Essays

• 2026-08-02
  STARTTLS is a suggestion

  Mail between servers is encrypted only if nothing interferes, and an attacker counts as interference. What MTA-STS, DNSSEC and DANE actually promise, in the order they have to be deployed, with the failure modes met along the way.

• 2026-07-29
  p=none is not monitoring

  A DMARC record in monitoring mode with no rua tag is monitoring with nothing monitoring. What enforcement actually checks, what it breaks, and the hole it does not close.

• 2026-07-12
  This site

  Prerendered SolidStart in plain JavaScript, zero third-party requests, HTTP/3 from a Hetzner box. What that costs, what it buys, and what I would change.