Worth adding for anyone in a jurisdiction with a data-protection law: your deletion and access requests have actual legal teeth in more places than people realise, and brokers have to respond. Even where there's no law, invoking the framework by name in your request tends to get a faster, less-ignored reply than a polite ask.

a video of the bug is the QA equivalent of a notarized affidavit, and I would bet money devs still ask if you cleared your cache

password managers are just outsourcing the confidence. I personally contain zero passwords now, only one enormous secret

'if the secure path is painful, users route around it' is a foundational idea in security design and it applies perfectly here. The most elegant threat model is worthless if it's so annoying you turn it off at the first inconvenience. Adoption is the metric, not theoretical strength.

coming back to add the corollary to 'threat model first': revisit it. mine changed when I moved and again when I changed jobs — the adversaries and the assets both shifted. a threat model is a living document, not a one-time ritual. re-read yours once a year and see if it still describes your actual life.

security person here, cackling respectfully. for what it's worth this is way more common than you'd think, and your fix took five minutes. most people never notice at all

update from this thread radicalizing me: went and labelled our load-bearing print statements. we have nine. one is in a language we no longer use anywhere else

Fair callout on the bypass. Some devices — a few streaming gadgets are notorious — ignore the DNS you hand out over DHCP and hardcode their own. If you want to actually enforce it you end up redirecting or blocking outbound DNS at the firewall so everything has to use your resolver. Worth knowing before you assume the sinkhole is catching everything.

my password manager having a password manager finally paid off. turns out the bit was preparation all along

the february 30th one haunts me, not because I know which date library it was, but because it could be all of them

Strong agree on the anti-theatre section. Fingerprinting resistance is real but it's an all-or-nothing property — a hardened browser that's simultaneously logged into your named account is defeating its own purpose. Pick the browser strategy that matches how you actually browse, then be consistent, rather than chasing a perfect score in a benchmark that doesn't reflect your usage.

one cart, many customers is simultaneously an incident report, a philosophy lecture, and a country song

DNS is the phone book of the internet, in the sense that it's ancient, everything depends on it, and nobody has verified it since 2014

100%. two hardware keys, not one — a primary and a backup registered to the same accounts, stored separately. the failure mode of 'I secured it so well I locked myself out forever' is real and it's demoralising enough to make people abandon the whole practice.

The 'unprofitable target' framing is exactly right and it's how security people actually think. You're not building an impenetrable fortress, you're raising the cost of attacking you above the value of the reward. The one thing I'll add: your threat model should include the mundane failure modes, not just the villains. Losing your phone, a laptop getting stolen, a random breach dumping your reused password. Full-disk encryption and a password manager quietly defend against the boring 90% while everyone's arguing about the exotic 10%.