Understanding HTTP State Management

HTTP state management is covered in RFC6265.  

Python's request module however refers to its predecessor RFC2965 within the class DefaultCookiePolicy in cookiejar.py. Some programmers say the implementation is quite strict.

One difference in the RFCs is the use of Augmented Backus-Naur form (ABNF) in the latter, not used in the former. ABNF for specifications is formalised in RFC5234 (an Internet standard, proposed to be augmented by RFC7405).

What is DNSSEC?

DNSSEC uses a cryptographic signature of DNS records to protect domains against forged DNS answers.

DNSSEC stands for Domain Name System Security Extensions, and comprises a suite of protocols to protect against DNS Spoofing, cache poisoning and man-in-the-middle attacks.

A scenario in layman's terms would be an attack that sends a user to a fake copy of your site. E-commerce and SaaS platforms in particular must take care to ensure they use DNSSEC for added protection.

DNSSEC can be skipped for very early stage projects where DNS server settings may change frequently.

Multi-signer DNSSEC is an additional way to implement DNNSEC. An RFC covers this (note that it is not an Internet Standard however), with contributors from Salesforce and Verisign.

The Weird World of OCSP Revocation Checks (Certificate Status)

OCSP, or Online Certificate Status Protocol, enables real-time verification (for clients like web browsers) of digital certificate validity (rather than use downloaded lists of revoked certificates, a la CRLs, or certificate revocation lists). 

It reduces overhead in validation (could be useful in real-time use cases e.g. transaction processing).

Statuses can be "good", "revoked" or "unknown".

Certificate Authorities (CAs) are mandated to track certificates they revoke.

Collaborative Email Authentication with DMARC

DMARC is an email authentication policy covered by RFC7489.

It stands for "Domain-based Message Authentication, Reporting and Conformance" and builds on SPF and DKIM protocols.  SPF and DKIM were invented for email authentication - the problem of validating whether this email that claims to come Jack really came from Jack. More details on why DKIM was needed and the threats it is intended to protect from are detailed in RFC4686. DKIM stands for DomainKeys Identified Mail.

DMARC improves on DKIM and other protocols in the way described emphasising collaboration between senders and receivers.

Some documents may describe DMARC as a replacement for ADSP. ADSP is an optional extension of DKIM and stands for Author Domain Signing Practices where a domain can publish the signing practices it utilizes when relaying mail on behalf of authors. It did not have much adoption.

Learning about .eml files

An .eml file is a plaintext version of an email which users can save to devices. 

These files can be sent and received via RFC822 compliant programs (RFC822 is formally the standard for ARPA Internet Text Messages). 

In Windows you can right-click on an .eml file and open it in Microsoft Word. 

Opening an .eml in Notepad you may see sections specifying DKIM-Signature designed to prevent email spoofing.