Benchmark
Domain ranking list used as the seed set for subdomain enumeration in the exposure scan.
Just 474 of the 1,000 most popular websites set DMARC to reject spoofed mail, a dev.to survey of their DNS found. Thirty-two months after Google and Yahoo began requiring DMARC from bulk senders, 84.5% of the sites publish a record, but only 69.4% apply an enforcing policy to all their mail.
Reality
The "p99 0 ms" claim measures from key release rather than key press. That redefinition hands a solo founder on one European server the perceived speed an edge fleet would buy, as long as his users type fast and live nearby.
Reality
A practitioner who builds an automation browser argues bot detection fires in a fixed order, starting at the TLS handshake. The Bamberg crawl he cites found 75% of blocks on headless Chromium needed only HTTP headers.
Reality
A new arXiv paper describes two amplification attacks that turn a CDN's HTTP/3 front end into a pump aimed at HTTP/1.1 origins. Two CDN vendors have paid bounties and shipped the authors' mitigations.
Reality
Two disclosed DoS techniques turn HTTP/3-to-HTTP/1.1 conversion at six major CDNs into up to 350x load on the origin, with no configuration change by the customer.
Reality