Notes on network protocols and security research.https://self-signed.pages.dev/https://self-signed.pages.dev/posts/quic-fingerprint-layers/https://self-signed.pages.dev/posts/quic-fingerprint-layers/The layers a passive observer can use to tell QUIC stacks apart, from datagram sizes to retransmission timing, and why copying a browser's ClientHello is only the start.Sun, 08 Nov 2026 08:27:19 GMThttps://self-signed.pages.dev/posts/sql-taint-token-confinement/https://self-signed.pages.dev/posts/sql-taint-token-confinement/Adding request-scoped taint tracking to an embedded scripting engine, and flagging injection by checking whether tainted bytes stay inside a single SQL token.Thu, 29 Oct 2026 03:31:14 GMThttps://self-signed.pages.dev/posts/quic-initial-is-not-encrypted/https://self-signed.pages.dev/posts/quic-initial-is-not-encrypted/Walking through RFC 9001's Initial packet protection by hand, and why any on-path observer can read your ClientHello.Fri, 16 Oct 2026 23:06:35 GMT