Complete static archive of GigaTap articles about VPN, privacy, OPSEC, and security.
- Active Probing and Why a Server Must Stay Silent Consistently - Passive analysis only flags a suspicious address; then the censor connects itself. What gives away a server that simply does not answer, and why silence has to be consistent.
- Chains and Multihop: What They Give You and What They Cost - A second hop solves specific problems and creates new ones. What a chain actually buys, why a fallback path is not failover, and the trace multihop leaves in traffic.
- Choosing a Transport Family: Vulnerability Profiles, Not a Ranking - Transports cannot be ranked by strength — their vulnerability profiles differ in kind, not in degree. Four families across five axes, and the rule of diverse failure modes.
- Config Delivery: How a Broken Subscription Locks a User Out - The worst state a service can reach is one where restoring access requires the access you do not have. The circular trap, domain migration, and channel independence.
- DNS in Circumvention: The First Step and the First Leak - Name resolution happens before the connection and announces intent before protection starts. Three roles DNS plays, the silent fallback, and where to resolve names.
- ECH: What It Actually Solves, and What It Does Not - Encrypting the name in a TLS handshake closes one leak and leaves the rest untouched. What stays visible, why the anonymity set decides, and when it is a liability.
- Measuring Blocking Correctly - A probe must measure the quantity by which the network actually breaks. Four requirements: volume, seriality, failure classification and vantage point.
- Why Looking Random Is Not the Same as Looking Normal - A fully encrypted stream with no structure does not blend into traffic — it forms a class of its own. Why removing a signature does not deliver indistinguishability.
- Silent Failures That Look Like Blocking - Some failures happen with no error at all: the server drops the client silently, and from outside that is indistinguishable from blocking. A catalogue, and why to check it first.
- Three Axes of Traffic Shape: Why Two Mechanisms Demand Opposite Settings - One restriction demands splitting connections, another demands merging them. The contradiction dissolves once count, concurrency and volume become independent axes.
- TLS Fingerprints and the Post-Quantum Shift: How a Fake Browser Gives Itself Away - By late 2025 more than half of web traffic had gone post-quantum. A client claiming a modern browser without the matching key exchange gives itself away by that field.
- Upgrades as a Source of Failure: Why It Broke Right After the Update - An upgrade changes defaults, tightens checks and relocates parameters. Four mechanisms, each of which looks exactly like blocking, and the correct order of upgrading.
- Your VPN Check Says Timeout but the Connection Works — and Vice Versa - The built-in connection check in VPN clients measures the wrong quantity. That produces two symptoms: red-but-working, and the more dangerous green-but-broken.
- What Counts as Proof That It Works - Connected and works are different claims. The thresholds below which a check proves nothing, and the minimum set of conditions under which a result can be believed.
- Whitelists: What They Are, Why They Change, and What Splitting Them Means - A whitelist lists addresses, not services. That is why subnet neighbours inherit its protection — and why splitting those addresses into separate subnets changes so much.
- Why Blocking Hits One User and Not Another - The same config behaves differently for two people, and luck has nothing to do with it. Filtering is distributed and counts per sender-destination pair, not per service.
- NASA’s new telescope may help track asteroid threats - NASA’s Roman Space Telescope is built for astronomy, but researchers are exploring how its survey capabilities could support asteroid tracking and planetar
- AI Chip Race Is Becoming a Talent Battle - Samsung and SK Hynix’s chip talent fight shows that AI infrastructure depends on scarce engineering expertise, not only models.
- Tor Browser 15.0.19 Updates the Privacy Stack - Tor Browser 15.0.19 is a maintenance release with updated Firefox components, NoScript changes, and security fixes. Here is what users should check.
- AI agents can optimize the wrong goal - Reward hacking shows why AI agents need better evaluation, permissions, and monitoring before they enter operational workflows.
- OpenAI’s Hugging Face Incident Shows AI Control Gaps - The Hugging Face attack was not rogue AI. It exposed a familiar security problem: capable models can find paths around poorly defined boundaries.
- Rust Safety Needs Security Testing Beyond the Compiler - Trail of Bits’ new Rust testing handbook chapter shows where Rust guarantees end and where teams still need security testing, dependency checks, and review
- GitHub Cuts Common Paths in Supply Chain Attacks - GitHub added npm and GitHub Actions controls that target compromised accounts, unsafe workflows, credential theft, and unauthorized package publishing.
- AutoJack: when agent browsing turns localhost into RCE - AutoJack shows how AI agents that combine browsing and local tool access can be turned into a remote code execution path via localhost control planes.