The Polyfill Attack Was Just a Domain Sale
No server was breached. In February 2024 a company bought the polyfill.io domain, and four months later it was quietly serving malware to over 100,000 sites. The attack was the purchase.
Blog
Protocols, security incidents, and how the internet actually works. 147 posts.
Email Authentication Stopped Being Optional
For twenty years SPF, DKIM, and DMARC were advice you could ignore. Then in fourteen months Gmail, Yahoo, and Outlook made them the price of admission — without changing SMTP by a single byte.
DNSSEC Adoption Is a Map of Registry Discounts
Why do about 60% of .nl domains sign with DNSSEC and only about 4% of .com? Not the protocol. Follow the money: adoption tracks which registries pay registrars to sign.
The Internet Doesn't Route Around Damage Anymore
99% of the data between continents rides a few hundred undersea cables through a handful of chokepoints. When one is cut, there's no rerouting your way out — you wait for a ship.
security.txt: The Standard Nobody Reads
Four years after RFC 9116, roughly one in a hundred sites publishes a security.txt — and many of those files skip the mandatory expiry date or let it lapse. The standard didn't fail because it's bad. It failed because a text file can't manufacture the thing it's standing in for: a human who will read the report.
Port 25: The Day ISPs Gave Up on Email Federation
You cannot run a mail server from your home internet connection. The port SMTP was born on in 1982 is blocked on most consumer networks — and that quiet, entirely justified defense is also the thing that killed email as a peer-to-peer system.
ROBOT: The 19-Year-Old Attack That Came Back
In 1998 Bleichenbacher broke RSA in TLS. The fix was a fragile workaround — so in 2017 it broke again, on 27 of the top 100 domains.
The First Time the Root Key Changed
For eight years the security of signed DNS hung from a single key that had never once changed. When they finally rolled it in 2018, the terrifying part wasn't the cryptography — it was that nobody could see which resolvers were ready to follow.
The 1.35 Tbps Attack That Lasted Eight Minutes
On February 28, 2018, GitHub absorbed a 1.35 Tbps DDoS — the largest ever recorded at the time. No botnet built it. It was assembled from open memcached servers and a routing flaw the internet has refused to fix since 2000.
NAT: The Hack That Ate the Internet
In 1994 NAT was pitched as a short-term patch to buy time until IPv6 shipped. Thirty years later it's load-bearing infrastructure, it quietly deleted the internet's founding design principle, and by working too well it delayed its own replacement.
The Kaminsky Bug: When DNS Almost Broke
In 2008 a single researcher found a way to forge any domain on the internet in seconds. The fix wasn't a new protocol — it was 16 bits of randomness bolted onto a 25-year-old design, and we're still leaning on it.
Mirai: The Botnet Made of Cameras
In 2016 a botnet built from home cameras and DVRs knocked a chunk of the internet offline. It didn't exploit anything clever. It logged in with the factory password.