. Wildcard certificates trade a small convenience for a blast radius you can't see — and the current standard spells out the risk.
A wildcard DNS record reads like 'match everything below this name.' It doesn't. It never touches names that already exist — and it dies quietly the moment you add one record deep in the tree.
You add a DNS record and the world keeps saying it doesn't exist. Nothing is wrong with your record. DNS cached its absence — under a TTL you never set, governed by a field in the SOA that nobody touches.
How DNS rebinding crosses a hostname-based boundary, where browser and resolver defenses apply, and what internal service operators should verify.
The same IP address answers you in Seoul and someone else in São Paulo, from two different machines, and neither of you can tell. That's anycast — a lie told to BGP that the whole internet agreed to believe, and the trick that quietly made TCP work in hundreds of places at once.