Posts

All the articles I've posted.

• A QUIC Client Fingerprint Is More Than Its ClientHello

  8 Nov, 2026

  The layers a passive observer can use to tell QUIC stacks apart, from datagram sizes to retransmission timing, and why copying a browser's ClientHello is only the start.

• Tracking SQL Injection at Runtime, One Token at a Time

  29 Oct, 2026

  Adding request-scoped taint tracking to an embedded scripting engine, and flagging injection by checking whether tainted bytes stay inside a single SQL token.

• The QUIC Initial Is Not Encrypted (For You)

  16 Oct, 2026

  Walking through RFC 9001's Initial packet protection by hand, and why any on-path observer can read your ClientHello.