91
Email could have been X.400 times better
X.400 promised recallable, scheduled, self-destructing email. Why simple SMTP won instead, and what we lost and gained when it did.
92
Disrupting the largest residential proxy network
IPIDEA’s proxy infrastructure is a component of the digital ecosystem leveraged by a wide array of bad actors.
93
You can't trust the internet anymore
I like things that are strange and a bit obscure. It’s a habit of mine, and a lot of this blog is to document things I haven’t heard of before, because I wan...
94
Running My Own XMPP Server
Notes from setting up Prosody in Docker for federated messaging, with file sharing, voice calls, and end-to-end encryption.
95
So my ISP was hijacking my DNS
My ISP was tampering with my DNS queries and handing back bogus IP addresses. Here are the misconceptions about DoH, DoT and DNSSEC that followed, and the setup I actually run.
96
We intercepted the White House app's network traffic
We set up a MITM proxy and captured the decrypted HTTPS traffic from the official White House iOS app. On a single browsing session it contacts multiple Elfsight domains, sends your device fingerprint to OneSignal, and loads Google DoubleClick ad tracking. The privacy manifest says it collects nothing.
97
10Gb/s Ethernet: what I did to get it working in my home
I already had 2.5Gb/s working. Here's how I upgraded the whole house to 10Gb/s Ethernet -- including real iperf3 numbers, MikroTik switches, scary thermals, and what actually worked.
98
RPKI now protects 70% of internet routes
RPKI now protects 70% of Internet routes. See what drove the 2026 jump, how well it stops invalid routes, and where gaps remain.
99
Getting 25 Gbps Thunderbolt Ethernet on My Mac Studio
I've been using the built-in 10 Gigabit Ethernet on my Mac Studio for a few years. It works fine: I can edit 4K video straight off my NAS over the network, and run backups at around 1 GB/sec. But... I want more. I upgraded my rack and my NAS to 25 GbE a couple years ago, and wanted to upgrade my main workstation, too.
100
Internet centralization and the original sin of NAT
How NAT broke the concept of an internet connection
101
SecurityBaseline.eu
On May 13, 2026, the website SecurityBaseline.eu was launched. It is a spin-off from the Dutch “Basisbeveiliging”, which has monitored baseline security for over a decade and is part of governmental policy. Three months ago we sent tens of thousands of e-mails to European governments indicating the new site would…
102
What changes when you turn a Linux box into a router
I think it is incredibly cool that we can change a Linux system into a networking device. But have you ever wondered:
103
We have ipinfo at home or how to geolocate IPs in your CLI using latency
TLDR: I made a CLI tool that can resolve an IP address to a country, US state and even a city. https://github.com/jimaek/geolocation-tool It works well and confirms ipinfo's findings. Recently, I read how ipinfo finally proved what most technical people assumed: VPN providers don't actually maintain
104
Extremely Low Frequencies
The submarine is a surprisingly ancient technology—at least in its early, primitive forms. The idea is quite simple, that a well-enough-sealed boat ought to be able to submerge and resurface. It's the practicalities that make the whole thing difficult. It is generally considered that the US Civil War was the first use…
105
Plex vulnerabilities being exploited in the wild to drop a cryptominer
Intro: (No AI was involved in writing, research, etc...) If you see weird fonts and spacing, blame Blogger. Skip to "In the wild exploitati...
106
A most elegant TCP hole punching algorithm
The algorithm in this post needs “double buckets” to be reliable. Otherwise, the two sides can split on bucket boundaries and fail to converge. If the first bucket fails, compute an additional bucket step for convergence. My algorithm trades slow startup for less infrastructure.
107
The people holding up the internet
Four billion phones ask one text file what time it is, kept by a UCLA lecturer in his spare time. We counted who maintains the code under your phone.
108
Bluesky Protocol Services
A new home for the infrastructure Bluesky runs on the open network — including Jetstream v2 with network replay, a new Jetstream SDK, and a lex-based TypeScript SDK
109
Android NAT-T keepalive offload bypasses VPN lockdown
Technical report on Android VPN lockdown bypass via NAT-T keepalive offload.
110
Bad Connection: Global telecom exploitation by covert surveillance actors
Our investigation uncovers two sophisticated telecom surveillance campaigns and, for the first time, links real-world attack traffic to mobile operator signalling infrastructure. The findings expose how suspected commercial surveillance vendors (CSVs) exploit the global telecom interconnect ecosystem, leverage private…
111
SendGrid isn’t emailing about ICE or BLM – it’s a phishing attack
For the past several months, I’ve been receiving and then ignoring a steady stream of concerning emails from Sendgrid, the popular email delivery service owned by Twilio that I use for sendin…
112
Networking and the Internet, from First Principles
How electricity, light, and radio move data across independently operated networks.
113
Cloudflare OHTTP gateway
We’re announcing the closed beta of a self-serve Cloudflare OHTTP Gateway. We’re also renaming our Privacy Gateway to Cloudflare OHTTP Relay to better distinguish the two products.
114
Self-hosted HTTP tunnels with SSH and Nginx
No extra software to install: OpenSSH remote forwarding and nginx's secure_link module give you a shareable HTTPS URL with an expiring token.
115
Build your own Dial-up ISP with a Raspberry Pi
Last year my aunt let me add her original Tangerine iBook G3 clamshell to my collection of old Macs1. It came with an AirPort card—a $99 add-on Apple made that ushered in the Wi-Fi era. The iBook G3 was the first consumer laptop with built-in Wi-Fi antennas, and by far the cheapest way to get a computer onto an 802.11…
116
Running Your Own AS: BGP on FreeBSD with FRR, GRE Tunnels, and Policy Routing
How I obtained my own AS number and IPv6 prefix, set up a FreeBSD BGP router with FRR, and built a tunnel overlay to bring globally routable addresses to servers that already have provider-assigned...
117
TrustTunnel: AdGuard VPN protocol goes open-source
Today is a big day for us, and for everyone who cares about transparency, privacy, and having full control over their own traffic. We’re finally open-sourcing the protocol that powers AdGuard VPN. And it now has a name: TrustTunnel.
118
Bluesky Trademarks ATProto
Bluesky now owns the trademark for AT Protocol to shield the ecosystem and make sure it can be used as widely as possible.
119
DMARC has been public since 2012 but most company domains still don't enforce it
DMARC has been public since 2012. We checked 67,336 domains: 68.4% still have no policy or one that does not enforce it.
120
We halved DNS build delay and cut memory use by 85%
Zone setting changes used to rebuild entire DNS zones, even ones with tens of millions of records. Here is how we built a planner that picks the smallest safe build, cutting full builds by 40%, peak memory by 85%, and halving build delay.