1
The Wi-Fi only works when it's raining
The strangest hardware problem I've ever had to debug.
2
Engineering for Slow Internet
How to minimize user frustration in Antarctica.
3
Flightradar24's new GPS jamming map
Learn how to view areas of GPS jamming affecting aircraft around the world and how GPS jamming affects aviation.
4
Passkeys: A shattered dream
Firstyear's blog
5
PySkyWiFi: Free stupid wi-fi on long-haul flights
The plane reached 10,000ft. I took out my laptop, planning to peruse the internet and maybe do a little work if I got really desperate.
6
Hacking millions of modems and investigating who hacked my modem
Two years ago, something very strange happened to me while working from my home network. I was exploiting a blind XXE vulnerability that required an external HTTP server to smuggle out files, so I spun up an AWS box and ran a simple Python webserver to receive the traffic from the vulnerable server.
7
It's always TCP_NODELAY
The first thing I check when debugging latency issues in distributed systems is whether TCP_NODELAY is enabled. And it’s not just me. Every distributed system builder I know has lost hours to latency issues quickly fixed by enabling this simple socket option, suggesting that the default behavior is wrong, and perhaps…
8
DNS traffic can leak outside the VPN tunnel on Android
We were recently made aware of multiple potential DNS leaks on Android. They stem from bugs in Android itself, and only affect certain apps.
9
10
Is Tor still safe to use?
This blog post is a response to an investigative news report about a large-scale law-enforcement attack that managed to de-anonymize a user of an old version of the long-retired app Ricochet. This blog post aims to provide insight into what we know so far. Nothing that the Tor Project has learned about this incident…
11
API Shouldn't Redirect HTTP to HTTPS
Instead of redirecting API calls from HTTP to HTTPS, make the failure visible. Unfortunately, many well-known API providers don't currently do so.
12
Hacking Kia: Remotely controlling cars with just a license plate
On June 11th, 2024, we discovered a set of vulnerabilities in Kia vehicles that allowed remote control over key functions using only a license plate. These attacks could be executed remotely on any hardware-equipped vehicle in about 30 seconds, regardless of whether it had an active Kia Connect subscription.
13
14
Is Telegram really an encrypted messaging app?
This blog is reserved for more serious things, and ordinarily I wouldn’t spend time on questions like the above. But much as I’d like to spend my time writing about exciting topics, som…
15
What You Get After Running an SSH Honeypot for 30 Days
Discover what 11,599 SSH login attempts reveal after running a honeypot for 30 days. Learn key cybersecurity insights—read now to protect your systems!
16
.INTERNAL is now reserved for private-use applications
Whereas, on 1 March 2019, the Board took action on each of the 35 recommendations issued within the Competition, Consumer Trust, and Consumer Choice (CCT) Review Team Final Report dated 8 September 2018, as specified within the scorecard titled " Final CCT Recommendations: Board Action (1 March 2019) ". The Board…
17
Using Cloudflare on your website could be blocking RSS users
Cloudflare's security features could be blocking RSS feed users from accessing your website
18
iMessage with PQ3 Cryptographic Protocol
We are introducing PQ3, a groundbreaking cryptographic protocol for iMessage that advances the state of the art of end-to-end secure messaging. With compromise-resilient encryption and extensive defenses against even highly sophisticated quantum attacks, PQ3 provides protocol protections that surpass those in all…
19
How to get the whole planet to send abuse complaints to your best friends
It all begins with one scary email late at night just before I had to go to sleep:
20
Warning: DNS encryption in Little Snitch 6.1 may occasionally fail
UPDATE: Spoke too soon… The problem discussed here turned out to be specific to Little Snitch 6.1 and not a general issue in macOS. It has already been fixed in Little Snitch 6.1.1. See the end of the article for details. DNS Encryption 101 When…
21
22
WebSockets vs. Server-Sent-Events vs. Long-Polling vs. WebRTC vs. WebTransport
Learn the unique benefits and pitfalls of each real-time tech. Make informed decisions on WebSockets, SSE, Polling, WebRTC, and WebTransport.
23
The New Internet
Tailscale's CEO, Avery Pennarun, explores the future of the internet, discussing the evolution of networking, the issues with today's complex systems, and how Tailscale is simplifying connectivity for developers with a new, more efficient approach. Discover the vision for a New Internet.
24
JIT WireGuard
Our fancy WireGuard setup was accumulating stale peers. Here's what we did about it.
25
Maybe Bluesky has "won"
November has sucked so far. One upside of the terrible nonsense is that more people are fleeing X. Many are choosing Bluesky. I’ve seen a bunch of takes about this recently, but I keep seeing things I disagree with. I figure that’s a good enough excuse to write more about this weird-assed social network.
26
Zero-Click Calendar invite vulnerability chain in macOS
Critical zero-click vulnerability chain in macOS (patched)
27
Attackers can decloak routing-based VPNs
We discovered a fundamental design problem in VPNs and we're calling it TunnelVision. This problem lets someone see what you're doing online, even if you think you're safely using a VPN.
28
Stop Microsoft users sending 'reactions' to email by adding a postfix header
Over the past few months, I’ve noticed that an increasing number of replies to email that I’ve sent are “reactions”.
29
The FCC needs to stop 5G fast lanes
The FCC is set to vote on April 25 to restore its authority over the companies we pay to get online, and reinstate federal net neutrality protections that were jettisoned by the Trump administration in 2017. Net neutrality protections are supposed to ensure that we, not the internet service providers
30
HTTP: , FTP:, and Dict:?
I went for a spelunk through an ancient codebase a few weeks ago which contained a curious regex that I just couldn't grok. Copied to 📋⧉ {<((https?|ftp|dict|tel):[^\'">\s]+)>}i I'm familiar with HTTP and FTP. I worked in the mobile industry, so knew that tel:+44... could be used to launch a dialer. But DICT?!?!?! It…