Networking

HTTP/3 in Practice: From SPDY to QUIC on My Home Router

I turned on HTTP/3 for a CloudFront distribution, saw the load times improve, and then did what I usually do when something works without me understanding why: I went looking for the packets. This post has three parts. First, how HTTP got here — because HTTP/3 makes very little sense without the twenty years of workarounds that preceded it. Second, the theory, kept short. Third, the practical part: enabling it on a CDN, then capturing real QUIC traffic on my OpenWrt router with tcpdump and reading what comes back.

Monday, July 27, 2026 | 12 minutes Read

Mutual TLS: What It Actually Proves

Every HTTPS connection you make proves something: that the server is who it claims to be. Almost none of them prove the reverse. The server has no idea who you are until you send it a password, a token, or a cookie — a secret that has to be created, stored, transmitted and rotated, and that anyone who steals it can replay. Mutual TLS moves that proof into the connection itself. Both sides present a certificate, both sides verify the other, and the caller’s identity is established before a single byte of your application protocol is exchanged.

Tuesday, June 9, 2026 | 16 minutes Read