How the Modern Web and HTTPS Emerged from Simple Two-Computer Networks
The article traces the evolution of internet infrastructure from two friends connecting PCs with twisted-pair cable and assigning IP addresses to the global system of DNS, routing, and public-key certificates.
It explains how early local networks expanded with switches, always-on servers, and domain names to solve the problem of changing IP addresses. As networks grew and interconnected through routers and ISPs, new risks of eavesdropping and traffic redirection appeared on open paths.
The solution introduced centralized certificate authorities such as the fictional Sectigo that issue chained certificates rooted in pre-installed trust stores.
The piece details the structure of certificates, key pairs, signing chains, and the browser validation process that enables encrypted HTTPS sessions.
Written in accessible language with deliberate simplifications, the text serves as an educational overview rather than a technical manual.
Related articles
Yandex Builds Secure KVM Access for BareMetal Servers with IPMI Proxy and Network Isolation
Yandex Cloud engineers developed a layered architecture to grant external users safe KVM access to dedicated BareMetal servers while protecting the shared IPMI network. The solution combines IPMI Proxy containers that normalize vendor-specific protocols into VNC, IPMI Router instances running jool for IPv6-to-IPv4 translation, and strict L2/L3 controls using 802.1X, eBPF, and switch ACLs. DHCP is delivered statelessly by deriving IPv4 addresses from MAC addresses to simplify failover with VRRP. Client-side risks from legacy Java and weak hashes are contained by running minimal containers and mounting ISO images from S3 as external volumes. Continuous permission checks every ten seconds ensure long-lived sessions do not become persistent attack paths. The resulting design unifies access across hardware platforms inside the Yandex Cloud console without exposing BMCs to lateral movement.
Russia Approves Dedicated Traffic Regulations for Delivery Robots
Russian authorities have coordinated requirements for the movement of delivery robots, known as rovers, across urban areas. The rules will establish permitted speeds, guidelines for interactions with pedestrians, identification procedures, and operator liability. The draft resolution was prepared by the Ministry of Economic Development together with the Ministry of Transport and the Ministry of Internal Affairs. An experimental legal regime lasting three years will test these measures in 35 regions of Russia. The core principle requires that robots must not obstruct people or create hazards on sidewalks. Specific zones where robots are permitted or prohibited will be defined in the final version of the document.
WebDesktopGL Framework Turns Web Sites into Desktop Apps on Astra Linux via Chromium
WebDesktopGL is an open-source framework that converts web applications into standalone desktop programs using a local Chromium engine. It was developed specifically for Astra Linux to meet strict licensing requirements that prohibit unlicensed software. The solution supports both X11 and Wayland sessions and has been tested on Ubuntu 24.04 KDE, Ubuntu 22.04 KDE, and Astra Linux 1.8. Key technical components include a modified VirtualGL build for GPU acceleration inside Xephyr or Xvfb virtual displays, custom clipboard synchronization via xclip, and a lightweight xdotool_xseticon utility for window management. Two launch scripts are provided: InfoDoc.sh for full isolation on a virtual X server and InfoDoc_light.sh for simpler direct execution suitable for remote deployment. The project aims to serve as a lightweight, license-compliant alternative to Electron for Linux environments.
DNS Resolver Operator Discovers Missing DNSSEC Validation After Six Months via External Test
A solo developer running VantageDNS, a recursive DNS resolver with filtering, discovered that DNSSEC validation had been disabled for six months after running an external DNS-OARC test. The test flagged "Lookup succeeded while signature was invalid," revealing that the resolver was accepting and returning responses with invalid DNSSEC signatures instead of returning SERVFAIL. Internal monitoring remained green throughout because the absence of validation does not trigger latency spikes, error rates, or availability alerts. The root cause traced back to a comment in the Unbound configuration left from an MVP phase that referenced enabling validation in Sprint 5, which never occurred. After enabling validation using a static trust-anchor-file, the operator documented the correct verification steps using dnssec-failed.org and domains with the AD flag, while noting that performance impact was negligible. The incident highlighted that security properties like DNSSEC validation require active, periodic external probing rather than passive monitoring.