Post-Quantum Certificates
A summary of post-quantum certificates and the TLS / web-PKI ecosystem as of June 2026.
Signs of Triviality
Opinions, mostly my own, on the importance of being and other things.
Latest posts
AI errno(2) values
errno(2) values for the AI age
Resetting Mutt's terminal after OAuth2 / GPG
A quick fix for how to get mutt's terminal reset after shelling out to GPG during the OAuth2 flow.
SSH Key Handling using the macOS keychain and 1Password
Just a few hints on client-side configuration options for handling SSH keys on macOS using the keychain and 1Password.
The End of the Open Web
Do you remember the Open Web? Web rings, directories, quirky resources out in the open, without the need to sign in anywhere. But I fear we're seeing the beginning of the end of this wonderful shared platform.
Sites using PQC (February 2026)
Another periodic check of which of the top 1M domains support post-quantum cryptography in their TLS key exchange.
IPv6 Adoption in 2026
IPv6 is over 30 years old now, so 2026 is definitely going to be the year where we see universal adoption. Uhuh, right.
Use of PQC in SMTP STARTTLS
A quick summary of which SMTP servers amongst the Top1M domains uses post-quantum cryptography for STARTTLS.
Can I use HTTPS RRs?
A quick summary of which browsers support RFC9460 HTTPS DNS records and to what extent as of December 2025.
Process Memory Sharing
A look at what parts of each others memory space threads and related processes can access.
Stacking Threads
An attempt to clarify my understanding of thread stacks in memory, particularly within the context of Address Space Layout Randomization (ASLR).
Sites using PQC (September 2025)
An updated check of which of the top 100K domains support post-quantum cryptography in their TLS key exchange.
vimrc: settings based on terminal background
How to set e.g., syntax highlighting colorschemes based on the current terminal's background.
Yes, it's a slow coup
In which I play Cassandra in the hopes of being wrong.
Post-Quantum Cryptography Proof of Concept Implementations
A few quic PQC TLS server implekentations to help you verify client and language capabilities.
July 4th, 2025
Patriotism? I have need for that hypothesis.
Bootstrapping HTTP/1.1, HTTP/2, and HTTP/3
How do we get from HTTP/1.1 all the way to 11... I mean, to HTTP/3? Let's look at the path browsers take.
Post-Quantum Cryptography on NetBSD
Quick instructions to set up Post-Quantum Cryptography (PQC) on NetBSD using Open Quantum Safe and BoringSSL.
How it's going...
When friends from outside the US ask you how it's going and you almost tell them.
Sites using PQC (March 2025)
A quick look to check which of the top 100K domains support post-quantum cryptography in their TLS key exchange.
Mood
One month in...
Post-Quantum Cryptography in February 2025
An updated summary of how the implementation of post-quantum cryptography has advanced in the industry in the last year.
Does the internet really need even more TLDs?
ICANN announced it is looking for applicants for new generic top-level domain names (gTLDs) - but do we really need more TLDs? Really?
2024-11-06
Post-election mood.
TLS 1.3 Hybrid Key Exchange using X25519Kyber768 / ML-KEM
A quick description of what a TLS 1.3 Hybrid Key Exchange using X25519Kyber768 / ML-KEM looks like in practice.
Installing NetBSD on Linode
Instructions on how to install NetBSD on a Linode instance. All steps are performed via the command-line and serial console.
Creating a NetBSD/amd64 AMI
Instructions for how to create a NetBSD/amd64 AMI from scratch.
Creating NetBSD EC2 AMIs
A short description of how to create a NetBSD AMI for Amazon AWS EC2 using the 'bsdec2-image-upload' tool.
Whose CIDR is it anyway?
A look at CIDR block ownership from a RIR-, country-, and organization level. Originally presented at RIPE88.
Email DNS Records Cheatsheet
A quick summary of the SMTP related DNS records together with brief examples.
Post-Quantum Cryptography in January 2024
It's 2024 - Do you know where your post-quantum cryptography is?
Use of HTTPS Resource Records
An analysis of over 225 million domain names to determine the current use of the new HTTPS DNS Resource Records.
TLD Domain Count Stats
I got tired of not finding a good source of domain name stats, so I put together counts of all TLDs by number of domain names in them myself.
The gTLDs' New Clothes
An analysis of A and AAAA records across all gTLDs' and several ccTLDs' naked domains.
Whose Cert Is It Anyway?
An analysis of the use of CAA records across all gTLDs and the Top 1M domains, providing insights into CA dominance on the internet.
Open sourcing code into a separate git repository
A quick description of how to add a second remote repository for the purposes of open sourcing local code.
Who reads your email?
A look at diversity of MX records across all gTLDs and the Top 1M domains, indicating where SMTP is concentrated and what organizations might have broad access to the world's emails.
AWS IAM and Cost Explorer CLI Setup
How to create an IAM admin user and configure another account to use Cost Explorer on the command-line.
Who controls the internet?
A look at diversity of authoritative NS records in gTLDs, as presented at the 5th ICANN DNS Symposium.
Time is an illusion, Unix time doubly so...
Unix counts time as seconds since the epoch. Seems straight forward. What could possibly go wrong?
The Sender Policy Framework (SPF)
A look at the Sender Policy Framework (SPF) and how it's more complex than you might think.
DNS Response Size
Everybody knows a DNS response needs to fit into a 512 byte UDP packet, right? But suppose it doesn't fit...
If Programming Languages Were Futurama Characters
Map your (least) favorite programming language to your favorite Planet Express crew member based on its characteristics.
Keeping Up To Date
A list of mailing lists and other channels I use to keep up to date on tech related matters.
Learning By Lurking
One of the best ways to broaden your understanding and deepen your knowledge is to surround yourself by smart people, sit back, and... listen. Behold, the power of learning by lurking!
Debugging Certificate Errors
It is a truth universally acknowledged, that any developer accessing a web service must be in want of using 'curl -k'. But why?
Basic Network Troubleshooting
A quick explanation of the differences between network failures most commonly observed in day to day operations. And no, it's not (always) DNS.
Infosec Skill Sets
Soft skills are hard, and everybody's career path different. Some skill sets tend to intersect, however. Here's my simplified breakdown using, what else, Venn diagrams.
WHOIS: Fragile, unparseable, obsolete... and universally relied upon
A rather unstructured look at one of the older and infuriatingly trivial internet protocols: WHOIS
strlcat(3) > strncat(3)
A quick look at a common mistake made when using strncat(3), and how strlcat(3) prevents a possible buffer overflow here.