Insights

Our own forge

Our own forgeAugust 18, 2026

The validator that lies: an em dash versus our PGP signature

The reference security.txt validator accused our PGP block of being invalid. The real culprit: an em dash in a comment, and a library that decodes signed files as Latin-1. Lesson: validate with the validator's own tooling.

1 min read

Our own forgeJuly 22, 2026

How we reached 100% on internet.nl — and how to verify it yourself

Our site scores 100% on the public internet.nl test: IPv6, modern TLS, RPKI and a strict CSP without unsafe-inline on a static site. Here is the real journey — outage included — and the commands to verify every claim.

7 min read

Our own forgeJuly 22, 2026

Fishing for an IP address: getting RPKI when your prefix isn't signed

Our IPv4 address sat in one of the only two unsigned prefixes our cloud assigns to virtual machines in Zurich — and a ROA can only be signed by the hosting provider. Our solution: reserve addresses until one lands in a validated prefix. First cast, seven seconds of downtime.

2 min read

← All articles