Archives
All the articles I've archived.
2026 3
November 1
A QUIC Client Fingerprint Is More Than Its ClientHello
The layers a passive observer can use to tell QUIC stacks apart, from datagram sizes to retransmission timing, and why copying a browser's ClientHello is only the start.
October 2
Tracking SQL Injection at Runtime, One Token at a Time
Adding request-scoped taint tracking to an embedded scripting engine, and flagging injection by checking whether tainted bytes stay inside a single SQL token.
The QUIC Initial Is Not Encrypted (For You)
Walking through RFC 9001's Initial packet protection by hand, and why any on-path observer can read your ClientHello.