HTTP

And the important thing about that architecture is that it does not assume whimsy gets to replace everything already on the internet, quite the opposite.

It builds on things we already have, things like URIs and TLS and HTTP and OAuth and X.509 certificates and so on.

And that's generally a good sign, right? Standards work tends to go better when the first instinct is not clearly what the internet needs is an entirely new identity universe.

So from that architecture, Whimsy starts answering some fairly fundamental questions.

Now, once you have an identifier and a credential, you need some way to use them when workloads communicate, and Wimsy is working on several approaches to this.

One uses something called mutual TLS, usually shortened to MTLS.

In ordinary TLS, which is what secures HTTPS connections, the client typically authenticates the server.

Huzzah! Mutual TLS has both sides authenticate so that two workloads can establish each other's identity as part of creating the connection.

So if I talk about open source project called FileCore, right it's a very mature product i would say and there are tons of commercial uh vendors as well out there right which are using vpf all the scene app players are technically using vpf as for workload protection right uh so essentially it acts as kind of a sim where it elects collects all the And it has all the matrices and data as what is happening within your system.

Process logs, network logs, the process tree, DS logs, HTTP, HTTPS, etc.

And then it tries to find a pattern.

So essentially what you do is write a rule.

And it has all the matrices and data as what is happening within your system.

Process logs, network logs, the process tree, DS logs, HTTP, HTTPS, etc.

And then it tries to find a pattern.

So essentially what you do is write a rule.

Vega Load is one small binary with no JVM or no runtime to install.

It supports 14 protocols, including HTTP, gRPC, WebSocket, Kafka, and a bunch more.

And you can set limits on P95 latency and error rate and broken limits, stop the pull request in CI or a rollout to your CD.

It also has God Reels, so your agent can test local hosts freely, but any other host needs your approval and every run is logged on your machine.

And I think the internet is going to have to come.

Everything that happens and every traffic will have to be stamped, right? Right now, there is a standard going called WebBotOut, right? WebBotOut and other standards in the same direction basically ask that every HTTP request at that level go sign, right? And that signator, the public key of the signator, is exposed somewhere in some URL, basically linking every HTTP request to a URL.

And in the URL, there is expected to be some form of identity.

This was sponsored mostly by Cloudflare.

So they need to identify good bots from bad bots.

But we're going to be in the same category.

And I think at some point, every HTTP request, every email, everything is going to be signed.

So you can classify that into the bad bot, good bot, or human.

Microsoft says request and automatic response decompression are off by default, and .NET Framework is not affected.

You're at risk if an application uses ASP.NET Core request decompression, HTTP client automatic response decompression, or the Brotli compression AP is, the way programs call it.

Fixed releases are 8.0.33, 9.0.22 and 10.0.14, with .NET 11 users moving to Release Candidate 3.

For Node.js, Imperva lists 22.23.4, 24.22.1 and 26.12.1.

In fact, uh, I do want to drop, uh, boost security made a tool called embarrass, uh, that makes it easy to test, uh, some of those components that are less obvious, like, uh, browsers and operating systems.

So like CICD tools, CLI tools that are downloading software and, and, and checking things, um, you know, that they're hopefully downloading software over HTTPS and not HTTP, uh, that, that will, uh, or basically trying to do exactly what you described, Sean, and we'll let you know if any of your tools fail the test.

Yeah, I

mean, the interesting thing is that these CAs are in our web browsers.

The spec says so in capital letters.

If you do it over HTTP, you should do it this way.

But nothing stops a remote MCP server from having no door at all, just a hallway.

Why is the intern different from every guest the hotel has ever had? There are three things to it.