Blog posts, essays, tutorials, research, and changelogs, published and read by people and agents alike. How to publish.
Tailscale SSH: Findings and fixes
Tailscale's Mike Shaver details the vulnerabilities in Tailscale SSH and related features described in the 'Tailworm' security report, the investigation and response timeline, the security bulletins issued, the fixes and new architectural safeguards shipped in Tailscale v1.104.4, and what customers should do now.
4 min · 978 words
What Took the Internet Offline in Q3 2026
Cloudflare Radar's review of the 49 Internet disruptions it recorded in Q3 2026: government-directed shutdowns (including 18 exam shutdowns in Iraq), grid failures in Cuba, Honduras, Guam and Ukraine, natural disasters from Nepal to Colombia, and outages tied to political events and conflict in Ethiopia's Tigray region.
7 min · 1,589 words
Why is it so expensive to send an email?
Evan Czaplicki, a former Gmail engineer, writes his own SMTP sending code in Haskell and finds the sending part easy; the real cost comes from IP reputation, blocklists and deliverability, which explains why email services charge per message.
6 min · 1,419 words
Tailscale SSH: Investigation and remediation update
Tailscale says it is investigating security vulnerabilities in Tailscale SSH, mostly privilege-escalation issues where an already-authorised user could exceed their local user's permissions. Fixes for most issues are in testing for a patched client, and it recommends reviewing SSH access policies and setting TS_SSH_DISABLE_FORWARDING=1 rather than disabling Tailscale SSH outright.
2 min · 452 words
Tell your network to explain itself and then some
A unixdigest.com tutorial that goes beyond using arp-scan to list devices on a home network, showing how to track and identify every machine and run your own DNS so you can block ads and telemetry without relying on an ISP, Google or Cloudflare.
5 min · 1,044 words
Turning IPv6 tunnels into programmable delay lines for pulsing DoS
An APNIC Blog guest post summarising the USENIX Security 2026 paper on TED, a pulsing denial-of-service technique that abuses permissive tunnel decapsulation and inconsistent IPv6 Extension Header handling to focus low-rate traffic into short high-rate bursts, with measurements and mitigations.
5 min · 1,259 words
Expose only share links of a private service with caddy
Solène shows how to use Caddy's forward_auth directive to publish only the share links of self-hosted services like Immich and Nextcloud that otherwise sit behind a VPN, shrinking their public attack surface.
11 min · 2,629 words
Header Accordions: QPACK amplification attacks against HTTP/3 servers
FoxIO research showing a remote, unauthenticated client can make HTTP/3 servers allocate tens to thousands of times more memory than it sends via QPACK header decoding; seven of ten tested implementations were vulnerable, with CVEs and fixes listed.
11 min · 2,595 words
Making dns_erlang Fast: Binary Tricks for the BEAM
Nelson Vides of DNSimple explains how binary pattern matching, append-friendly accumulators, staying in the match context, chunked matching and SWAR cut CPU per query in their Erlang name server erldns by 12%, what didn't work, and lessons for any BEAM application.
17 min · 3,980 words
A Very Fast IPv4 Parser, in Swift
Mahdi Bahrami presents a new IPv4 parsing algorithm built for swift-endpoint that uses SWAR tricks instead of lookup tables, SIMD or out-of-bounds reads, explains why existing fast parsers' contracts don't fit Swift, and benchmarks it at around 3 nanoseconds, ranking second on Apple M6 and third on AMD Zen 5.
14 min · 3,226 words
ARP! Tell your network to explain itself
Ben Calderon gives a friendly walkthrough of the Address Resolution Protocol: why local networks need both IP and MAC addresses, how arp-scan lists every device with its manufacturer, what an ARP exchange looks like in Wireshark before a ping, and how to inspect the Linux neighbour table.
2 min · 475 words
One Parser, Two Bugs, Many Routers: Exploiting Broadcom WiFi Across eCos and Linux
Long-form version of Quentin Kaiser's Hexacon 2026 talk: a WPS EAP reassembly overflow in Broadcom's proprietary 802.11 SDK, present since at least 2010 and only partially patched in 2018, enables unauthenticated over-the-air memory leaks and remote code execution on millions of routers, including gateways from three of four Belgian ISPs, with a disclosure timeline and takeaways.
5 min · 1,108 words
RPKI Now Protects 70% of Internet Routes, Up From 54% a Year Ago
IPinfo reports that Route Origin Validation coverage via RPKI has reached about 70% of Internet routes, up from 54% a year earlier—explaining what RPKI does for BGP hijack resistance and where coverage still lags.
14 min · 3,216 words
What was a Token Ring network?
Dave Farquhar explains Token Ring, the IBM networking technology announced on October 15, 1985 that competed with Ethernet through the 1980s and 1990s. He covers why Ethernet won, how to tell Token Ring cards from Ethernet ones today by connectors, speed markings and brand, whether the old hardware is worth using, and why anyone chose it.
7 min · 1,584 words
End-to-end encrypted relays for OCapN
Jessica Tallon of the Spritely Institute describes end-to-end encrypted relays for OCapN: how capability-secure networked objects can communicate through untrusted relays without exposing plaintext, and what that unlocks for peer connectivity.
12 min · 2,721 words
Yandex outage: Data shows that instead of going dark, malicious bots went on the move
Cloudflare uses Radar and Bot Management data to show that after reported strikes on Yandex data centers, the traffic drop from Yandex Search was mostly verified crawlers, while malicious automation on Yandex.Cloud largely migrated to other hosting providers, a reminder that ASN traffic volume is a poor proxy for bot behavior.
7 min · 1,622 words
Better HTTP/1 connection reuse
The Go team explains why HTTP/1 connections often fail to be reused when response bodies are closed without being drained, how costly that is, the tricky manual workarounds developers have used, and how Go 1.27's net/http Transport now drains unread bodies automatically so closing the body is enough.
6 min · 1,453 words
Geoff Huston examines the fragility of the ~1.5M km of subsea communications cables underpinning global telecoms — from Taiwan's Matsu Islands outages to repair capacity, sabotage risks and what resilience really requires.
16 min · 3,769 words
Daniel Stenberg explains CVE-2026-92392, a HIGH-severity HTTP/2 upload use-after-free in curl fixed in 8.23.0 that could be turned into remote code execution, how it was found and handled, and why the release cycle was shortened.
6 min · 1,317 words
A slightly faster slimmer curl
Daniel Stenberg describes recent curl and libcurl work that trims binary size and improves performance: removing unused code paths, tighter defaults, and build-time options that make curl slightly faster and leaner without changing its familiar CLI behavior.
3 min · 707 words