Josepollman·7h agoChrome Now Asks Before It Loads HTTP. I Checked the Redirects on My Own Sites.None of my seven sites will trigger the new prompt. Four of them still send a www visitor through two redirects, the chain my own speed…
Josepollman·2d agoDigiCert Moved an Internal Archive to a Reachable Network and Treated It as an Infrastructure ChangeDigiCert says archived customer data, including a few ID documents, was read 27 June to 2 July. No certificates were touched.
Josepollman·5d agoChrome Refused a Certificate From the Compromised eMudhra CA. Curl on the Same Machine Returned 200.Apple says Mac terminal tools ignore its eMudhra block. On my Linux machine, Chrome refused the bad certificate and curl returned 200.
Josepollman·Oct 28DreamHost Asked Customers to Check Their Mail Forwards. A New Password Doesn’t Remove One.The host hasn’t said why it expired some mail and SFTP passwords. Two lines in its notice still tell you what to check after any reset.A response icon1A response icon1
Josepollman·Oct 26Google’s Public DNS Says the Blocklist Test Address Doesn’t ExistEvery IPv4 blocklist has to list 127.0.0.2. This morning Google answered “no such name” for it on Spamhaus, Cloudflare answered with an…
Josepollman·Oct 23The EU Accessibility Law for Businesses Never Uses the Phrase “Accessibility Statement”My new accessibility pages got their first two search clicks from a query for the public-sector directive. Reading both laws side by side…
Josepollman·Oct 21The ConnectWise Backup Breach Needed No Customer PasswordA backup app’s own credential, held in the vendor’s tenant, was used to get tokens in customer Microsoft 365 tenants. I ran the vendor…
Josepollman·Oct 19Apple’s Servers Signed a Forged iCloud Address. My Header Analyzer Called It Good.A now-fixed iCloud bug let a logged-in user send as any @icloud.com address with SPF, DKIM and DMARC all passing. I pasted the researchers’…
Josepollman·Oct 16Meta’s New Business Terms Authorize Crawling for AI Training. They Never Mention Robots.txt.From 30 October, managing a Facebook Page means agreeing to a crawl clause. Checking my own robots.txt against it showed the file wasn’t…
Josepollman·Oct 14Brevo’s Attacker Didn’t Need to Forge a DNS Record. A Cloudflare Key Let Them Write One.For five and a half hours a fake verification page ran on Brevo’s own domains while its servers stayed untouched. Reading the post-mortem…
