PageSourceSearch

https://textslashplain.com/

html textslashplain.com collected 2026-09-24 08:47:06 UTC 219,189 bytes, 1,602 lines download raw bytes

1<!doctype html>
2<html lang="en-US">
3<head>
4	<meta charset="UTF-8" />
5	<meta name="viewport" content="width=device-width, initial-scale=1" />
6	<link rel="profile" href="https://gmpg.org/xfn/11" />
7	<title>text/plain &#8211; ericlaw talks about security, the web, and software in general</title>
8<meta name='robots' content='max-image-preview:large' />
9<!-- Jetpack Site Verification Tags -->
10<meta name="google-site-verification" content="FQ2m6-F6KlTeFSjsKwCccjZBjWTG1DhcwoATe-Vt8Tw">
11<link rel='dns-prefetch' href='//secure.gravatar.com' />
12<link rel='dns-prefetch' href='//fonts-api.wp.com' />
13<link rel='dns-prefetch' href='//widgets.wp.com' />
14<link rel='dns-prefetch' href='//jetpack.wordpress.com' />
15<link rel='dns-prefetch' href='//s0.wp.com' />
16<link rel='dns-prefetch' href='//public-api.wordpress.com' />
17<link rel='dns-prefetch' href='//0.gravatar.com' />
18<link rel='dns-prefetch' href='//1.gravatar.com' />
19<link rel='dns-prefetch' href='//2.gravatar.com' />
20<link rel='preconnect' href='//i0.wp.com' />
21<link rel='preconnect' href='//c0.wp.com' />
22<link rel="alternate" type="application/rss+xml" title="text/plain &raquo; Feed" href="https://textslashplain.com/feed/" />
23<link rel="alternate" type="application/rss+xml" title="text/plain &raquo; Comments Feed" href="https://textslashplain.com/comments/feed/" />
24<style id="wp-img-auto-sizes-contain-inline-css">
25img:is([sizes=auto i],[sizes^="auto," i]){contain-intrinsic-size:3000px 1500px}
26/*# sourceURL=wp-img-auto-sizes-contain-inline-css */
27</style>
28<style id="wp-emoji-styles-inline-css">
29
30	img.wp-smiley, img.emoji {
31		display: inline !important;
32		border: none !important;
33		box-shadow: none !important;
34		height: 1em !important;
35		width: 1em !important;
36		margin: 0 0.07em !important;
37		vertical-align: -0.1em !important;
38		background: none !important;
39		padding: 0 !important;
40	}
41/*# sourceURL=wp-emoji-styles-inline-css */
42</style>
43<style id="wp-block-library-inline-css">
44:root{--wp-block-synced-color:#7a00df;--wp-block-synced-color--rgb:122,0,223;--wp-bound-block-color:var(--wp-block-synced-color);--wp-editor-canvas-background:#ddd;--wp-admin-theme-color:#007cba;--wp-admin-theme-color--rgb:0,124,186;--wp-admin-theme-color-darker-10:#006ba1;--wp-admin-theme-color-darker-10--rgb:0,107,160.5;--wp-admin-theme-color-darker-20:#005a87;--wp-admin-theme-color-darker-20--rgb:0,90,135;--wp-admin-border-width-focus:2px}@media (min-resolution:192dpi){:root{--wp-admin-border-width-focus:1.5px}}.wp-element-button{cursor:pointer}:root .has-very-light-gray-background-color{background-color:#eee}:root .has-very-dark-gray-background-color{background-color:#313131}:root .has-very-light-gray-color{color:#eee}:root .has-very-dark-gray-color{color:#313131}:root .has-vivid-green-cyan-to-vivid-cyan-blue-gradient-background{background:linear-gradient(135deg,#00d084,#0693e3)}:root .has-purple-crush-gradient-background{background:linear-gradient(135deg,#34e2e4,#4721fb 50%,#ab1dfe)}:root .has-hazy-dawn-gradient-background{background:linear-gradient(135deg,#faaca8,#dad0ec)}:root .has-subdued-olive-gradient-background{background:linear-gradient(135deg,#fafae1,#67a671)}:root .has-atomic-cream-gradient-background{background:linear-gradient(135deg,#fdd79a,#004a59)}:root .has-nightshade-gradient-background{background:linear-gradient(135deg,#330968,#31cdcf)}:root .has-midnight-gradient-background{background:linear-gradient(135deg,#020381,#2874fc)}:root{--wp--preset--font-size--normal:16px;
44--wp--preset--font-size--huge:42px}.has-regular-font-size{font-size:1em}.has-larger-font-size{font-size:2.625em}.has-normal-font-size{font-size:var(--wp--preset--font-size--normal)}.has-huge-font-size{font-size:var(--wp--preset--font-size--huge)}:root .has-text-align-center{text-align:center}:root .has-text-align-left{text-align:left}:root .has-text-align-right{text-align:right}.has-fit-text{white-space:nowrap!important}#end-resizable-editor-section{display:none}.aligncenter{clear:both}.items-justified-left{justify-content:flex-start}.items-justified-center{justify-content:center}.items-justified-right{justify-content:flex-end}.items-justified-space-between{justify-content:space-between}.screen-reader-text{word-wrap:normal!important;border:0;clip-path:inset(50%);height:1px;margin:-1px;overflow:hidden;padding:0;position:absolute;width:1px;word-break:normal!important}.screen-reader-text:focus{background-color:#ddd;clip-path:none;color:#444;display:block;font-size:1em;height:auto;left:5px;line-height:normal;padding:15px 23px 14px;text-decoration:none;top:5px;width:auto;z-index:100000}html :where(.has-border-color){border-style:solid}html :where([style^=border-color],[style*=";border-color"],[style*="; border-color"]){border-style:solid}html :where([style^=border-top-color],[style*=";border-top-color"],[style*="; border-top-color"]){border-top-style:solid}html :where([style^=border-right-color],[style*=";border-right-color"],[style*="; border-right-color"]){border-right-style:solid}html :where([style^=border-bottom-color],[style*=";border-bottom-color"],[style*="; border-bottom-color"]){border-bottom-style:solid}html :where([style^=border-left-color],[style*=";border-left-color"],[style*="; border-left-color"]){border-left-style:solid}html :where([style^=border-width],[style*=";border-width"],[style*="; border-width"]){border-style:solid}html :where([style^=border-top-width],[style*=";border-top-width"],[style*="; border-top-width"]){border-top-style:solid}html :where([style^=border-right-width],[style*=";border-right-width"],[style*="; border-right-width"]){border-right-style:solid}html :where([style^=border-bottom-width],[style*=";border-bottom-width"],[style*="; border-bottom-width"]){border-bottom-style:solid}html :where([style^=border-left-width],[style*=";border-left-width"],[style*="; border-left-width"]){border-left-style:solid}html :where(img[class*=wp-image-]){height:auto;max-width:100%}:where(figure){margin:0 0 1em}html :where(.is-position-sticky){--wp-admin--admin-bar--position-offset:var(--wp-admin--admin-bar--height,0px)}@media screen and (max-width:600px){html :where(.is-position-sticky){--wp-admin--admin-bar--position-offset:0px}}
45
46/*# sourceURL=https://textslashplain.com/wp-content/plugins/gutenberg/build/styles/block-library/common.min.css */
47</style>
48<style id="wp-block-audio-inline-css">
49.wp-block-audio{box-sizing:border-box}.wp-block-audio :where(figcaption){margin-bottom:1em;margin-top:.5em}.wp-block-audio audio{min-width:300px;width:100%}
50/*# sourceURL=https://textslashplain.com/wp-content/plugins/gutenberg/build/styles/block-library/audio/style.min.css */
51</style>
52<style id="wp-block-audio-theme-inline-css">
53.wp-block-audio :where(figcaption){color:#555;font-size:13px;text-align:center}.is-dark-theme .wp-block-audio :where(figcaption){color:hsla(0,0%,100%,.65)}.wp-block-audio{margin:0 0 1em}
54/*# sourceURL=https://textslashplain.com/wp-content/plugins/gutenberg/build/styles/block-library/audio/theme.min.css */
55</style>
56<link rel='stylesheet' id='all-css-d373e116ff26052f6cc412cf36c8fc3e' href='https://textslashplain.com/wp-content/mu-plugins/wpcomsh/jetpack_vendor/automattic/jetpack-mu-wpcom/src/build/wpcom-blocks-code-style/wpcom-blocks-code-style.css?m=1790187559' type='text/css' media='all' />
57<style id="wp-block-quote-inline-css">
58.wp-block-quote{box-sizing:border-box;overflow-wrap:break-word}.wp-block-quote.is-large:where(:not(.is-style-plain)),.wp-block-quote.is-style-large:where(:not(.is-style-plain)){margin-bottom:1em;padding:0 1em}.wp-block-quote.is-large:where(:not(.is-style-plain)) p,.wp-block-quote.is-style-large:where(:not
58(.is-style-plain)) p{font-size:1.5em;font-style:italic;line-height:1.6}.wp-block-quote.is-large:where(:not(.is-style-plain)) cite,.wp-block-quote.is-large:where(:not(.is-style-plain)) footer,.wp-block-quote.is-style-large:where(:not(.is-style-plain)) cite,.wp-block-quote.is-style-large:where(:not(.is-style-plain)) footer{font-size:1.125em;text-align:right}.wp-block-quote>cite{display:block}
59/*# sourceURL=https://textslashplain.com/wp-content/plugins/gutenberg/build/styles/block-library/quote/style.min.css */
60</style>
61<style id="wp-block-quote-theme-inline-css">
62.wp-block-quote{border-left:.25em solid;margin:0 0 1.75em;padding-left:1em}.wp-block-quote cite,.wp-block-quote footer{color:currentColor;font-size:.8125em;font-style:normal;position:relative}.wp-block-quote:where(.has-text-align-right){border-left:none;border-right:.25em solid;padding-left:0;padding-right:1em}.wp-block-quote:where(.has-text-align-center){border:none;padding-left:0}.wp-block-quote.is-large,.wp-block-quote.is-style-large,.wp-block-quote:where(.is-style-plain){border:none}
63/*# sourceURL=https://textslashplain.com/wp-content/plugins/gutenberg/build/styles/block-library/quote/theme.min.css */
64</style>
65<style id="wp-block-heading-inline-css">
66h1:where(.wp-block-heading).has-background,h2:where(.wp-block-heading).has-background,h3:where(.wp-block-heading).has-background,h4:where(.wp-block-heading).has-background,h5:where(.wp-block-heading).has-background,h6:where(.wp-block-heading).has-background{padding:var(--wp--style--block-background-padding,1.25em 2.375em)}h1.has-text-align-left[style*=writing-mode]:where([style*=vertical-lr]),h1.has-text-align-right[style*=writing-mode]:where([style*=vertical-rl]),h2.has-text-align-left[style*=writing-mode]:where([style*=vertical-lr]),h2.has-text-align-right[style*=writing-mode]:where([style*=vertical-rl]),h3.has-text-align-left[style*=writing-mode]:where([style*=vertical-lr]),h3.has-text-align-right[style*=writing-mode]:where([style*=vertical-rl]),h4.has-text-align-left[style*=writing-mode]:where([style*=vertical-lr]),h4.has-text-align-right[style*=writing-mode]:where([style*=vertical-rl]),h5.has-text-align-left[style*=writing-mode]:where([style*=vertical-lr]),h5.has-text-align-right[style*=writing-mode]:where([style*=vertical-rl]),h6.has-text-align-left[style*=writing-mode]:where([style*=vertical-lr]),h6.has-text-align-right[style*=writing-mode]:where([style*=vertical-rl]){rotate:180deg}
67/*# sourceURL=https://textslashplain.com/wp-content/plugins/gutenberg/build/styles/block-library/heading/style.min.css */
68</style>
69<style id="wp-block-image-inline-css">
70.wp-block-image>a,.wp-block-image>figure>a{display:inline-block}.wp-block-image img{box-sizing:border-box;height:auto;max-width:100%;vertical-align:bottom}@media not (prefers-reduced-motion){.wp-block-image img.hide{visibility:hidden}.wp-block-image img.show{animation:show-content-image .4s}}.wp-block-image[style*=border-radius] img,.wp-block-image[style*=border-radius]>a{border-radius:inherit}.wp-block-image.has-custom-border img{box-sizing:border-box}.wp-block-image.aligncenter{text-align:center}.wp-block-image.alignfull>a,.wp-block-image.alignwide>a{width:100%}.wp-block-image.alignfull img,.wp-block-image.alignwide img{height:auto;width:100%}.wp-block-image .aligncenter,.wp-block-image .alignleft,.wp-block-image .alignright,.wp-block-image.aligncenter,.wp-block-image.alignleft,.wp-block-image.alignright{display:table}.wp-block-image .aligncenter>figcaption,.wp-block-image .alignleft>figcaption,.wp-block-image .alignright>figcaption,.wp-block-image.aligncenter>figcaption,.wp-block-image.alignleft>figcaption,.wp-block-image.alignright>figcaption{caption-side:bottom;display:table-caption}.wp-block-image .alignleft{float:left;margin:.5em 1em .5em 0}.wp-block-image .alignright{float:right;margin:.5em 0 .5em 1em}.wp-block-image .aligncenter{margin-left:auto;margin-right:auto}.wp-block-image :where(figcaption){margin-bottom:1em;margin-top:.5em}.wp-block-image.is-style-circle-mask img{border-radius:9999px}@supports ((-webkit-mask-image:none) or (mask-image:none)) or (-webkit-mask-image:none){.wp-block-image.is-style-circle-mask img{border-radius:0;-webkit-mask-image:url('data:image/svg+xml;utf8,<svg viewBox="0 0 100 100" xmlns="http://www.w3.org/2000/svg"><circle cx="50" cy="50" r="50"/></svg>');mask-image:url('data:image/svg+xml;utf8,<svg viewBox="0 0 100 100" xmlns="http://www.w3.org/2000/svg"><circle cx="50" cy="50" r="50"/></svg>');mask-mode:alpha;-webkit-mask-position:center;mask-position:center;-webkit-mask-repeat:no-repeat;mask-repeat:no-repeat;-webkit-mask-size:contain;mask-size:contain}}:root :where(.wp-block-image.is-style-rounded img,.wp-block-image .is-style-rounded img){border-radius:9999px}.wp-block-image figure{margin:0}.wp-lightbox-container{display:flex;flex-direction:column;position:relative}.wp-lightbox-container img{cursor:zoom-in}.wp-lightbox-container img:hover+button{opacity:1}.wp-lightbox-container button{align-items:center;backdrop-filter:blur(16px) saturate(180%);background-color:rgba(90,90,90,.25);border:none;border-radius:4px;cursor:zoom-in;display:flex;height:20px;justify-content:center;opacity:0;padding:0;position:absolute;right:16px;text-align:center;top:16px;width:20px;z-index:100}@media not (prefers-reduced-motion){.wp-lightbox-container button{transition:opacity .2s ease}}.wp-lightbox-container button:focus-visible{outline:3px auto rgba(90,90,90,.25);outline:3px auto -webkit-focus-ring-color;outline-offset:3px}.wp-lightbox-container button:hover{cursor:pointer;opacity:1}.wp-lightbox-container button:focus{opacity:1}.wp-lightbox-container button:focus,.wp-lightbox-container button:hover,.wp-lightbox-container button:not(:hover):not(:active):not(.has-background){background-color:rgba(90,90,90,.25);border:none}.wp-lightbox-overlay{box-sizing:border-box;
70cursor:zoom-out;height:100vh;left:0;overflow:hidden;position:fixed;top:0;visibility:hidden;width:100%;z-index:100000}.wp-lightbox-overlay .wp-lightbox-close-button{align-items:center;cursor:pointer;display:flex;font-family:inherit;gap:8px;justify-content:center;line-height:1;min-height:40px;min-width:40px;padding:0 4px;position:absolute;right:calc(env(safe-area-inset-right) + 16px);top:calc(env(safe-area-inset-top) + 16px);z-index:5000000}.wp-lightbox-overlay .wp-lightbox-close-button:focus,.wp-lightbox-overlay .wp-lightbox-close-button:hover,.wp-lightbox-overlay .wp-lightbox-close-button:not(:hover):not(:active):not(.has-background){background:none;border:none}.wp-lightbox-overlay .wp-lightbox-close-button:has(.wp-lightbox-close-text:not([hidden])) .wp-lightbox-close-icon svg{height:1em;width:1em}.wp-lightbox-overlay .wp-lightbox-close-icon svg{display:block}.wp-lightbox-overlay .wp-lightbox-navigation-button-next,.wp-lightbox-overlay .wp-lightbox-navigation-button-prev{align-items:center;bottom:16px;cursor:pointer;display:flex;font-family:inherit;gap:4px;justify-content:center;line-height:1;min-height:40px;min-width:40px;padding:0 8px;position:absolute;z-index:2000002}.wp-lightbox-overlay .wp-lightbox-navigation-button-next[hidden],.wp-lightbox-overlay .wp-lightbox-navigation-button-prev[hidden]{display:none}@media (min-width:960px){.wp-lightbox-overlay .wp-lightbox-navigation-button-next,.wp-lightbox-overlay .wp-lightbox-navigation-button-prev{bottom:50%;transform:translateY(-50%)}}.wp-lightbox-overlay .wp-lightbox-navigation-button-next:focus,.wp-lightbox-overlay .wp-lightbox-navigation-button-next:hover,.wp-lightbox-overlay .wp-lightbox-navigation-button-next:not(:hover):not(:active):not(.has-background),.wp-lightbox-overlay .wp-lightbox-navigation-button-prev:focus,.wp-lightbox-overlay .wp-lightbox-navigation-button-prev:hover,.wp-lightbox-overlay .wp-lightbox-navigation-button-prev:not(:hover):not(:active):not(.has-background){background:none;border:none;padding:0 8px}.wp-lightbox-overlay .wp-lightbox-navigation-button-next:has(.wp-lightbox-navigation-text:not([hidden])) .wp-lightbox-navigation-icon svg,.wp-lightbox-overlay .wp-lightbox-navigation-button-prev:has(.wp-lightbox-navigation-text:not([hidden])) .wp-lightbox-navigation-icon svg{display:block;height:1.5em;width:1.5em}.wp-lightbox-overlay .wp-lightbox-navigation-button-prev{left:calc(env(safe-area-inset-left) + 16px)}.wp-lightbox-overlay .wp-lightbox-navigation-button-next{right:calc(env(safe-area-inset-right) + 16px)}.wp-lightbox-overlay .wp-lightbox-navigation-icon svg{vertical-align:middle}.wp-lightbox-overlay .lightbox-image-container{height:var(--wp--lightbox-container-height);left:50%;overflow:hidden;position:absolute;top:50%;transform:translate(-50%,-50%);transform-origin:top left;width:var(--wp--lightbox-container-width);z-index:2000001}.wp-lightbox-overlay .wp-block-image{align-items:center;box-sizing:border-box;display:flex;height:100%;justify-content:center;margin:0;position:relative;transform-origin:0 0;width:100%;z-index:3000000}.wp-lightbox-overlay .wp-block-image img{height:var(--wp--lightbox-image-height);min-height:var(--wp--lightbox-image-height);min-width:var(--wp--lightbox-image-width);width:var(--wp--lightbox-image-width)}.wp-lightbox-overlay .wp-block-image figcaption{display:none}.wp-lightbox-overlay button{background:none;border:none}.wp-lightbox-overlay .scrim{background-color:#fff;height:100%;opacity:.9;position:absolute;width:100%;z-index:2000000}.wp-lightbox-overlay.active{visibility:visible}@media not (prefers-reduced-motion){.wp-lightbox-overlay.active{animation:turn-on-visibility .25s both}.wp-lightbox-overlay.active img{animation:turn-on-visibility .35s both}.wp-lightbox-overlay.show-closing-animation:not(.active){animation:turn-off-visibility .35s both}.wp-lightbox-overlay.show-closing-animation:not(.active) img{animation:turn-off-visibility .25s both}.wp-lightbox-overlay.zoom.active{animation:none;opacity:1;visibility:visible}.wp-lightbox-overlay.zoom.active .lightbox-image-container{animation:lightbox-zoom-in .4s}.wp-lightbox-overlay.zoom.active .lightbox-image-container img{animation:none}.wp-lightbox-overlay.zoom.active .scrim{animation:turn-on-visibility .4s forwards}.wp-lightbox-overlay.zoom.show-closing-animation:not(.active){animation:none}.wp-lightbox-overlay.zoom.show-closing-animation:not(.active) .lightbox-image-container{animation:lightbox-zoom-out .4s}.wp-lightbox-overlay.zoom.show-closing-animation:not(.active) .lightbox-image-container img{animation:none}.wp-lightbox-overlay.zoom.show-closing-animation:not(.active) .scrim{animation:turn-off-visibility .4s forwards}}
70@keyframes show-content-image{0%{visibility:hidden}99%{visibility:hidden}to{visibility:visible}}@keyframes turn-on-visibility{0%{opacity:0}to{opacity:1}}@keyframes turn-off-visibility{0%{opacity:1;visibility:visible}99%{opacity:0;visibility:visible}to{opacity:0;visibility:hidden}}@keyframes lightbox-zoom-in{0%{transform:translate(calc((-100vw + var(--wp--lightbox-scrollbar-width))/2 + var(--wp--lightbox-initial-left-position)),calc(-50vh + var(--wp--lightbox-initial-top-position))) scale(var(--wp--lightbox-scale))}to{transform:translate(-50%,-50%) scale(1)}}@keyframes lightbox-zoom-out{0%{transform:translate(-50%,-50%) scale(1);visibility:visible}99%{visibility:visible}to{transform:translate(calc((-100vw + var(--wp--lightbox-scrollbar-width))/2 + var(--wp--lightbox-initial-left-position)),calc(-50vh + var(--wp--lightbox-initial-top-position))) scale(var(--wp--lightbox-scale));visibility:hidden}}
71/*# sourceURL=https://textslashplain.com/wp-content/plugins/gutenberg/build/styles/block-library/image/style.min.css */
72</style>
73<style id="wp-block-image-theme-inline-css">
74:root :where(.wp-block-image figcaption){color:#555;font-size:13px;text-align:center}.is-dark-theme :root :where(.wp-block-image figcaption){color:hsla(0,0%,100%,.65)}.wp-block-image{margin:0 0 1em}
75/*# sourceURL=https://textslashplain.com/wp-content/plugins/gutenberg/build/styles/block-library/image/theme.min.css */
76</style>
77<style id="wp-block-list-inline-css">
78ol,ul{box-sizing:border-box}:root :where(.wp-block-list.has-background){padding:var(--wp--style--block-background-padding,1.25em 2.375em)}
79/*# sourceURL=https://textslashplain.com/wp-content/plugins/gutenberg/build/styles/block-library/list/style.min.css */
80</style>
81<style id="wp-block-paragraph-inline-css">
82.is-small-text{font-size:.875em}.is-regular-text{font-size:1em}.is-large-text{font-size:2.25em}.is-larger-text{font-size:3em}.has-drop-cap:not(:focus):first-letter{float:left;font-size:8.4em;font-style:normal;font-weight:100;line-height:.68;margin:.05em .1em 0 0;text-transform:uppercase}body.rtl .has-drop-cap:not(:focus):first-letter{float:none;margin-left:.1em}p.has-drop-cap.has-background{overflow:hidden}:root :where(p.has-background){padding:var(--wp--style--block-background-padding,1.25em 2.375em)}:where(p.has-text-color:not(.has-link-color)) a{color:inherit}p.has-text-align-left[style*="writing-mode:vertical-lr"],p.has-text-align-right[style*="writing-mode:vertical-rl"]{rotate:180deg}
83/*# sourceURL=https://textslashplain.com/wp-content/plugins/gutenberg/build/styles/block-library/paragraph/style.min.css */
84</style>
85<style id="wp-block-library-inline-css-extra">
86.has-text-align-justify{text-align:justify;}
87/*# sourceURL=wp-block-library-inline-css */
88</style>
89
90<style id="classic-theme-styles-inline-css">
91.wp-block-button__link{background-color:#32373c;border-radius:9999px;box-shadow:none;color:#fff;font-size:1.125em;padding:calc(.667em + 2px) calc(1.333em + 2px);text-decoration:none}.wp-block-file__button{background:#32373c;color:#fff}.wp-block-accordion-heading{margin:0}.wp-block-accordion-heading__toggle{background-color:inherit!important;color:inherit!important}.wp-block-accordion-heading__toggle:not(:focus-visible){outline:none}.wp-block-accordion-heading__toggle:focus,.wp-block-accordion-heading__toggle:hover{background-color:inherit!important;border:none;box-shadow:none;color:inherit;padding:var(--wp--preset--spacing--20,1em) 0;text-decoration:none}.wp-block-accordion-heading__toggle:focus-visible{outline:auto;outline-offset:0}.wp-block-tab:not(.has-text-color){color:inherit!important}.wp-block-tab:not(.has-background){background-color:inherit!important}.wp-block-tab:focus,.wp-block-tab:hover{text-decoration:none}.wp-block-tab:focus-visible{outline:auto;outline-offset:0}
92/*# sourceURL=https://textslashplain.com/wp-content/plugins/gutenberg/build/styles/block-library/classic.min.css */
93</style>
94
95<link rel='stylesheet' id='all-css-fa5ea71b5c6a215968743319f2ee1bb5' href='https://textslashplain.com/_static/??-eJydyzEOwjAMQNELEUwrFCbEWdzEai1SJ4rdptyeMjAy0PXrv1ZcyGIkBiUtI4tCyEPK4akQWQ3UXonctzna9lc5i56D6qn9yVF4Rtv5Lz1WXNGwOpIJJVCEYeEUoaAZVVGnE1aKhzlFtsN4ZWof/Jjv3e168b7zff8G/i560g==' type='text/css' media='all' />
96<style id="global-styles-inline-css">
97:root{--wp--preset--aspect-ratio--square: 1;--wp--preset--aspect-ratio--4-3: 4/3;--wp--preset--aspect-ratio--3-4: 3/4;--wp--preset--aspect-ratio--3-2: 3/2;--wp--preset--aspect-ratio--2-3: 2/3;--wp--preset--aspect-ratio--16-9: 16/9;--wp--preset--aspect-ratio--9-16: 9/16;--wp--preset--color--black: #000000;--wp--preset--color--cyan-bluish-gray: #abb8c3;--wp--preset--color--white: #ffffff;--wp--preset--color--pale-pink: #f78da7;--wp--preset--color--vivid-red: #cf2e2e;--wp--preset--color--luminous-vivid-orange: #ff6900;--wp--preset--color--luminous-vivid-amber: #fcb900;--wp--preset--color--light-green-cyan: #7bdcb5;--wp--preset--color--vivid-green-cyan: #00d084;--wp--preset--color--pale-cyan-blue: #8ed1fc;--wp--preset--color--vivid-cyan-blue: #0693e3;--wp--preset--color--vivid-purple: #9b51e0;--wp--preset--color--primary: #CD2220;--wp--preset--color--secondary: #007AB7;--wp--preset--color--foreground: #303030;--wp--preset--color--background: #FFFFFF;--wp--preset--gradient--vivid-cyan-blue-to-vivid-purple: linear-gradient(135deg,rgb(6,147,227) 0%,rgb(155,81,224) 100%);--wp--preset--gradient--light-green-cyan-to-vivid-green-cyan: linear-gradient(135deg,rgb(122,220,180) 0%,rgb(0,208,130) 100%);--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange: linear-gradient(135deg,rgb(252,185,
970) 0%,rgb(255,105,0) 100%);--wp--preset--gradient--luminous-vivid-orange-to-vivid-red: linear-gradient(135deg,rgb(255,105,0) 0%,rgb(207,46,46) 100%);--wp--preset--gradient--very-light-gray-to-cyan-bluish-gray: linear-gradient(135deg,rgb(238,238,238) 0%,rgb(169,184,195) 100%);--wp--preset--gradient--cool-to-warm-spectrum: linear-gradient(135deg,rgb(74,234,220) 0%,rgb(151,120,209) 20%,rgb(207,42,186) 40%,rgb(238,44,130) 60%,rgb(251,105,98) 80%,rgb(254,248,76) 100%);--wp--preset--gradient--blush-light-purple: linear-gradient(135deg,rgb(255,206,236) 0%,rgb(152,150,240) 100%);--wp--preset--gradient--blush-bordeaux: linear-gradient(135deg,rgb(254,205,165) 0%,rgb(254,45,45) 50%,rgb(107,0,62) 100%);--wp--preset--gradient--luminous-dusk: linear-gradient(135deg,rgb(255,203,112) 0%,rgb(199,81,192) 50%,rgb(65,88,208) 100%);--wp--preset--gradient--pale-ocean: linear-gradient(135deg,rgb(255,245,203) 0%,rgb(182,227,212) 50%,rgb(51,167,181) 100%);--wp--preset--gradient--electric-grass: linear-gradient(135deg,rgb(202,248,128) 0%,rgb(113,206,126) 100%);--wp--preset--gradient--midnight: linear-gradient(135deg,rgb(2,3,129) 0%,rgb(40,116,252) 100%);--wp--preset--font-size--small: 16.6px;--wp--preset--font-size--medium: 20px;--wp--preset--font-size--large: 26.45px;--wp--preset--font-size--x-large: 42px;--wp--preset--font-size--normal: 20px;--wp--preset--font-size--huge: 30.4174px;--wp--preset--spacing--20: 0.44rem;--wp--preset--spacing--30: 0.67rem;--wp--preset--spacing--40: 1rem;--wp--preset--spacing--50: 1.5rem;--wp--preset--spacing--60: 2.25rem;--wp--preset--spacing--70: 3.38rem;--wp--preset--spacing--80: 5.06rem;--wp--preset--shadow--natural: 6px 6px 9px rgba(0, 0, 0, 0.2);--wp--preset--shadow--deep: 12px 12px 50px rgba(0, 0, 0, 0.4);--wp--preset--shadow--sharp: 6px 6px 0px rgba(0, 0, 0, 0.2);--wp--preset--shadow--outlined: 6px 6px 0px -3px rgb(255, 255, 255), 6px 6px rgb(0, 0, 0);--wp--preset--shadow--crisp: 6px 6px 0px rgb(0, 0, 0);}.wp-block-button{--wp--preset--dimension--25: 25%;--wp--preset--dimension--50: 50%;--wp--preset--dimension--75: 75%;--wp--preset--dimension--100: 100%;}:where(body) { margin: 0; }:where(.wp-site-blocks) > * { margin-block-start: 24px; margin-block-end: 0; }:where(.wp-site-blocks) > :first-child { margin-block-start: 0; }:where(.wp-site-blocks) > :last-child { margin-block-end: 0; }:root { --wp--style--block-gap: 24px; }:root :where(.is-layout-flow) > :first-child{margin-block-start: 0;}:root :where(.is-layout-flow) > :last-child{margin-block-end: 0;}:root :where(.is-layout-flow) > *{margin-block-start: 24px;margin-block-end: 0;}:root :where(.is-layout-constrained) > :first-child{margin-block-start: 0;}:root :where(.is-layout-constrained) > :last-child{margin-block-end: 0;}:root :where(.is-layout-constrained) > *{margin-block-start: 24px;margin-block-end: 0;}:root :where(.is-layout-flex){gap: 24px;}:root :where(.is-layout-grid){gap: 24px;}body .is-layout-flex{display: flex;}.is-layout-flex{flex-wrap: wrap;align-items: center;}.is-layout-flex > :is(*, div){margin: 0;}body .is-layout-grid{display: grid;}.is-layout-grid > :is(*, div){margin: 0;}body{padding-top: 0px;padding-right: 0px;padding-bottom: 0px;padding-left: 0px;}:root :where(.wp-element-button, .wp-block-button__link){background-color: #32373c;border-width: 0;color: #fff;font-family: inherit;font-size: inherit;font-style: inherit;font-weight: inherit;letter-spacing: inherit;line-height: inherit;padding-top: calc(0.667em + 2px);padding-right: calc(1.333em + 2px);padding-bottom: calc(0.667em + 2px);padding-left: calc(1.333em + 2px);text-decoration: none;text-transform: inherit;}.has-black-color{color: var(--wp--preset--color--black) !important;}.has-cyan-bluish-gray-color{color: var(--wp--preset--color--cyan-bluish-gray) !important;}.has-white-color{color: var(--wp--preset--color--white) !important;}.has-pale-pink-color{color: var(--wp--preset--color--pale-pink) !important;}.has-vivid-red-color{color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-color{color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-color{color: var(--wp--preset--color--luminous-vivid-amber) !important;}.has-light-green-cyan-color{color: var(--wp--preset--color--light-green-cyan) !important;}.has-vivid-green-cyan-color{color: var(--wp--preset--color--vivid-green-cyan) !important;}.has-pale-cyan-blue-color{color: var(--wp--preset--color--pale-cyan-blue) !important;}.has-vivid-cyan-blue-color{color: var(--wp--preset--color--vivid-cyan-blue) !important;}.has-vivid-purple-color{color: var(--wp--preset--color--vivid-purple) !important;}.has-primary-color{color: var(--wp--preset--color--primary) !important;}.has-secondary-color{color: var(--wp--preset--color--secondary) !important;}.has-foreground-color{color: var(--wp--preset--color--foreground) !important;}.has-background-color{color: var(--wp--preset--color--background) !important;}.has-black-background-color{background-color: var(--wp--preset--color--black) !important;}.has-cyan-bluish-gray-background-color{background-color: var(--wp--preset--color--cyan-bluish-gray) !important;}.has-white-background-color{background-color: var(--wp--preset--color--white) !important;}.has-pale-pink-background-color{background-color: var(--wp--preset--color--pale-pink) !important;}.has-vivid-red-background-color{background-color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-background-color{background-color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-background-color{background-color: var(--wp--preset--color--luminous-vivid-amber) !important;}.has-light-green-cyan-background-color{background-color: var(--wp--preset--color--light-green-cyan) !important;}.has-vivid-green-cyan-background-color{background-color: var(--wp--preset--color--vivid-green-cyan) !important;}.has-pale-cyan-blue-background-color{background-color: var(--wp--preset--color--pale-cyan-blue) !important;}.has-vivid-cyan-blue-background-color{background-color: var(--wp--preset--color--vivid-cyan-blue) !important;}.has-vivid-purple-background-color{background-color: var(--wp--preset--color--vivid-purple) !important;}.has-primary-background-color{background-color: var(--wp--preset--color--primary) !important;}.has-secondary-background-color{background-color: var(--wp--preset--color--secondary) !important;}.has-foreground-background-color{background-color: var(--wp--preset--color--foreground) !important;}.has-background-background-color{background-color: var(--wp--preset--color--background) !important;}.has-black-border-color{border-color: var(--wp--preset--color--black) !important;}.has-cyan-bluish-gray-border-color{border-color: var(--wp--preset--color--cyan-bluish-gray) !important;}.has-white-border-color{border-color: var(--wp--preset--color--white) !important;}.has-pale-pink-border-color{border-color: var(--wp--preset--color--pale-pink) !important;}.has-vivid-red-border-color{border-color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-border-color{border-color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-border-color{border-color: var(--wp--preset--color--luminous-vivid-amber) !important;}.has-light-green-cyan-border-color{border-color: var(--wp--preset--color--light-green-cyan) !important;}.has-vivid-green-cyan-border-color{border-color: var(--wp--preset--color--vivid-green-cyan) !important;}.has-pale-cyan-blue-border-color{border-color: var(--wp--preset--color--pale-cyan-blue) !important;}.has-vivid-cyan-blue-border-color{border-color: var(--wp--preset--color--vivid-cyan-blue) !important;}.has-vivid-purple-border-color{border-color: var(--wp--preset--color--vivid-purple) !important;}.has-primary-border-color{border-color: var(--wp--preset--color--primary) !important;}.has-secondary-border-color{border-color: var(--wp--preset--color--secondary) !important;}.has-foreground-border-color{border-color: var(--wp--preset--color--foreground) !important;}.has-background-border-color{border-color: var(--wp--preset--color--background) !important;}.has-vivid-cyan-blue-to-vivid-purple-gradient-background{background: var(--wp--preset--gradient--vivid-cyan-blue-to-vivid-purple) !important;}.has-light-green-cyan-to-vivid-green-cyan-gradient-background{background: var(--wp--preset--gradient--light-green-cyan-to-vivid-green-cyan) !important;}.has-luminous-vivid-amber-to-luminous-vivid-orange-gradient-background{background: var(--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange) !important;}.has-luminous-vivid-orange-to-vivid-red-gradient-background{background: var(--wp--preset--gradient--luminous-vivid-orange-to-vivid-red) !important;}
97.has-very-light-gray-to-cyan-bluish-gray-gradient-background{background: var(--wp--preset--gradient--very-light-gray-to-cyan-bluish-gray) !important;}.has-cool-to-warm-spectrum-gradient-background{background: var(--wp--preset--gradient--cool-to-warm-spectrum) !important;}.has-blush-light-purple-gradient-background{background: var(--wp--preset--gradient--blush-light-purple) !important;}.has-blush-bordeaux-gradient-background{background: var(--wp--preset--gradient--blush-bordeaux) !important;}.has-luminous-dusk-gradient-background{background: var(--wp--preset--gradient--luminous-dusk) !important;}.has-pale-ocean-gradient-background{background: var(--wp--preset--gradient--pale-ocean) !important;}.has-electric-grass-gradient-background{background: var(--wp--preset--gradient--electric-grass) !important;}.has-midnight-gradient-background{background: var(--wp--preset--gradient--midnight) !important;}.has-small-font-size{font-size: var(--wp--preset--font-size--small) !important;}.has-medium-font-size{font-size: var(--wp--preset--font-size--medium) !important;}.has-large-font-size{font-size: var(--wp--preset--font-size--large) !important;}.has-x-large-font-size{font-size: var(--wp--preset--font-size--x-large) !important;}.has-normal-font-size{font-size: var(--wp--preset--font-size--normal) !important;}.has-huge-font-size{font-size: var(--wp--preset--font-size--huge) !important;}
98/*# sourceURL=global-styles-inline-css */
99</style>
100
101<style id="jetpack-stats-inline-css">
102img#wpstats{display:none}
103/*# sourceURL=jetpack-stats-inline-css */
104</style>
105<link rel='stylesheet' id='dashicons-css' href='https://textslashplain.com/wp-includes/css/dashicons.min.css?ver=7.1.2' media='all' />
106<link rel='stylesheet' id='all-css-5637bb3f5c4191457f95b28bb1f10d1f' href='https://textslashplain.com/_static/??-eJyNjUEKwjAQRS9kO1Qo1YW4KXgAT9BOhhiazARnQuntjWQvLt/n896eOxQ2YoMciw+s4EvFld4e1hKiA7UjkoK9KBE40uC5M9mItU+Be1Q97X9bUFIWrkdtyy8FyhoFN4XAGEstw0yZ2BFjqPCQeXHugGczt0xcjNS+xnu6DdPlOo7jMJ0/oihXWg==' type='text/css' media='all' />
107<link rel='stylesheet' id='print-css-fc6cea5c2493407b3b9187e241ceda9f' href='https://textslashplain.com/wp-content/themes/varia/print.css?m=1738187798' type='text/css' media='print' />
108<link rel='stylesheet' id='all-css-80b178224cc40b234b612085deb0c0a2' href='https://textslashplain.com/_static/??-eJyNjEsKhDAQBS80mTagmI14lCHTNhLtfEgnhLn94MKl4rJe8aolhTEUCgUS19UFgY1KsrjDxwWEL0fcBaS5RPmNIq92/fBxqUwCaHOsQnwKdQ5PA8UxLWq1zJR/d3QEZz/p0Qym06bv/9xmTnk=' type='text/css' media='all' />
109<style id="jetpack_likes-inline-css">
110#jp-post-flair{padding-top:.5em}#content div.sharedaddy,#main div.sharedaddy,div.sharedaddy{clear:both}div.sharedaddy h3.sd-title{display:inline-block;font-size:9pt;font-weight:700;line-height:1.2;margin:0 0 1em}div.sharedaddy h3.sd-title:before{border-top:1px solid #dcdcde;content:"";display:block;margin-bottom:1em;min-width:30px;width:100%}div.jetpack-likes-widget-wrapper{min-height:50px;position:relative;width:100%}div.jetpack-likes-widget-wrapper .sd-link-color{font-size:12px}div.jetpack-comment-likes-widget-wrapper{min-height:31px;position:relative;width:100%}div.jetpack-comment-likes-widget-wrapper iframe{margin-bottom:0}#likes-other-gravatars{background-color:#fff;border:1px solid #dcdcde;border-radius:4px;box-shadow:none;display:none;height:auto;max-height:240px;min-width:220px;overflow:auto;padding:9px 12px 10px;position:absolute;z-index:1000}#likes-other-gravatars *{line-height:normal}#likes-other-gravatars .likes-text{color:#101517;font-size:12px;font-weight:500;padding-bottom:8px}#likes-other-gravatars :is(li,ul){list-style-type:none;margin:0;padding:0;text-indent:0}#likes-other-gravatars li:before{content:""}#likes-other-gravatars ul.wpl-avatars{display:block;max-height:190px;overflow:auto}#likes-other-gravatars ul.wpl-avatars li{float:none;height:28px;margin:0 0 4px;width:196px}#likes-other-gravatars ul.wpl-avatars li a{align-items:center;border-bottom:none!important;display:flex;gap:8px;margin:0 2px 0 0;text-decoration:none}#likes-other-gravatars ul.wpl-avatars li a span{color:#2c3338;font-size:12px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}#likes-other-gravatars ul.wpl-avatars li a img{background:none;border:none;border-radius:50%;box-sizing:border-box;margin:0!important;padding:1px!important;position:static}div.sd-box{border-top:1px solid #00000021}.jetpack-likes-widget-loaded iframe,.jetpack-likes-widget-loading .likes-widget-placeholder,.jetpack-likes-widget-unloaded .likes-widget-placeholder{display:block}.jetpack-likes-widget-loaded .likes-widget-placeholder,.jetpack-likes-widget-loading iframe,.jetpack-likes-widget-unloaded iframe{display:none}.comment-likes-widget,.entry-content .post-likes-widget,.post-likes-widget{border-width:0;margin:0}.comment-likes-widget-placeholder,.post-likes-widget-placeholder{border-width:0;margin:0;position:relative}.comment-likes-widget-placeholder{display:flex;font-family:-apple-system,BlinkMacSystemFont,Segoe UI,Roboto,Oxygen-Sans,Ubuntu,Cantarell,Helvetica Neue,sans-serif;height:18px;position:absolute}.comment-likes-widget-placeholder:before{background-image:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'%3E%3Cpath fill='none' d='M0 0h24v24H0z'/%3E%3Cpath fill='%232ea2cc' d='m12 2 2.582 6.953L22 9.257l-5.822 4.602L18.18 21 12 16.89 5.82 21l2.002-7.14L2 9.256l7.418-.304'/%3E%3C/svg%3E");background-repeat:no-repeat;background-size:16px 16px;color:#2ea2cc;content:"";display:inline-block;height:16px;padding-right:5px;position:relative;top:3px;width:16px}.post-likes-widget-placeholder .button{display:none}:is(.comment-likes-widget-placeholder,.post-likes-widget-placeholder) .loading{color:#999;font-size:12px}.comment-likes-widget-placeholder .loading{align-self:center;color:#4e4e4e;margin-top:4px;padding-left:5px}
110div.sharedaddy.sd-like-enabled .sd-like h3{display:none}div.sharedaddy.sd-like-enabled .sd-like .post-likes-widget{float:none;position:absolute;top:0;width:100%}.comment-likes-widget{width:100%}.cs-rating,.pd-rating{display:block!important}.sd-gplus .sd-title{display:none}@media print{.jetpack-likes-widget-wrapper{display:none}}
111/*# sourceURL=https://textslashplain.com/wp-content/plugins/jetpack/_inc/build/likes/style.min.css */
112</style>
113<link rel='stylesheet' id='all-css-e8ef77940e185d27bf390aead6c358e3' href='https://textslashplain.com/_static/??wp-content/themes/morden/style.css,wp-content/themes/varia/inc/style-wpcom.css?m=1738187798' type='text/css' media='all' />
114<link rel='stylesheet' id='morden-fonts-css' href='https://fonts-api.wp.com/css?family=Noto+Sans%3A400%2C400i%2C700%2C700i&#038;subset=latin%2Clatin-ext' media='all' />
115<link rel='stylesheet' id='all-css-7aa849586d0df372f8f5df5ea0492a17' href='https://textslashplain.com/wp-content/themes/morden/style.css?m=1738187798' type='text/css' media='all' />
116<style id="jetpack-global-styles-frontend-style-inline-css">
117:root { --font-headings: unset; --font-base: unset; --font-headings-default: -apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Oxygen-Sans,Ubuntu,Cantarell,"Helvetica Neue",sans-serif; --font-base-default: -apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Oxygen-Sans,Ubuntu,Cantarell,"Helvetica Neue",sans-serif;}
118/*# sourceURL=jetpack-global-styles-frontend-style-inline-css */
119</style>
120<script id="jetpack-mu-wpcom-settings-js-before">
121var JETPACK_MU_WPCOM_SETTINGS = {"assetsUrl":"https://textslashplain.com/wp-content/mu-plugins/wpcomsh/jetpack_vendor/automattic/jetpack-mu-wpcom/src/build/"};
122//# sourceURL=jetpack-mu-wpcom-settings-js-before
123</script>
123
124<link rel="https://api.w.org/" href="https://textslashplain.com/wp-json/" /><link rel="EditURI" type="application/rsd+xml" title="RSD" href="https://textslashplain.com/xmlrpc.php?rsd" />
125
126<link rel='shortlink' href='https://wp.me/60i9o' />
127		<style type="text/css">
128			.recentcomments a {
129				display: inline !important;
130				padding: 0 !important;
131				margin: 0 !important;
132			}
133
134			table.recentcommentsavatartop img.avatar, table.recentcommentsavatarend img.avatar {
135				border: 0;
136				margin: 0;
137			}
138
139			table.recentcommentsavatartop a, table.recentcommentsavatarend a {
140				border: 0 !important;
141				background-color: transparent !important;
142			}
143
144			td.recentcommentsavatarend, td.recentcommentsavatartop {
145				padding: 0 0 1px 0;
146				margin: 0;
147			}
148
149			td.recentcommentstextend {
150				border: none !important;
151				padding: 0 0 2px 10px;
152			}
153
154			.rtl td.recentcommentstextend {
155				padding: 0 10px 2px 0;
156			}
157
158			td.recentcommentstexttop {
159				border: none;
160				padding: 0 0 0 10px;
161			}
162
163			.rtl td.recentcommentstexttop {
164				padding: 0 10px 0 0;
165			}
166		</style>
167		<meta name="description" content="ericlaw talks about security, the web, and software in general" />
168
169<!-- Jetpack Open Graph Tags -->
170<meta property="og:type" content="website" />
171<meta property="og:title" content="text/plain" />
172<meta property="og:description" content="ericlaw talks about security, the web, and software in general" />
173<meta property="og:url" content="https://textslashplain.com/" />
174<meta property="og:site_name" content="text/plain" />
175<meta property="og:image" content="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/02/cropped-fb_img_1677942992666.jpg?fit=512%2C512&#038;ssl=1" />
176<meta property="og:image:width" content="512" />
177<meta property="og:image:height" content="512" />
178<meta property="og:image:alt" content="" />
179<meta property="og:locale" content="en_US" />
180
181<!-- End Jetpack Open Graph Tags -->
182<link rel="icon" href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/02/cropped-fb_img_1677942992666.jpg?fit=32%2C32&#038;ssl=1" sizes="32x32" />
183<link rel="icon" href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/02/cropped-fb_img_1677942992666.jpg?fit=192%2C192&#038;ssl=1" sizes="192x192" />
184<link rel="apple-touch-icon" href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/02/cropped-fb_img_1677942992666.jpg?fit=180%2C180&#038;ssl=1" />
185<meta name="msapplication-TileImage" content="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/02/cropped-fb_img_1677942992666.jpg?fit=270%2C270&#038;ssl=1" />
186<style type="text/css" id="wp-custom-css">/*
187Welcome to Custom CSS!
188
189To learn how this works, see https://wp.me/PEmnE-Bt
190*/
191#masthead {
192	background: #0B61A5;
193}
194
195.entry-title {
196	text-decoration-line: overline underline;
197	color: #0B61A5;
198}
199
200:root {
201  --bg-color: #ffffff;
202  --text-color: #333333;
203}
204
205@media (prefers-color-scheme: dark) {
206  :root {
207    --bg-color: #1a1a1a;
208    --text-color: #f0f0f0;
209  }
210}
211
212footer, div#page.site, .site-main, body {
213  background-color: var(--bg-color);
214  color: var(--text-color);
215  transition: background-color 0.3s ease, color 0.3s ease;
216}</style><link rel='stylesheet' id='all-css-8381d57c63639341d67b857e4ecf2e89' href='https://textslashplain.com/wp-content/plugins/jetpack/modules/widgets/gravatar-profile.css?m=1764003632' type='text/css' media='all' />
217<link rel='stylesheet' id='gravatar-card-services-css' href='https://secure.gravatar.com/css/services.css?ver=202639' media='all' />
218
219</head>
220
221<body class="home blog wp-embed-responsive wp-theme-varia wp-child-theme-morden hfeed image-filters-enabled">
222
223
224<div id="page" class="site">
225	<a class="skip-link screen-reader-text" href="#content">Skip to content</a>
226
227	
228<header id="masthead" class="site-header" role="banner">
229	<div class="site-header-wrap responsive-max-width has-title-and-tagline">
230		
231
232			<h1 class="site-title"><a href="https://textslashplain.com/" rel="home">text/plain</a></h1>
233	
234		<p class="site-description">
235			ericlaw talks about security, the web, and software in general		</p>
236					</div><!-- .site-header-wrap -->
237</header><!-- #masthead -->
238
239	<div id="content" class="site-content">
240
241	<section id="primary" class="content-area">
242		<main id="main" class="site-main">
243
244		
245<article id="post-15709" class="post-15709 post type-post status-publish format-standard hentry category-design category-dev category-tech category-web tag-browsers tag-defender tag-hsts entry">
246	<header class="entry-header responsive-max-width">
247		<h2 class="entry-title"><a href="https://textslashplain.com/2026/09/11/experimentation-just-try-it/" rel="bookmark">Experimentation: Just Try It!</a></h2>	</header><!-- .entry-header -->
248
249	
250	<div class="entry-content">
251		
252<p class="wp-block-paragraph">I&#8217;ve now been working in tech for 25 years, and in that time I&#8217;ve developed some wisdom. One theme I&#8217;ve discovered and blogged about repeatedly over the years is profound despite its simplicity:</p>
253
254
255
256<p class="has-text-align-center wp-block-paragraph"><em><strong>In many cases, the best way to know whether something will work is to <span style="text-decoration: underline;">just try it</span>.</strong></em></p>
257
258
259
260<p class="wp-block-paragraph">I&#8217;ve written numerous posts making fundamentally the same point:</p>
261
262
263
264<ul class="wp-block-list">
265<li>Want to <a href="https://textslashplain.com/2023/05/15/detecting-when-the-user-is-offline/">detect if a user is online</a>? Just try sending a request!</li>
266
267
268
269<li>Want to know if a new feature will result in user churn or crashes? <a href="https://textslashplain.com/2019/07/16/updating-browsers-quickly-flags-respins-and-components/#:~:text=using%20ChromiumDash.-,Field%20Trial%20Flags,-In%20some%20cases">Conduct a field trial with feature flags</a>!</li>
270
271
272
273<li>Want to know how a setting, ASR Rule, or Group Policy will behave? Create a trivial test and <a href="https://textslashplain.com/2020/02/09/demystifying-browsers/#:~:text=it%E2%80%99s%20often%20easiest%20to%20definitively%20answer%20questions%20about%20how%20browsers%20work%20by%20trying%20things">try it out</a>!</li>
274
275
276
277<li>Want to know if your app or site will work after the next browser update? <a href="https://textslashplain.com/2022/08/04/understanding-browser-channels/">Try a pre-release channel</a>!</li>
278
279
280
281<li>Want to know if you&#8217;re likely to be broken in the future? Use a <a href="https://textslashplain.com/2021/10/01/practical-time-machines/">practical time machine</a> to check!</li>
282</ul>
283
284
285
286<p class="wp-block-paragraph">While I believe experimentation is usually the <em>best </em>approach, it&#8217;s not <em>always </em>practical to try things out &#8212; you might not have the time, resources, or expertise required to experiment. And sometimes your experiment might be flawed and talking to an expert or reading the spec or code might reveal hidden complexities you didn&#8217;t foresee. </p>
287
288
289
290<p class="wp-block-paragraph">Beyond that, unfortunately some systems weren&#8217;t designed to facilitate experimentation.</p>
291
292
293
294<h3 class="wp-block-heading">Experimentation vs. Trapdoors</h3>
295
296
297
298<p class="wp-block-paragraph">In this <a href="https://www.youtube.com/watch?v=rxsdOQa_QkM">short clip</a>, Jeff Bezos talks about decision making and the importance of recognizing the difference between a &#8220;two-way door&#8221; decision and a &#8220;one-way door&#8221; (trapdoor) decision. Put simply: If a decision can be easily reversed, you should make it quickly and without too much thought, avoiding analysis paralysis.<em> Just try it</em>! </p>
299
300
301
302<p class="wp-block-paragraph">In contrast, making a <strong>trapdoor </strong>decision requires much more thought: when a mistake would be very costly or unrecoverable, it is worthwhile to invest significant energy in making sure that your first choice is the best one. </p>
303
304
305<div class="wp-block-image">
306<figure class="aligncenter size-large is-resized"><a href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/09/image-2.png?ssl=1"><img data-recalc-dims="1" fetchpriority="high" decoding="async" width="750" height="750" data-attachment-id="15720" data-permalink="https://textslashplain.com/2026/09/11/experimentation-just-try-it/image-743/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/09/image-2.png?fit=1254%2C1254&amp;ssl=1" data-orig-size="1254,1254" data-comments-opened="1" data-image-meta="{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;,&quot;alt&quot;:&quot;&quot;}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/09/image-2.png?fit=750%2C750&amp;ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/09/image-2.png?resize=750%2C750&#038;ssl=1" alt="" class="wp-image-15720" style="width:594px;height:auto" srcset="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/09/image-2.png?resize=1024%2C1024&amp;ssl=1 1024w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/09/image-2.png?resize=300%2C300&amp;ssl=1 300w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/09/image-2.png?resize=150%2C150&amp;ssl=1 150w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/09/image-2.png?resize=768%2C768&amp;ssl=1 768w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/09/image-2.png?w=1254&amp;
306ssl=1 1254w" sizes="(max-width: 750px) 100vw, 750px" /></a></figure>
307</div>
308
309
310<p class="wp-block-paragraph">In my experience, there are relatively few trapdoor actions in the real-world: yes, it&#8217;s often worthwhile to &#8220;<em>measure twice and cut once</em>&#8220;, but the number of actions with unrecoverable outcomes is small and such circumstances are typically obvious. </p>
311
312
313
314<h3 class="wp-block-heading">Design for Experimentation</h3>
315
316
317
318<p class="wp-block-paragraph">To the extent possible, designers should strive to build products and standards that facilitate experimentation, allowing easy recovery if the user makes a mistake. </p>
319
320
321
322<p class="wp-block-paragraph">Why? Customers <em>prefer </em>products where they can &#8220;<em>just play with it</em>&#8221; without fear of consequences. Fearless experimentation helps smooth over other product shortcomings, including inadequate/outdated documentation, excessive complexity, or confusing UX. </p>
323
324
325
326<h4 class="wp-block-heading">Observability</h4>
327
328
329
330<p class="wp-block-paragraph">An experiment is risky if the outcome cannot be determined.</p>
331
332
333
334<p class="wp-block-paragraph">One important characteristic of experiment-friendly designs is that the experimenter can determine the result of the experiment. In some cases, the user can directly observe the result&#8211; desktop publishing software got much easier to use with the invention of &#8220;print preview&#8221; and what-you-see-is-what-you-get (<a href="https://en.wikipedia.org/wiki/WYSIWYG">WYSIWYG</a>). In others, the product needs instrumentation and telemetry to determine the outcome (e.g. &#8220;<em>With the new compositor feature flag enabled, our crash rate increased by 4%</em>).</p>
335
336
337
338<p class="wp-block-paragraph">Sometimes the best way to make an experiment safe is to allow observation of the outcome <em>without actually making the change</em> (e.g. &#8220;print preview&#8221; shows the outcome without actually wasting paper); some products offer a &#8220;simulation&#8221; mode. </p>
339
340
341
342<h4 class="wp-block-heading">Revertability</h4>
343
344
345
346<p class="wp-block-paragraph">An experiment is risky if getting back to the default or prior state is impossible or difficult.</p>
347
348
349
350<p class="wp-block-paragraph">If getting back to the prior or default state requires that the user keep track of everything they changed and manually undo each operation, users will be reluctant to touch <em>anything</em> for fear of breaking a working configuration. You should strive to make it simple to go back to the prior configuration, or, at the very least offer a single click &#8220;Reset to defaults&#8221; button.</p>
351
352
353
354<h4 class="wp-block-heading">Latency</h4>
355
356
357
358<p class="wp-block-paragraph">An experiment is risky if undoing the experiment takes too much time.</p>
359
360
361
362<p class="wp-block-paragraph">For example, the Web Platform&#8217;s <a href="https://textslashplain.com/tag/hsts/">Strict Transport Security</a> feature allows a site to announce that it is only loadable over HTTPS, refusing to load over HTTP. A site owner can even decree that browsers should &#8220;pre-load&#8221; this enforcement to protect every visitor&#8217;s first visit. The problem is that the browser&#8217;s <a href="https://hstspreload.org/">HSTS Preload list</a> only updates every few weeks, meaning <a href="https://textslashplain.com/2018/04/09/hsts-preload-and-subdomains/">a common mistake</a> is that a site owner preloads their entire domain but quickly learns that some overlooked subdomains only support HTTP. Then they panic and beg the browser vendors for help, but it&#8217;s too late &#8212; it&#8217;ll be weeks before their domain can be removed from the preload list. <em>Oops</em>.</p>
363
364
365<div class="wp-block-image">
366<figure class="aligncenter size-full is-resized"><a href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/09/image-4.png?ssl=1"><img data-recalc-dims="1" decoding="async" width="750" height="277" data-attachment-id="15731" data-permalink="https://textslashplain.com/2026/09/11/experimentation-just-try-it/image-745/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/09/image-4.png?fit=750%2C277&amp;ssl=1" data-orig-size="750,277" data-comments-opened="1" data-image-meta="{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;,&quot;alt&quot;:&quot;&quot;}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/09/image-4.png?fit=750%2C277&amp;ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/09/image-4.png?resize=750%2C277&#038;ssl=1" alt="" class="wp-image-15731" style="aspect-ratio:2.7076775540136513;width:624px;height:auto" srcset="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/09/image-4.png?w=750&amp;ssl=1 750w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/09/image-4.png?resize=300%2C111&amp;
366ssl=1 300w" sizes="(max-width: 750px) 100vw, 750px" /></a><figcaption class="wp-element-caption">Timeline of misery (Browsers now ship even faster, but the time-to-recover is still very long)</figcaption></figure>
367</div>
368
369
370<p class="wp-block-paragraph">The Web Platform&#8217;s <a href="https://tools.ietf.org/html/rfc7469">HTTP Public Key Pinning feature</a> was so often a source of self-inflicted outages that the feature was <a href="https://chromestatus.com/feature/5903385005916160">removed from Chrome entirely</a> in version 72.</p>
371
372
373
374<p class="wp-block-paragraph">As a less extreme example, <a href="https://textslashplain.com/2025/04/07/understanding-smartscreen-and-network-protection/">Microsoft Defender&#8217;s Network Protection</a> Indicators feature allows an organization to block any &#8220;indicator&#8221; (domain, IP address, code-signing certificate or executable file&#8217;s hash). When the Security Operation Center adds a block against an indicator, Defender will prevent access to the resource. For example, if your IT department configures a Defender Custom Certificate Indicator to forbid use of Notepad++ inside your enterprise, attempting to download or run the installer will <a href="https://textslashplain.com/2026/01/27/microsoft-defender-false-positives/#:~:text=block%20from%20Company%20Policy">result in a block</a>:</p>
375
376
377<div class="wp-block-image">
378<figure class="aligncenter size-full is-resized"><a href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/09/image-3.png?ssl=1"><img data-recalc-dims="1" decoding="async" width="750" height="671" data-attachment-id="15725" data-permalink="https://textslashplain.com/2026/09/11/experimentation-just-try-it/image-744/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/09/image-3.png?fit=964%2C863&amp;ssl=1" data-orig-size="964,863" data-comments-opened="1" data-image-meta="{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;,&quot;alt&quot;:&quot;&quot;}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/09/image-3.png?fit=750%2C671&amp;ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/09/image-3.png?resize=750%2C671&#038;ssl=1" alt="" class="wp-image-15725" style="aspect-ratio:1.1170560329394916;width:494px;height:auto" srcset="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/09/image-3.png?w=964&amp;ssl=1 964w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/09/image-3.png?resize=300%2C269&amp;ssl=1 300w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/09/image-3.png?resize=768%2C688&amp;ssl=1 768w" sizes="(max-width: 750px) 100vw, 750px" /></a></figure>
379</div>
380
381
382<p class="wp-block-paragraph">But what happens if the SOC administrator read some threat intelligence and naively decided to block <code>s3.amazonaws.com</code> via a network indicator? They would very quickly find that a huge number of websites that use Amazon S3 storage fail to load correctly, preventing their colleagues from loading mission-critical web applications. The SOC admin would immediately delete the errant indicator, but because changes to Defender&#8217;s indicators typically take <strong>two hours </strong>to propagate to all devices, they&#8217;ve just created an expensive <strong>outage</strong>. </p>
383
384
385
386<p class="wp-block-paragraph">Custom Indicators are an extremely powerful feature, but to experiment with them safely the admin cannot blindly &#8220;<em>set it and forget it</em>.&#8221;</p>
387
388
389
390<h4 class="wp-block-heading">Audit/ReportOnly Mode</h4>
391
392
393
394<p class="wp-block-paragraph">An experiment is safe if running the experiment is harmless. </p>
395
396
397
398<p class="wp-block-paragraph">Defender&#8217;s Indicators feature allows the admin to specify that the indicator should run in <strong>
398<a href="https://learn.microsoft.com/en-us/defender-endpoint/indicators-overview#:~:text=on%20your%20devices.-,Audit,-%3A%20an%20alert%20is">audit mode</a></strong>. While an indicator is in Audit mode, the SOC will receive a notice if the indicator <em>would have</em> triggered in warn/block mode. To safely deploy an indicator, admins should always first deploy the indicator in audit mode and wait, watching for any alerts that indicate unexpected blocking. Only after a successful trial period should an IOC be set to warn/block mode. </p>
399
400
401
402<p class="wp-block-paragraph">System designers can design systems that encourage safe experimentation, for instance, by not allowing an Indicator to directly be set to block mode until an audit period has elapsed.</p>
403
404
405
406<p class="wp-block-paragraph">Audit/Report modes don&#8217;t just exist for Defender Indicators, of course. Web Platform features like <code>Content-Security-Policy</code> allow a <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy-Report-Only"><code>report only</code> mode</a> where content that violates the directives results in a telemetry report that can be <a href="https://report-uri.com/">logged</a> for validation before moving into enforcement mode. </p>
407
408
409
410<h4 class="wp-block-heading">&#8220;<em>Careful This Thing&#8217;s Loaded!</em>&#8220;</h4>
411
412
413
414<p class="wp-block-paragraph">When it&#8217;s not possible to make decisions easily reversible, there should be prominent warnings to alert the user to the risk. </p>
415
416
417
418<figure class="wp-block-image size-large"><a href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/09/image.png?ssl=1"><img data-recalc-dims="1" loading="lazy" decoding="async" width="750" height="576" data-attachment-id="15716" data-permalink="https://textslashplain.com/2026/09/11/experimentation-just-try-it/image-741/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/09/image.png?fit=1383%2C1061&amp;ssl=1" data-orig-size="1383,1061" data-comments-opened="1" data-image-meta="{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;,&quot;alt&quot;:&quot;&quot;}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/09/image.png?fit=750%2C576&amp;ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/09/image.png?resize=750%2C576&#038;ssl=1" alt="" class="wp-image-15716" srcset="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/09/image.png?resize=1024%2C786&amp;ssl=1 1024w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/09/image.png?resize=300%2C230&amp;ssl=1 300w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/09/image.png?resize=768%2C589&amp;ssl=1 768w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/09/image.png?w=1383&amp;ssl=1 1383w" sizes="auto, (max-width: 750px) 100vw, 750px" /></a></figure>
419
420
421
422<p class="wp-block-paragraph">The HSTSPreload website requires that the admin undertake a number of technical steps, and warns (although arguably not sufficiently prominently) of the implications of preloading:</p>
423
424
425
426<figure class="wp-block-image size-full"><a href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/09/image-5.png?ssl=1"><img data-recalc-dims="1" loading="lazy" decoding="async" width="750" height="290" data-attachment-id="15733" data-permalink="https://textslashplain.com/2026/09/11/experimentation-just-try-it/image-746/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/09/image-5.png?fit=920%2C356&amp;ssl=1" data-orig-size="920,356" data-comments-opened="1" data-image-meta="{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;,&quot;alt&quot;:&quot;&quot;}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/09/image-5.png?fit=750%2C290&amp;ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/09/image-5.png?resize=750%2C290&#038;ssl=1" alt="" class="wp-image-15733" srcset="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/09/image-5.png?w=920&amp;ssl=1 920w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/09/image-5.png?resize=300%2C116&amp;ssl=1 300w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/09/image-5.png?resize=768%2C297&amp;
426ssl=1 768w" sizes="auto, (max-width: 750px) 100vw, 750px" /></a></figure>
427
428
429
430<p class="wp-block-paragraph"></p>
431
432
433
434<h3 class="wp-block-heading">Constant Vigilence</h3>
435
436
437
438<p class="wp-block-paragraph">I&#8217;ve <a href="https://textslashplain.com/2021/10/01/practical-time-machines/">previously argued</a> “<em>The definition of insanity is doing the same thing over and over again, and expecting the</em> same <em>results</em>&#8221; and my linked blog post explains why. You cannot assume that just because you&#8217;ve carefully experimented and tuned before setting a policy that the resulting behavior will never cause you problems. Over time, your devices will get software updates, your users will try out new scenarios, and you will probably even get new employees that exercise new functionality. Even if you follow <a href="https://textslashplain.com/2021/10/01/practical-time-machines/#:~:text=Practical%20Time%20Machine%20%E2%80%93%20Channels">best practices to stay ahead of your users</a>, you will always need to have appropriate monitoring in place to get notice of any behavioral breakages that slip by your testing. </p>
439
440
441
442<p class="wp-block-paragraph"></p>
443
444
445
446<p class="wp-block-paragraph">Thanks for your help in building better products and using them more effectively!</p>
447
448
449
450<p class="wp-block-paragraph">-Eric</p>
451	</div><!-- .entry-content -->
452
453	<footer class="entry-footer responsive-max-width">
454		<span class="byline"><svg class="svg-icon" width="16" height="16" aria-hidden="true" role="img" focusable="false" viewBox="0 0 24 24" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><path d="M12 12c2.21 0 4-1.79 4-4s-1.79-4-4-4-4 1.79-4 4 1.79 4 4 4zm0 2c-2.67 0-8 1.34-8 4v2h16v-2c0-2.66-5.33-4-8-4z"></path><path d="M0 0h24v24H0z" fill="none"></path></svg><span class="screen-reader-text">Posted by</span><span class="author vcard"><a class="url fn n" href="https://textslashplain.com/author/ericlaw1979/">ericlaw</a></span></span><span class="posted-on"><svg class="svg-icon" width="16" height="16" aria-hidden="true" role="img" focusable="false" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><defs><path id="a" d="M0 0h24v24H0V0z"></path></defs><clipPath id="b"><use xlink:href="#a" overflow="visible"></use></clipPath><path clip-path="url(#b)" d="M12 2C6.5 2 2 6.5 2 12s4.5 10 10 10 10-4.5 10-10S17.5 2 12 2zm4.2 14.2L11 13V7h1.5v5.2l4.5 2.7-.8 1.3z"></path></svg><a href="https://textslashplain.com/2026/09/11/experimentation-just-try-it/" rel="bookmark"><time class="entry-date published" datetime="2026-09-11T16:32:23-05:00">2026-09-11</time><time class="updated" datetime="2026-09-17T10:27:08-05:00">2026-09-17</time></a></span><span class="cat-links"><svg class="svg-icon" width="16" height="16" aria-hidden="true" role="img" focusable="false" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M10 4H4c-1.1 0-1.99.9-1.99 2L2 18c0 1.1.9 2 2 2h16c1.1 0 2-.9 2-2V8c0-1.1-.9-2-2-2h-8l-2-2z"></path><path d="M0 0h24v24H0z" fill="none"></path></svg><span class="screen-reader-text">Posted in</span><a href="https://textslashplain.com/category/design/" rel="category tag">design</a>, <a href="https://textslashplain.com/category/dev/" rel="category tag">dev</a>, <a href="https://textslashplain.com/category/tech/" rel="category tag">tech</a>, <a href="https://textslashplain.com/category/tech/web/" rel="category tag">web</a></span><span class="tags-links"><svg class="svg-icon" width="16" height="16" aria-hidden="true" role="img" focusable="false" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M21.41 11.58l-9-9C12.05 2.22 11.55 2 11 2H4c-1.1 0-2 .9-2 2v7c0 .55.22 1.05.59 1.42l9 9c.36.36.86.58 1.41.58.55 0 1.05-.22 1.41-.59l7-7c.37-.36.59-.86.59-1.41 0-.55-.23-1.06-.59-1.42zM5.5 7C4.67 7 4 6.33 4 5.5S4.67 4 5.5 4 7 4.67 7 5.5 6.33 7 5.5 7z"></path><path d="M0 0h24v24H0z" fill="none"></path></svg><span class="screen-reader-text">Tags:</span><a href="https://textslashplain.com/tag/browsers/" rel="tag">browsers</a>, <a href="https://textslashplain.com/tag/defender/" rel="tag">Defender</a>, <a href="https://textslashplain.com/tag/hsts/" rel="tag">HSTS</a></span><span class="comments-link"><svg class="svg-icon" width="16" height="16" aria-hidden="true" role="img" focusable="false" viewBox="0 0 24 24" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><path d="M21.99 4c0-1.1-.89-2-1.99-2H4c-1.1 0-2 .9-2 2v12c0 1.1.9 2 2 2h14l4 4-.01-18z"></path><path d="M0 0h24v24H0z" fill="none"></path></svg><a href="https://textslashplain.com/2026/09/11/experimentation-just-try-it/#respond">Leave a comment<span class="screen-reader-text"> on Experimentation: Just Try It!</span></a></span>	</footer><!-- .entry-footer -->
455</article><!-- #post-${ID} -->
456
457<article id="post-15699" class="post-15699 post type-post status-publish format-standard hentry category-browsers category-design category-security entry">
458	<header class="entry-header responsive-max-width">
459		<h2 class="entry-title"><a href="https://textslashplain.com/2026/09/10/simple-browser-security-improvements/" rel="bookmark">Simple Browser Security Improvements</a></h2>	</header><!-- .entry-header -->
460
461	
462	<div class="entry-content">
463		
464<p class="wp-block-paragraph">Security Engineering is all about tradeoffs: </p>
465
466
467
468<ul class="wp-block-list">
469<li><a href="https://textslashplain.com/2023/10/04/security-tradeoffs-privacy/">Security vs. Privacy</a></li>
470
471
472
473<li>Security vs. Performance</li>
474
475
476
477<li>Security vs. Compatibility</li>
478
479
480
481<li>Security vs. Usability</li>
482</ul>
483
484
485
486<p class="wp-block-paragraph">Web Browsers attempt to achieve an absolutely bananas goal: Allow safe execution of untrusted content on a user&#8217;s device.</p>
487
488
489
490<p class="wp-block-paragraph">Browsers are a huge vector for compromise of users&#8217; devices and personal information, owing to the power and complexity. Much of the vulnerability induced by browsers occur where tradeoffs were either made poorly initially, or where the tradeoff would be made differently knowing what we know now.</p>
491
492
493
494<p class="wp-block-paragraph">So, what should we do? Here&#8217;s a modest list of proposals, many of which could be achieved in less than one dev day:</p>
495
496
497
498<ol class="wp-block-list">
499<li>Disallow <a href="https://textslashplain.com/2023/09/12/attack-techniques-fullscreen-abuse/">random websites from going fullscreen</a> without permission</li>
500
501
502
503<li>Allow simple Enterprise control of what <a href="https://textslashplain.com/2023/04/05/file-types/">types of files</a> are allowed to download &#8212; current controls are <a href="https://textslashplain.com/2021/05/19/download-blocking-by-file-type/#:~:text=for%20dangerous%20content.-,Group%20Policies,-DownloadRestrictions%20is%20a">comically underpowered</a>. (<a href="https://issues.chromium.org/issues/40265750">https://issues.chromium.org/issues/40265750</a>)</li>
504
505
506
507<li>Block download UI launch of <a href="https://textslashplain.com/2024/05/20/attack-techniques-full-trust-script-downloads/">high-risk file types</a> that the OS has inexplicably failed to secure</li>
508
509
510
511<li>Introduce a pre-fetch security check to allow security software to block malicious requests (similar to <a href="https://textslashplain.com/2025/06/10/apple-url-filter-api/">this</a>)</li>
512
513
514
515<li>Call <a href="https://textslashplain.com/2024/10/25/defensive-technology-antimalware-scan-interface-amsi/">AMSI</a> to <a href="https://textslashplain.com/2025/04/15/vibe-coding-for-security/">detect malicious content copied to the clipboard</a> (<a href="https://issues.chromium.org/issues/440381280">https://issues.chromium.org/issues/440381280</a>)</li>
516
517
518
519<li>Call AMSI when installing a new <a href="https://textslashplain.com/2024/03/07/browser-extensions-powerful-and-potentially-dangerous/">browser extension</a> or restarting the browser to allow local security software insight of what code can impact the user&#8217;s browsing experience</li>
520
521
522
523<li>Stop supporting <a href="https://textslashplain.com/2023/03/22/attack-techniques-spoofing-via-userinfo/">UserInfo in URLs</a> or introduce a warning</li>
524
525
526
527<li>Disallow user-navigation to <code>javascript:</code> URLs or introduce a warning (<a href="https://issues.chromium.org/issues/559142626">https://issues.chromium.org/issues/559142626</a>)</li>
528
529
530
531<li>Further restrict notification permissions to prevent <a href="https://textslashplain.com/2022/09/27/badware-techniques-notification-spam/">scams and spam</a></li>
532
533
534
535<li><em>more to come, I&#8217;m sure</em></li>
536</ol>
537
538
539
540<p class="wp-block-paragraph"></p>
541	</div><!-- .entry-content -->
542
543	<footer class="entry-footer responsive-max-width">
544		<span class="byline"><svg class="svg-icon" width="16" height="16" aria-hidden="true" role="img" focusable="false" viewBox="0 0 24 24" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><path d="M12 12c2.21 0 4-1.79 4-4s-1.79-4-4-4-4 1.79-4 4 1.79 4 4 4zm0 2c-2.67 0-8 1.34-8 4v2h16v-2c0-2.66-5.33-4-8-4z"></path><path d="M0 0h24v24H0z" fill="none"></path></svg><span class="screen-reader-text">Posted by</span><span class="author vcard"><a class="url fn n" href="https://textslashplain.com/author/ericlaw1979/">ericlaw</a></span></span><span class="posted-on"><svg class="svg-icon" width="16" height="16" aria-hidden="true" role="img" focusable="false" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><defs><path id="a" d="M0 0h24v24H0V0z"></path></defs><clipPath id="b"><use xlink:href="#a" overflow="visible"></use></clipPath><path clip-path="url(#b)" d="M12 2C6.5 2 2 6.5 2 12s4.5 10 10 10 10-4.5 10-10S17.5 2 12 2zm4.2 14.2L11 13V7h1.5v5.2l4.5 2.7-.8 1.3z"></path></svg><a href="https://textslashplain.com/2026/09/10/simple-browser-security-improvements/" rel="bookmark"><time class="entry-date published" datetime="2026-09-10T16:18:09-05:00">2026-09-10</time><time class="updated" datetime="2026-09-10T16:20:26-05:00">2026-09-10</time></a></span><span class="cat-links"><svg class="svg-icon" width="16" height="16" aria-hidden="true" role="img" focusable="false" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
544<path d="M10 4H4c-1.1 0-1.99.9-1.99 2L2 18c0 1.1.9 2 2 2h16c1.1 0 2-.9 2-2V8c0-1.1-.9-2-2-2h-8l-2-2z"></path><path d="M0 0h24v24H0z" fill="none"></path></svg><span class="screen-reader-text">Posted in</span><a href="https://textslashplain.com/category/browsers/" rel="category tag">browsers</a>, <a href="https://textslashplain.com/category/design/" rel="category tag">design</a>, <a href="https://textslashplain.com/category/security/" rel="category tag">security</a></span><span class="comments-link"><svg class="svg-icon" width="16" height="16" aria-hidden="true" role="img" focusable="false" viewBox="0 0 24 24" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><path d="M21.99 4c0-1.1-.89-2-1.99-2H4c-1.1 0-2 .9-2 2v12c0 1.1.9 2 2 2h14l4 4-.01-18z"></path><path d="M0 0h24v24H0z" fill="none"></path></svg><a href="https://textslashplain.com/2026/09/10/simple-browser-security-improvements/#comments">1 Comment<span class="screen-reader-text"> on Simple Browser Security Improvements</span></a></span>	</footer><!-- .entry-footer -->
545</article><!-- #post-${ID} -->
546
547<article id="post-15472" class="post-15472 post type-post status-publish format-standard hentry category-security category-tech tag-defender tag-security tag-ui tag-windows entry">
548	<header class="entry-header responsive-max-width">
549		<h2 class="entry-title"><a href="https://textslashplain.com/2026/08/31/the-windows-security-app/" rel="bookmark">The Windows Security App</a></h2>	</header><!-- .entry-header -->
550
551	
552	<div class="entry-content">
553		
554<p class="wp-block-paragraph">Going back as far as the 2004 release of Windows XP SP2, Windows has offered <a href="https://en.wikipedia.org/wiki/Security_and_Maintenance">various GUIs</a> to help users understand the security state of their PC. In modern Windows 10 (<a href="https://en.wikipedia.org/wiki/Windows_10_version_history#:~:text=It%20was%20codenamed%20%22-,Redstone%202,-%22%20(RS2)%20during">RS2</a>+) and Windows 11, the latest version of this graphical user interface is called the &#8220;<a href="https://learn.microsoft.com/en-us/windows/security/operating-system-security/system-security/windows-defender-security-center/windows-defender-security-center">Windows Security Center/App</a>&#8220;.</p>
555
556
557
558<p class="wp-block-paragraph">The Windows Security App (WSA) is a surface upon which Windows exposes various settings and information, including lightweight status for antivirus and firewall products (including those built by third-parties) and entry points to those products&#8217; user-experiences. </p>
559
560
561
562<p class="wp-block-paragraph">The WSA can be launched via the Start Menu, or by clicking on various toast notifications sent by features within the app.</p>
563
564
565<div class="wp-block-image">
566<figure class="aligncenter size-full"><a href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-65.png?ssl=1"><img data-recalc-dims="1" loading="lazy" decoding="async" width="334" height="227" data-attachment-id="15483" data-permalink="https://textslashplain.com/2026/08/31/the-windows-security-app/image-717/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-65.png?fit=334%2C227&amp;ssl=1" data-orig-size="334,227" data-comments-opened="1" data-image-meta="{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;,&quot;alt&quot;:&quot;&quot;}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-65.png?fit=334%2C227&amp;ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-65.png?resize=334%2C227&#038;ssl=1" alt="" class="wp-image-15483" srcset="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-65.png?w=334&amp;ssl=1 334w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-65.png?resize=300%2C204&amp;ssl=1 300w" sizes="auto, (max-width: 334px) 100vw, 334px" /></a></figure>
567</div>
568
569
570<p class="wp-block-paragraph">The default view aims to provide a &#8220;single status screen&#8221; showing the state of the system&#8217;s security components:</p>
571
572
573<div class="wp-block-image">
574<figure class="aligncenter size-full is-resized"><a href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-66.png?ssl=1"><img data-recalc-dims="1" loading="lazy" decoding="async" width="750" height="724" data-attachment-id="15484" data-permalink="https://textslashplain.com/2026/08/31/the-windows-security-app/image-718/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-66.png?fit=842%2C813&amp;ssl=1" data-orig-size="842,813" data-comments-opened="1" data-image-meta="{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;,&quot;alt&quot;:&quot;&quot;}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-66.png?fit=750%2C724&amp;ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-66.png?resize=750%2C724&#038;ssl=1" alt="" class="wp-image-15484" style="aspect-ratio:1.0356639004149377;width:575px;height:auto" srcset="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-66.png?w=842&amp;
574ssl=1 842w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-66.png?resize=300%2C290&amp;ssl=1 300w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-66.png?resize=768%2C742&amp;ssl=1 768w" sizes="auto, (max-width: 750px) 100vw, 750px" /></a></figure>
575</div>
576
577
578<p class="wp-block-paragraph">This UI provides entry points into configuring <a href="https://textslashplain.com/2025/04/07/understanding-smartscreen-and-network-protection/">SmartScreen network reputation</a>, <a href="https://textslashplain.com/2023/08/23/smartscreen-application-reputation-in-pictures/">SmartScreen Application Reputation</a>, <a href="https://textslashplain.com/2026/04/28/smart-app-control/">Smart App Control</a>, <a href="https://textslashplain.com/2024/11/15/defensive-technology-controlled-folder-access/">controlled folder access</a>, <a href="https://textslashplain.com/2025/11/19/defensive-technology-ransomware-data-recovery/">ransomware recovery</a>, <a href="https://textslashplain.com/2025/04/01/defensive-technology-exploit-protection/">exploit protection</a>, <a href="https://textslashplain.com/2025/03/31/defensive-technology-windows-filtering-platform/#:~:text=features%20in%20Windows.-,Windows%20Firewall,-Most%20prominently%2C%20WFP">Windows Firewall</a>, and the device&#8217;s hardware security features.</p>
579
580
581
582<h2 class="wp-block-heading">Defender Antivirus</h2>
583
584
585
586<p class="wp-block-paragraph">By default, Windows includes Microsoft Defender Antivirus (MDAV) and the &#8220;Virus and Threat Protection&#8221; section of the WSA shows the state of MDAV, including details about the most recent scan, any previously-allowed threats, and the &#8220;Protection history&#8221; which outlines any threats previously encountered. </p>
587
588
589
590<p class="wp-block-paragraph">Notably, the WSA is also the <em>only </em>client graphical user-interface for Microsoft Defender Antivirus and Microsoft Defender for Endpoint security products: unlike all third-party security products on Windows there is not today a separate Defender app (<em>except our D4I product; keep reading</em>).</p>
591
592
593<div class="wp-block-image">
594<figure class="aligncenter size-full"><a href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-68.png?ssl=1"><img data-recalc-dims="1" loading="lazy" decoding="async" width="582" height="483" data-attachment-id="15523" data-permalink="https://textslashplain.com/2026/08/31/the-windows-security-app/image-721/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-68.png?fit=582%2C483&amp;ssl=1" data-orig-size="582,483" data-comments-opened="1" data-image-meta="{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;,&quot;alt&quot;:&quot;&quot;}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-68.png?fit=582%2C483&amp;ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-68.png?resize=582%2C483&#038;ssl=1" alt="" class="wp-image-15523" srcset="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-68.png?w=582&amp;ssl=1 582w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-68.png?resize=300%2C249&amp;ssl=1 300w" sizes="auto, (max-width: 582px) 100vw, 582px" /></a></figure>
595</div>
596
597
598<p class="wp-block-paragraph">The <strong>Quick scan</strong> button allows invoking a quick scan of sensitive system locations (primarily, locations used by malware to establish persistence), while the Scan options link allows invoking other types of scans:</p>
599
600
601<div class="wp-block-image">
602<figure class="aligncenter size-full is-resized"><a href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-69.png?ssl=1"><img data-recalc-dims="1" loading="lazy" decoding="async" width="750" height="668" data-attachment-id="15525" data-permalink="https://textslashplain.com/2026/08/31/the-windows-security-app/image-722/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-69.png?fit=796%2C709&amp;ssl=1" data-orig-size="796,709" data-comments-opened="1" data-image-meta="{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;,&quot;alt&quot;:&quot;&quot;}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-69.png?fit=750%2C668&amp;ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-69.png?resize=750%2C668&#038;ssl=1" alt="" class="wp-image-15525" style="aspect-ratio:1.1227340200620755;width:479px;height:auto" srcset="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-69.png?w=796&amp;ssl=1 796w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-69.png?resize=300%2C267&amp;ssl=1 300w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-69.png?resize=768%2C684&amp;
602ssl=1 768w" sizes="auto, (max-width: 750px) 100vw, 750px" /></a></figure>
603</div>
604
605
606<p class="wp-block-paragraph">With that said, as outlined previously in my post about <a href="https://textslashplain.com/2026/04/10/understanding-defender-av-scans/">Understanding Defender AV Scans</a>, there is rarely any need to manually kick off an AV Scan.</p>
607
608
609
610<h2 class="wp-block-heading">Defender for Endpoint</h2>
611
612
613
614<p class="wp-block-paragraph">Until recently, the WSA would not show anything special if a device was onboarded to <a href="https://textslashplain.com/2024/11/18/security-software-an-overview/#:~:text=Microsoft%20Defender%20for%20Endpoint">Microsoft Defender for Endpoint (MDE),</a> the corporate version of Defender that adds numerous additional protection features beyond the free MDAV included with Windows. As I explained last month, it was previously non-trivial to determine whether a PC was <a href="https://textslashplain.com/2026/07/22/offboarding-from-microsoft-defender-for-endpoint/">onboarded to Defender for Endpoint&#8217;s XDR</a> and monitored by a Security Operations Center. </p>
615
616
617
618<p class="wp-block-paragraph">Fortunately, this has recently changed, and the WSA now shows specific information when a device is onboarded, including which MDE features are enabled:</p>
619
620
621<div class="wp-block-image">
622<figure class="aligncenter size-full is-resized"><a href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-70.png?ssl=1"><img data-recalc-dims="1" loading="lazy" decoding="async" width="750" height="728" data-attachment-id="15530" data-permalink="https://textslashplain.com/2026/08/31/the-windows-security-app/image-723/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-70.png?fit=796%2C773&amp;ssl=1" data-orig-size="796,773" data-comments-opened="1" data-image-meta="{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;,&quot;alt&quot;:&quot;&quot;}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-70.png?fit=750%2C728&amp;ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-70.png?resize=750%2C728&#038;ssl=1" alt="" class="wp-image-15530" style="aspect-ratio:1.0297673075336249;width:472px;height:auto" srcset="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-70.png?w=796&amp;ssl=1 796w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-70.png?resize=300%2C291&amp;ssl=1 300w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-70.png?resize=768%2C746&amp;ssl=1 768w" sizes="auto, (max-width: 750px) 100vw, 750px" /></a></figure>
623</div>
624
625
626<p class="wp-block-paragraph">The <strong>Device Details </strong>link in the footer reveals more information, including status and version numbers of the protection components:</p>
627
628
629<div class="wp-block-image">
630<figure class="aligncenter size-full is-resized"><a href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-71.png?ssl=1"><img data-recalc-dims="1" loading="lazy" decoding="async" width="647" height="714" data-attachment-id="15532" data-permalink="https://textslashplain.com/2026/08/31/the-windows-security-app/image-724/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-71.png?fit=647%2C714&amp;ssl=1" data-orig-size="647,714" data-comments-opened="1" data-image-meta="{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;,&quot;alt&quot;:&quot;&quot;}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-71.png?fit=647%2C714&amp;ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-71.png?resize=647%2C714&#038;ssl=1" alt="" class="wp-image-15532" style="aspect-ratio:0.9061802424826016;width:377px;height:auto" srcset="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-71.png?w=647&amp;ssl=1 647w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-71.png?resize=272%2C300&amp;
630ssl=1 272w" sizes="auto, (max-width: 647px) 100vw, 647px" /></a></figure>
631</div>
632
633
634<h2 class="wp-block-heading">Third Party Antivirus</h2>
635
636
637
638<p class="wp-block-paragraph">When a 3rd party security product installs on a client version of Windows, it calls the Windows Security Center API to announce its presence and status. Supported products include <strong>Virus and Threat Protection</strong> products and <strong>Firewall </strong>products. <em>WSA previously showed a <strong>Web Protection </strong>category intended to indicate the status of any <a href="https://textslashplain.com/2020/02/03/microsofts-three-browsers/">Edge Legacy</a> browser protection extensions, but this section was removed in a recent update because Edge Legacy was removed years ago.</em></p>
639
640
641
642<p class="wp-block-paragraph">Registering a product in the Virus and Threat Protection category causes MDAV to <a href="https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-antivirus-compatibility#antivirus-protection-without-defender-for-endpoint:~:text=summarizes%20the%20state%20of%20Microsoft%20Defender%20Antivirus">either</a> <a href="https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-antivirus-compatibility#antivirus-protection-without-defender-for-endpoint">enter &#8220;passive mode&#8221;</a><sup>1</sup> (disabling real-time protection and other features) or disable entirely<sup>1</sup>, allowing the 3rd party product to be the active protection component of the system. The product in question has short window after each system startup to register with the API: if it fails to do so, or if it indicates that it is not working properly, MDAV resumes Active protection. The APIs for registering with the Windows Security Center are not fully public, and only callable by members of <a href="https://learn.microsoft.com/en-us/unified-secops/virus-initiative-criteria">the MVI program</a>.</p>
643
644
645
646<p class="wp-block-paragraph">When a 3P security product registers, the UI of the Windows Security Center is updated to show lightweight status information from that product and offer an <strong>Open app</strong> entry point into the 3P product&#8217;s (typically) richer user-interface. </p>
647
648
649<div class="wp-block-image">
650<figure class="aligncenter size-full is-resized"><a href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-60.png?ssl=1"><img data-recalc-dims="1" loading="lazy" decoding="async" width="750" height="586" data-attachment-id="15476" data-permalink="https://textslashplain.com/2026/08/31/the-windows-security-app/image-712/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-60.png?fit=814%2C636&amp;ssl=1" data-orig-size="814,636" data-comments-opened="1" data-image-meta="{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;,&quot;alt&quot;:&quot;&quot;}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-60.png?fit=750%2C586&amp;ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-60.png?resize=750%2C586&#038;ssl=1" alt="" class="wp-image-15476" style="aspect-ratio:1.2799087226296086;width:642px;height:auto" srcset="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-60.png?w=814&amp;ssl=1 814w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-60.png?resize=300%2C234&amp;ssl=1 300w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-60.png?resize=768%2C600&amp;ssl=1 768w" sizes="auto, (max-width: 750px) 100vw, 750px" /></a><figcaption class="wp-element-caption">Windows Security App behind the 3P Sophos Home application spawned from the &#8220;Open app&#8221; button.</figcaption></figure>
651</div>
652
653
654<p class="wp-block-paragraph">Multiple 3P products (AV and Firewall) may be installed at one time, although it&#8217;s generally recommended to only have one product of each time active to avoid conflicts and performance impact.</p>
655
656
657<div class="wp-block-image">
658<figure class="aligncenter size-full is-resized"><a href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-62.png?ssl=1"><img data-recalc-dims="1" loading="lazy" decoding="async" width="429" height="550" data-attachment-id="15478" data-permalink="https://textslashplain.com/2026/08/31/the-windows-security-app/image-714/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-62.png?fit=429%2C550&amp;ssl=1" data-orig-size="429,550" data-comments-opened="1" data-image-meta="{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;,&quot;alt&quot;:&quot;&quot;}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-62.png?fit=429%2C550&amp;ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-62.png?resize=429%2C550&#038;ssl=1" alt="" class="wp-image-15478" style="aspect-ratio:0.7799937498224382;width:389px;height:auto" srcset="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-62.png?w=429&amp;ssl=1 429w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-62.png?resize=234%2C300&amp;ssl=1 234w" sizes="auto, (max-width: 429px) 100vw, 429px" /></a></figure>
659</div>
660
661<div class="wp-block-image">
662<figure class="aligncenter size-full is-resized"><a href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-61.png?ssl=1"><img data-recalc-dims="1" loading="lazy" decoding="async" width="750" height="624" data-attachment-id="15477" data-permalink="https://textslashplain.com/2026/08/31/the-windows-security-app/image-713/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-61.png?fit=843%2C701&amp;ssl=1" data-orig-size="843,701" data-comments-opened="1" data-image-meta="{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;,&quot;alt&quot;:&quot;&quot;}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-61.png?fit=750%2C624&amp;ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-61.png?resize=750%2C624&#038;ssl=1" alt="" class="wp-image-15477" style="aspect-ratio:1.20257769212238;width:568px;height:auto" srcset="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-61.png?w=843&amp;ssl=1 843w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-61.png?resize=300%2C249&amp;ssl=1 300w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-61.png?resize=768%2C639&amp;
662ssl=1 768w" sizes="auto, (max-width: 750px) 100vw, 750px" /></a></figure>
663</div>
664
665
666<p class="wp-block-paragraph">Notably, many consumers who buy PCs from major vendors may find that they have a &#8220;time-limited trial&#8221; of a 3rd party antivirus product pre-installed on their PC, leaving Defender in passive mode. Antivirus product vendors commonly pay PC vendors for such installations as a way to acquire customers for their security product subscriptions. As mentioned, uninstalling the trial product should automatically move MDAV back into &#8220;Active&#8221; mode.</p>
667
668
669
670<h3 class="wp-block-heading">Passive Mode</h3>
671
672
673
674<p class="wp-block-paragraph">You may wonder what MDAV&#8217;s &#8220;<a href="https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-passive-mode">Passive Mode</a>&#8221; is used for&#8211; if MDAV is not providing its normal &#8220;real-time&#8221; threat protection (with active <a href="https://textslashplain.com/2024/11/18/security-software-an-overview/#:~:text=EPP%20Protection%20Components">filesystem minifilters, network monitoring</a>, etc), what is it doing?</p>
675
676
677
678<p class="wp-block-paragraph">In Passive Mode, MDAV can evaluate file trust/reputation for <a href="https://textslashplain.com/2026/04/28/smart-app-control/">Smart App Control</a>, and, for MDE onboarded devices, work with <a href="https://learn.microsoft.com/en-us/defender-endpoint/edr-in-block-mode">EDR in Block Mode</a> to provide protections against detected threats. It can also provide services to other products, like Purview DLP.</p>
679
680
681
682<p class="wp-block-paragraph">End users can also optionally enable &#8220;<a href="https://learn.microsoft.com/en-us/defender-endpoint/limited-periodic-scanning-microsoft-defender-antivirus">limited periodic scans</a>&#8221; to provide additional protections on top of their third-party product.</p>
683
684
685<div class="wp-block-image">
686<figure class="aligncenter size-full"><a href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-72.png?ssl=1"><img data-recalc-dims="1" loading="lazy" decoding="async" width="475" height="314" data-attachment-id="15539" data-permalink="https://textslashplain.com/2026/08/31/the-windows-security-app/image-725/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-72.png?fit=475%2C314&amp;ssl=1" data-orig-size="475,314" data-comments-opened="1" data-image-meta="{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;,&quot;alt&quot;:&quot;&quot;}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-72.png?fit=475%2C314&amp;ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-72.png?resize=475%2C314&#038;ssl=1" alt="" class="wp-image-15539" srcset="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-72.png?w=475&amp;ssl=1 475w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-72.png?resize=300%2C198&amp;ssl=1 300w" sizes="auto, (max-width: 475px) 100vw, 475px" /></a></figure>
687</div>
688
689
690<h2 class="wp-block-heading">Navigating the WSA Programmatically</h2>
691
692
693
694<p class="wp-block-paragraph">Individual pages of the WSA can be accessed via commands to the <code>windowsdefender://</code> <a href="https://textslashplain.com/2019/08/29/web-to-app-communication-app-protocols/">App Protocol</a>:</p>
695
696
697<div class="wp-block-code">
698	<div class="cm-editor">
699		<div class="cm-scroller">
700			
701<pre>
702<code><div class="cm-line">home, threat, quarantinehistory, threatsettings, network,</div><div class="cm-line">perfhealth, appbrowser, family, fullhistory, history,</div><div class="cm-line">accountprotection, devicesecurity, updateandquickscan,</div><div class="cm-line">
702customscan, samples, settings, protectedfolders, allowedapps,</div><div class="cm-line">allowappthroughfolder, exploitprotection, ransomwareprotection,</div><div class="cm-line">coreisolation, securityprocessor, securityprocessortroubleshooting</div></code></pre>
703		</div>
704	</div>
705</div>
706
707
708<p class="wp-block-paragraph">For example, <code>windowsdefender://appbrowser/</code> opens the App &amp; Browser control page of the app:</p>
709
710
711<div class="wp-block-image">
712<figure class="aligncenter size-full is-resized"><a href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-67.png?ssl=1"><img data-recalc-dims="1" loading="lazy" decoding="async" width="673" height="527" data-attachment-id="15489" data-permalink="https://textslashplain.com/2026/08/31/the-windows-security-app/image-719/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-67.png?fit=673%2C527&amp;ssl=1" data-orig-size="673,527" data-comments-opened="1" data-image-meta="{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;,&quot;alt&quot;:&quot;&quot;}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-67.png?fit=673%2C527&amp;ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-67.png?resize=673%2C527&#038;ssl=1" alt="" class="wp-image-15489" style="aspect-ratio:1.2770480623832539;width:453px;height:auto" srcset="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-67.png?w=673&amp;ssl=1 673w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-67.png?resize=300%2C235&amp;ssl=1 300w" sizes="auto, (max-width: 673px) 100vw, 673px" /></a></figure>
713</div>
714
715
716<h2 class="wp-block-heading">Defender for Individuals app</h2>
717
718
719
720<p class="wp-block-paragraph">Above, I mentioned that Defender does not have its own app, relying on WSA for all of its graphical user-interface. That&#8217;s generally true with the exception of the <strong>Defender for Individuals</strong> (D4I) product bundled into <a href="https://www.microsoft.com/en-us/microsoft-365/p/microsoft-365-family/cfq7ttc0k5dm">Microsoft 365 subscriptions</a> for individuals and families. When installing D4I, you get a <a href="https://apps.microsoft.com/detail/9p6pmztm93lr?hl=en-US&amp;gl=US">new app named &#8220;Microsoft Defender&#8221;</a> that exposes the additional capabilities provided by your subscription, which include a unified dashboard across multiple devices (e.g. to see your kids&#8217; PC&#8217;s status) and other features which vary per-market (e.g. identity protections and dark web scanning services).</p>
721
722
723<div class="wp-block-image">
724<figure class="aligncenter size-large is-resized"><a href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-73.png?ssl=1"><img data-recalc-dims="1" loading="lazy" decoding="async" width="750" height="423" data-attachment-id="15548" data-permalink="https://textslashplain.com/2026/08/31/the-windows-security-app/image-726/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-73.png?fit=1372%2C773&amp;ssl=1" data-orig-size="1372,773" data-comments-opened="1" data-image-meta="{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;,&quot;alt&quot;:&quot;&quot;}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-73.png?fit=750%2C423&amp;ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-73.png?resize=750%2C423&#038;ssl=1" alt="" class="wp-image-15548" style="aspect-ratio:1.7747084755403868;width:637px;height:auto" srcset="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-73.png?resize=1024%2C577&amp;ssl=1 1024w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-73.png?resize=300%2C169&amp;ssl=1 300w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-73.png?resize=768%2C433&amp;ssl=1 768w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-73.png?w=1372&amp;
724ssl=1 1372w" sizes="auto, (max-width: 750px) 100vw, 750px" /></a></figure>
725</div>
726
727
728<p class="wp-block-paragraph">Even when a D4I subscription is active, the underlying Virus and Threat Protections are provided by MDAV included in Windows. Entry points for antivirus-related activities in the D4I Microsoft Defender app ultimately navigate to the appropriate pages in the WSA.</p>
729
730
731
732<h2 class="wp-block-heading">Windows Server</h2>
733
734
735
736<p class="wp-block-paragraph">The underlying Windows Security Center APIs that would allow 3P security products to register with Windows are not present on Windows Server. Instead, if a third-party product is installed on a Windows Server being onboarded to Microsoft Defender for Endpoint, the <code>ForceDefenderPassiveMode</code> <a href="https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-passive-mode#set-the-registry-key">registry key</a> must be set explicitly to put Defender in passive mode.</p>
737
738
739
740<p class="wp-block-paragraph">On servers, Windows Security features are typically configured via PowerShell, Group Policy, the MDE Security Portal, or similar management mechanisms. For Server 2019 and later, WSA is present when the Desktop Experience Installation option is chosen. For Server 2016, it <a href="https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-antivirus-windows-server-configure#enable-the-microsoft-defender-antivirus-user-interface-on-windows-server-2016">can be enabled</a> via <code>Install-WindowsFeature -Name Windows-Defender-GUI</code>.</p>
741
742
743
744<p class="wp-block-paragraph"></p>
745
746
747
748<p class="wp-block-paragraph">Stay safe out there!</p>
749
750
751
752<p class="wp-block-paragraph">-Eric</p>
753
754
755
756<p class="wp-block-paragraph"><sup>1</sup> <em>Technically</em>, if Smart App Control is enabled, Defenders status will be:</p>
757
758
759
760<ul class="wp-block-list">
761<li>Active Mode if the Device is MDE-onboarded</li>
762
763
764
765<li><a href="https://textslashplain.com/2026/04/28/smart-app-control/#:~:text=special%20%E2%80%9CHybrid%E2%80%9D%20mode">Hybrid mode</a> if not onboarded but MDAV is the primary AV</li>
766
767
768
769<li>Passive mode if not onboarded and a 3P AV has replaced MDAV. </li>
770</ul>
771
772
773
774<p class="wp-block-paragraph">Yes, this stuff is <em>incredibly </em>subtle and intricate.</p>
775	</div><!-- .entry-content -->
776
777	<footer class="entry-footer responsive-max-width">
778		<span class="byline"><svg class="svg-icon" width="16" height="16" aria-hidden="true" role="img" focusable="false" viewBox="0 0 24 24" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><path d="M12 12c2.21 0 4-1.79 4-4s-1.79-4-4-4-4 1.79-4 4 1.79 4 4 4zm0 2c-2.67 0-8 1.34-8 4v2h16v-2c0-2.66-5.33-4-8-4z"></path><path d="M0 0h24v24H0z" fill="none"></path></svg><span class="screen-reader-text">Posted by</span><span class="author vcard"><a class="url fn n" href="https://textslashplain.com/author/ericlaw1979/">ericlaw</a></span></span><span class="posted-on"><svg class="svg-icon" width="16" height="16" aria-hidden="true" role="img" focusable="false" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><defs><path id="a" d="M0 0h24v24H0V0z"></path></defs><clipPath id="b"><use xlink:href="#a" overflow="visible"></use></clipPath><path clip-path="url(#b)" d="M12 2C6.5 2 2 6.5 2 12s4.5 10 10 10 10-4.5 10-10S17.5 2 12 2zm4.2 14.2L11 13V7h1.5v5.2l4.5 2.7-.8 1.3z"></path></svg><a href="https://textslashplain.com/2026/08/31/the-windows-security-app/" rel="bookmark"><time class="entry-date published" datetime="2026-08-31T10:50:41-05:00">2026-08-31</time><time class="updated" datetime="2026-09-03T12:57:21-05:00">2026-09-03</time></a></span><span class="cat-links"><svg class="svg-icon" width="16" height="16" aria-hidden="true" role="img" focusable="false" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M10 4H4c-1.1 0-1.99.9-1.99 2L2 18c0 1.1.9 2 2 2h16c1.1 0 2-.9 2-2V8c0-1.1-.9-2-2-2h-8l-2-2z"></path><path d="M0 0h24v24H0z" fill="none"></path></svg><span class="screen-reader-text">Posted in</span><a href="https://textslashplain.com/category/security/" rel="category tag">security</a>, <a href="https://textslashplain.com/category/tech/" rel="category tag">tech</a></span><span class="tags-links"><svg class="svg-icon" width="16" height="16" aria-hidden="true" role="img" focusable="false" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
778<path d="M21.41 11.58l-9-9C12.05 2.22 11.55 2 11 2H4c-1.1 0-2 .9-2 2v7c0 .55.22 1.05.59 1.42l9 9c.36.36.86.58 1.41.58.55 0 1.05-.22 1.41-.59l7-7c.37-.36.59-.86.59-1.41 0-.55-.23-1.06-.59-1.42zM5.5 7C4.67 7 4 6.33 4 5.5S4.67 4 5.5 4 7 4.67 7 5.5 6.33 7 5.5 7z"></path><path d="M0 0h24v24H0z" fill="none"></path></svg><span class="screen-reader-text">Tags:</span><a href="https://textslashplain.com/tag/defender/" rel="tag">Defender</a>, <a href="https://textslashplain.com/tag/security/" rel="tag">security</a>, <a href="https://textslashplain.com/tag/ui/" rel="tag">UI</a>, <a href="https://textslashplain.com/tag/windows/" rel="tag">Windows</a></span><span class="comments-link"><svg class="svg-icon" width="16" height="16" aria-hidden="true" role="img" focusable="false" viewBox="0 0 24 24" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><path d="M21.99 4c0-1.1-.89-2-1.99-2H4c-1.1 0-2 .9-2 2v12c0 1.1.9 2 2 2h14l4 4-.01-18z"></path><path d="M0 0h24v24H0z" fill="none"></path></svg><a href="https://textslashplain.com/2026/08/31/the-windows-security-app/#comments">1 Comment<span class="screen-reader-text"> on The Windows Security App</span></a></span>	</footer><!-- .entry-footer -->
779</article><!-- #post-${ID} -->
780
781<article id="post-15316" class="post-15316 post type-post status-publish format-standard hentry category-browsers category-security tag-ai tag-infosecttp tag-scam tag-security entry">
782	<header class="entry-header responsive-max-width">
783		<h2 class="entry-title"><a href="https://textslashplain.com/2026/08/12/attack-technique-ai-clones/" rel="bookmark">Attack Technique: AI Clones</a></h2>	</header><!-- .entry-header -->
784
785	
786	<div class="entry-content">
787		
788<p class="wp-block-paragraph">Attackers are adept at using new technologies to enhance their attacks. Earlier this afternoon, for example, I got call from &#8220;American Express&#8221; suggesting that I needed to &#8220;verify a transaction.&#8221; The caller used a robotic voice similar to the one used by American Express&#8217; automated systems, and only obvious signals that it was a scam were a) they didn&#8217;t have my name or card number, b) I have been using my Visa exclusively for the past few weeks, and c) I have their app, and I get push notifications from it.</p>
789
790
791
792<p class="wp-block-paragraph">Recently, there&#8217;s been some excited press about attackers abusing AI-powered &#8220;deepfake&#8221; technology to persuade users to take unsafe actions (for instance, sending money or sharing secrets) by using a trusted person&#8217;s voice or appearance to make the pitch more compelling. Attackers no longer need to limit themselves to <a href="https://textslashplain.com/2023/08/12/sms-gift-card-scams/">spoofed phone numbers or names</a>, they now can use a real-looking voice or video.</p>
793
794
795
796<p class="wp-block-paragraph">But is cloning still an advanced technique, or are we soon going to see it everywhere?</p>
797
798
799
800<h2 class="wp-block-heading">Free Voice Cloning</h2>
801
802
803
804<p class="wp-block-paragraph">The best AI models require money to use and I don&#8217;t have the time or attention span to fully explore them, but as a <a href="https://textslashplain.com/2020/02/09/demystifying-browsers/">browser lover/enthusiast</a>, I&#8217;m intrigued to look at how convincing a spoof I can do using an <strong>in-browser speech cloning</strong> tool. </p>
805
806
807
808<p class="wp-block-paragraph">Beyond being free, such a tool will allow an attacker to generate speech without calling a web service that might keep logs that could be used to catch the attacker. Behold <a href="https://soundtools.io/voice-cloning/">SoundTools.io</a>. It&#8217;s <a href="https://soundtools.io/about/#:~:text=always%20be%20free%20to%20use">free</a>, trivial to use, and is very upfront about its market position and level of quality vs. competitors:</p>
809
810
811
812<figure class="wp-block-image size-large"><a href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-57.png?ssl=1"><img data-recalc-dims="1" loading="lazy" decoding="async" width="750" height="349" data-attachment-id="15380" data-permalink="https://textslashplain.com/2026/08/12/attack-technique-ai-clones/image-704/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-57.png?fit=1223%2C569&amp;ssl=1" data-orig-size="1223,569" data-comments-opened="1" data-image-meta="{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;,&quot;alt&quot;:&quot;&quot;}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-57.png?fit=750%2C349&amp;ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-57.png?resize=750%2C349&#038;ssl=1" alt="" class="wp-image-15380" srcset="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-57.png?resize=1024%2C476&amp;ssl=1 1024w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-57.png?resize=300%2C140&amp;ssl=1 300w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-57.png?resize=768%2C357&amp;ssl=1 768w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-57.png?resize=1200%2C558&amp;ssl=1 1200w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-57.png?w=1223&amp;
812ssl=1 1223w" sizes="auto, (max-width: 750px) 100vw, 750px" /></a></figure>
813
814
815
816<p class="wp-block-paragraph">Throughout, the tool includes clear explanations of how it works:</p>
817
818
819
820<figure class="wp-block-image size-full"><a href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-54.png?ssl=1"><img data-recalc-dims="1" loading="lazy" decoding="async" width="750" height="177" data-attachment-id="15353" data-permalink="https://textslashplain.com/2026/08/12/attack-technique-ai-clones/image-701/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-54.png?fit=1015%2C240&amp;ssl=1" data-orig-size="1015,240" data-comments-opened="1" data-image-meta="{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;,&quot;alt&quot;:&quot;&quot;}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-54.png?fit=750%2C177&amp;ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-54.png?resize=750%2C177&#038;ssl=1" alt="" class="wp-image-15353" srcset="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-54.png?w=1015&amp;ssl=1 1015w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-54.png?resize=300%2C71&amp;ssl=1 300w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-54.png?resize=768%2C182&amp;ssl=1 768w" sizes="auto, (max-width: 750px) 100vw, 750px" /></a></figure>
821
822
823
824<p class="wp-block-paragraph">To use it, you can either feed it previously recorded audio, or (preferably) a live recording of a paragraph of text:</p>
825
826
827<div class="wp-block-image">
828<figure class="aligncenter size-full is-resized"><a href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-50.png?ssl=1"><img data-recalc-dims="1" loading="lazy" decoding="async" width="750" height="318" data-attachment-id="15333" data-permalink="https://textslashplain.com/2026/08/12/attack-technique-ai-clones/image-697/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-50.png?fit=1020%2C433&amp;ssl=1" data-orig-size="1020,433" data-comments-opened="1" data-image-meta="{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;,&quot;alt&quot;:&quot;&quot;}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-50.png?fit=750%2C318&amp;ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-50.png?resize=750%2C318&#038;ssl=1" alt="" class="wp-image-15333" style="aspect-ratio:2.355669859846161;width:598px;height:auto" srcset="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-50.png?w=1020&amp;ssl=1 1020w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-50.png?resize=300%2C127&amp;ssl=1 300w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-50.png?resize=768%2C326&amp;ssl=1 768w" sizes="auto, (max-width: 750px) 100vw, 750px" /></a></figure>
829</div>
830
831
832<p class="wp-block-paragraph">After collecting the audio sample, the page downloads several large models (just over a gigabyte, cached for later use), to generate a cloned voice. It then allows the user to provide text that should be read aloud, and a desired quality level (lower-quality reproduction is faster):</p>
833
834
835<div class="wp-block-image">
836<figure class="aligncenter size-full is-resized"><a href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-52.png?ssl=1"><img data-recalc-dims="1" loading="lazy" decoding="async" width="750" height="537" data-attachment-id="15339" data-permalink="https://textslashplain.com/2026/08/12/attack-technique-ai-clones/image-699/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-52.png?fit=938%2C671&amp;ssl=1" data-orig-size="938,671" data-comments-opened="1" data-image-meta="{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;,&quot;alt&quot;:&quot;&quot;}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-52.png?fit=750%2C537&amp;ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-52.png?resize=750%2C537&#038;ssl=1" alt="" class="wp-image-15339" style="aspect-ratio:1.3979388949564535;width:604px;
836height:auto" srcset="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-52.png?w=938&amp;ssl=1 938w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-52.png?resize=300%2C215&amp;ssl=1 300w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-52.png?resize=768%2C549&amp;ssl=1 768w" sizes="auto, (max-width: 750px) 100vw, 750px" /></a></figure>
837</div>
838
839
840<p class="wp-block-paragraph">The time required depends on the quality chosen and the performance of the browser on your device. In my quick test, the &#8220;High quality&#8221; level, which requires 60 to 150 seconds per sentence, seems to generate pretty good results. <em>If it&#8217;s enabled, you&#8217;ll definitely want to turn off Edge&#8217;s &#8220;Enhanced Security Mode&#8221; for this site because its WebAssembly runs much more slowly in interpreted mode.</em> <em>The site makes heavy use of the system GPU:</em></p>
841
842
843<div class="wp-block-image">
844<figure class="aligncenter size-full is-resized"><a href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-59.png?ssl=1"><img data-recalc-dims="1" loading="lazy" decoding="async" width="750" height="582" data-attachment-id="15443" data-permalink="https://textslashplain.com/2026/08/12/attack-technique-ai-clones/image-711/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-59.png?fit=883%2C685&amp;ssl=1" data-orig-size="883,685" data-comments-opened="1" data-image-meta="{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;,&quot;alt&quot;:&quot;&quot;}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-59.png?fit=750%2C582&amp;ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-59.png?resize=750%2C582&#038;ssl=1" alt="" class="wp-image-15443" style="aspect-ratio:1.2890639122014202;width:555px;height:auto" srcset="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-59.png?w=883&amp;ssl=1 883w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-59.png?resize=300%2C233&amp;ssl=1 300w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-59.png?resize=768%2C596&amp;ssl=1 768w" sizes="auto, (max-width: 750px) 100vw, 750px" /></a></figure>
845</div>
846
847
848<p class="wp-block-paragraph"><em>&#8230;and surprisingly to me, <a href="https://bsky.app/profile/ericlawrence.com/post/3msxrv65uc22j">doesn&#8217;t seem to work</a> on Windows ARM devices like Surface Laptop 7.</em></p>
849
850
851
852<p class="wp-block-paragraph">Finally, when the generation completes, the recording is available to play or download. </p>
853
854
855<div class="wp-block-image">
856<figure class="aligncenter size-full is-resized"><a href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-51.png?ssl=1"><img data-recalc-dims="1" loading="lazy" decoding="async" width="750" height="663" data-attachment-id="15336" data-permalink="https://textslashplain.com/2026/08/12/attack-technique-ai-clones/image-698/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-51.png?fit=802%2C709&amp;ssl=1" data-orig-size="802,709" data-comments-opened="1" data-image-meta="{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;,&quot;alt&quot;:&quot;&quot;}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-51.png?fit=750%2C663&amp;ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-51.png?resize=750%2C663&#038;ssl=1" alt="" class="wp-image-15336" style="aspect-ratio:1.1311806027645592;width:603px;height:auto" srcset="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-51.png?w=802&amp;ssl=1 802w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-51.png?resize=300%2C265&amp;ssl=1 300w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-51.png?resize=768%2C679&amp;
856ssl=1 768w" sizes="auto, (max-width: 750px) 100vw, 750px" /></a></figure>
857</div>
858
859
860<p class="wp-block-paragraph">Folks who have heard me speak would probably agree that the results are pretty plausible. While <a href="https://www.ericlawrence.com/dl/CodeMash2015-LuckingIn-64kbps.mp3">my real voice</a> has more &#8220;ums&#8221;, &#8220;uhs&#8221;, variable pauses, and animation, careful preparation of the source text would yield even more compelling output. (<em>For example, the web app doesn&#8217;t currently handle &#8220;smart quotes&#8221; properly, voicing contractions like &#8220;Can’t&#8221; as &#8220;Can Tee&#8221;.</em>) </p>
861
862
863
864<p class="wp-block-paragraph">High Quality example (text from <a href="https://textslashplain.com/2026/08/05/fiddler-in-2026/#:~:text=Fiddler%20Book.-,First%2C%20a%20confession,-%E2%80%94the%20Fiddler%20Web">this post</a>):</p>
865
866
867
868<figure class="wp-block-audio"><audio controls src="https://textslashplain.com/wp-content/uploads/2026/08/HighQuality-48.mp3"></audio></figure>
869
870
871
872<p class="wp-block-paragraph">Ultra Quality example (text from <a href="https://textslashplain.com/2020/11/16/objectively-the-best-cat/">this post</a>):</p>
873
874
875
876<figure class="wp-block-audio"><audio controls src="https://textslashplain.com/wp-content/uploads/2026/08/UltraQuality-64.mp3"></audio></figure>
877
878
879
880<p class="wp-block-paragraph">Both of these are pretty solid, and attackers who worry about the quality of the clone would also likely simulate the speaker being in a noisy environment or suffering from a poor phone signal.</p>
881
882
883
884<h2 class="wp-block-heading">Not just voice, obviously</h2>
885
886
887
888<p class="wp-block-paragraph">Don&#8217;t even get me started about how trivial <a href="https://photoeditorai.io/">photo editing</a> has gotten:</p>
889
890
891<div class="wp-block-image">
892<figure class="aligncenter size-large is-resized"><a href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-53.png?ssl=1"><img data-recalc-dims="1" loading="lazy" decoding="async" width="750" height="498" data-attachment-id="15348" data-permalink="https://textslashplain.com/2026/08/12/attack-technique-ai-clones/image-700/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-53.png?fit=2312%2C1536&amp;ssl=1" data-orig-size="2312,1536" data-comments-opened="1" data-image-meta="{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;,&quot;alt&quot;:&quot;&quot;}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-53.png?fit=750%2C498&amp;ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-53.png?resize=750%2C498&#038;ssl=1" alt="" class="wp-image-15348" style="aspect-ratio:1.505897613804338;width:520px;height:auto" srcset="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-53.png?resize=1024%2C680&amp;ssl=1 1024w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-53.png?resize=300%2C199&amp;ssl=1 300w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-53.png?resize=768%2C510&amp;ssl=1 768w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-53.png?resize=1536%2C1020&amp;ssl=1 1536w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-53.png?resize=2048%2C1361&amp;ssl=1 2048w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-53.png?resize=1200%2C797&amp;ssl=1 1200w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-53.png?resize=1568%2C1042&amp;ssl=1 1568w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-53.png?w=2250&amp;ssl=1 2250w" sizes="auto, (max-width: 750px) 100vw, 750px" /></a><figcaption class="wp-element-caption">Dating profiles where guys hold a giant fish will never be believable again 🤣</figcaption></figure>
893</div>
894
895<div class="wp-block-image">
896<figure class="aligncenter size-large is-resized"><a href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-56.png?ssl=1"><img data-recalc-dims="1" loading="lazy" decoding="async" width="750" height="849" data-attachment-id="15365" data-permalink="https://textslashplain.com/2026/08/12/attack-technique-ai-clones/image-703/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-56.png?fit=1405%2C1590&amp;ssl=1" data-orig-size="1405,1590" data-comments-opened="1" data-image-meta="{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;,&quot;alt&quot;:&quot;&quot;}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-56.png?fit=750%2C849&amp;ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-56.png?resize=750%2C849&#038;ssl=1" alt="" class="wp-image-15365" style="aspect-ratio:0.8837880424198431;width:528px;height:auto" srcset="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-56.png?resize=905%2C1024&amp;ssl=1 905w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-56.png?resize=265%2C300&amp;ssl=1 265w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-56.png?resize=768%2C869&amp;ssl=1 768w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-56.png?resize=1357%2C1536&amp;ssl=1 1357w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-56.png?resize=1200%2C1358&amp;ssl=1 1200w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-56.png?w=1405&amp;
896ssl=1 1405w" sizes="auto, (max-width: 750px) 100vw, 750px" /></a><figcaption class="wp-element-caption">Running with my buddy</figcaption></figure>
897</div>
898
899
900<p class="wp-block-paragraph">Even today&#8217;s high schools can afford to generate <a href="https://www.youtube.com/watch?v=WDgzL8Z3SfM">sizzle videos</a> for marching bands that would&#8217;ve cost millions of dollars to render when <em>I</em> was high school.</p>
901
902
903
904<p class="wp-block-paragraph"><strong>Exciting </strong>stuff! But <strong>scary </strong>in the hands of bad guys. I don&#8217;t even know what to suggest folks do to stay safe, other than <strong><a href="https://textslashplain.com/2023/10/16/security-the-impact-of-time/#:~:text=fast%2Dmoving%20attackers.-,The%20Human%20Factor,-Many%20forms%20of">slow down and think</a></strong>, be extra skeptical of situations where someone unexpectedly contacts <em>you</em>, and be cautious of all non-in-person interactions, <em>especially </em>when it&#8217;s not a real-time conversation (which <a href="https://www.youtube.com/playlist?list=PLxgMOEESA8vgmkkQM_jsD94AZfH9Ve2Vd">can <em>still </em>be faked</a>, but it&#8217;s harder). </p>
905
906
907
908<p class="wp-block-paragraph">For years, it&#8217;s been easy to <a href="https://textslashplain.com/2025/04/24/attack-techniques-fake-literally-everything/">fake an entire company</a>, but today it&#8217;s not too hard to shallowly fake a family member or close friend. Perhaps in the future, we will all share a <a href="https://en.wikipedia.org/wiki/Shibboleth">Shibboleth</a> with close friends, or demand out-of-band confirmations of all requests?</p>
909
910
911
912<p class="wp-block-paragraph">Stay safe out there, and <strong>don&#8217;t believe everything you hear, or see</strong>!</p>
913
914
915
916<p class="wp-block-paragraph">-Eric</p>
917	</div><!-- .entry-content -->
918
919	<footer class="entry-footer responsive-max-width">
920		<span class="byline"><svg class="svg-icon" width="16" height="16" aria-hidden="true" role="img" focusable="false" viewBox="0 0 24 24" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><path d="M12 12c2.21 0 4-1.79 4-4s-1.79-4-4-4-4 1.79-4 4 1.79 4 4 4zm0 2c-2.67 0-8 1.34-8 4v2h16v-2c0-2.66-5.33-4-8-4z"></path><path d="M0 0h24v24H0z" fill="none"></path></svg><span class="screen-reader-text">Posted by</span><span class="author vcard"><a class="url fn n" href="https://textslashplain.com/author/ericlaw1979/">ericlaw</a></span></span><span class="posted-on"><svg class="svg-icon" width="16" height="16" aria-hidden="true" role="img" focusable="false" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><defs><path id="a" d="M0 0h24v24H0V0z"></path></defs><clipPath id="b"><use xlink:href="#a" overflow="visible"></use></clipPath><path clip-path="url(#b)" d="M12 2C6.5 2 2 6.5 2 12s4.5 10 10 10 10-4.5 10-10S17.5 2 12 2zm4.2 14.2L11 13V7h1.5v5.2l4.5 2.7-.8 1.3z"></path></svg><a href="https://textslashplain.com/2026/08/12/attack-technique-ai-clones/" rel="bookmark"><time class="entry-date published" datetime="2026-08-12T18:08:07-05:00">2026-08-12</time><time class="updated" datetime="2026-08-18T16:17:26-05:00">2026-08-18</time></a></span><span class="cat-links"><svg class="svg-icon" width="16" height="16" aria-hidden="true" role="img" focusable="false" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M10 4H4c-1.1 0-1.99.9-1.99 2L2 18c0 1.1.9 2 2 2h16c1.1 0 2-.9 2-2V8c0-1.1-.9-2-2-2h-8l-2-2z"></path><path d="M0 0h24v24H0z" fill="none"></path></svg><span class="screen-reader-text">Posted in</span><a href="https://textslashplain.com/category/browsers/" rel="category tag">browsers</a>, <a href="https://textslashplain.com/category/security/" rel="category tag">security</a></span><span class="tags-links"><svg class="svg-icon" width="16" height="16" aria-hidden="true" role="img" focusable="false" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M21.41 11.58l-9-9C12.05 2.22 11.55 2 11 2H4c-1.1 0-2 .9-2 2v7c0 .55.22 1.05.59 1.42l9 9c.36.36.86.58 1.41.58.55 0 1.05-.22 1.41-.59l7-7c.37-.36.59-.86.59-1.41 0-.55-.23-1.06-.59-1.42zM5.5 7C4.67 7 4 6.33 4 5.5S4.67 4 5.5 4 7 4.67 7 5.5 6.33 7 5.5 7z"></path><path d="M0 0h24v24H0z" fill="none"></path></svg><span class="screen-reader-text">Tags:</span><a href="https://textslashplain.com/tag/ai/" rel="tag">AI</a>, <a href="https://textslashplain.com/tag/infosecttp/" rel="tag">InfoSecTTP</a>, <a href="https://textslashplain.com/tag/scam/" rel="tag">scam</a>, <a href="https://textslashplain.com/tag/security/" rel="tag">security</a></span><span class="comments-link"><svg class="svg-icon" width="16" height="16" aria-hidden="true" role="img" focusable="false" viewBox="0 0 24 24" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><path d="M21.99 4c0-1.1-.89-2-1.99-2H4c-1.1 0-2 .9-2 2v12c0 1.1.9 2 2 2h14l4 4-.01-18z"></path><path d="M0 0h24v24H0z" fill="none"></path></svg><a href="https://textslashplain.com/2026/08/12/attack-technique-ai-clones/#respond">Leave a comment<span class="screen-reader-text"> on Attack Technique: AI Clones</span></a></span>	</footer><!-- .entry-footer -->
921</article><!-- #post-${ID} -->
922
923<article id="post-15003" class="post-15003 post type-post status-publish format-standard hentry category-fiddler-2 category-life category-storytelling entry">
924	<header class="entry-header responsive-max-width">
925		<h2 class="entry-title"><a href="https://textslashplain.com/2026/08/05/fiddler-in-2026/" rel="bookmark">Fiddler in 2026</a></h2>	</header><!-- .entry-header -->
926
927	
928	<div class="entry-content">
929		
930<p class="wp-block-paragraph">I&#8217;ve shared the stories behind the Fiddler Web Debugger a fair bit over the years, in the <a href="https://fiddlerbook.com/">Fiddler Book</a>, in <a href="https://github.com/ericlaw1979/CodeMash2015/tree/master/LuckingIn">a talk</a> at the CodeMash conference in 2015, and <a href="https://textslashplain.com/2024/11/24/fiddler-my-mistakes/">on this blog</a>. It features prominently in my <a href="https://bluebadgebook.com/bbb/">to-be-completed (some day?) memoir</a>, and I&#8217;ve enjoyed telling Fiddler stories to folks who ask over the years. (I&#8217;ve also written a ton of content about <a href="https://textslashplain.com/category/fiddler-2/"><em>using </em>Fiddler</a>.) </p>
931
932
933
934<p class="wp-block-paragraph">Over two decades, what was once a little side project came to influence a very meaningful percentage of my life, including where I live today and so many of my life&#8217;s experiences.</p>
935
936
937<div class="wp-block-image">
938<figure class="aligncenter size-full"><a href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-45.png?ssl=1"><img data-recalc-dims="1" loading="lazy" decoding="async" width="299" height="268" data-attachment-id="15162" data-permalink="https://textslashplain.com/2026/08/05/fiddler-in-2026/image-688/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-45.png?fit=299%2C268&amp;ssl=1" data-orig-size="299,268" data-comments-opened="1" data-image-meta="{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;,&quot;alt&quot;:&quot;&quot;}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-45.png?fit=299%2C268&amp;ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-45.png?resize=299%2C268&#038;ssl=1" alt="" class="wp-image-15162"/></a><figcaption class="wp-element-caption">Receiving the Engineering Excellence Award for Fiddler, circa 2007</figcaption></figure>
939</div>
940
941
942<p class="wp-block-paragraph">On Monday morning, I got a ping from someone from Progress Software, acquirers of Telerik in 2014, after Telerik acquired Fiddler (and for a few years, me) back in 2012. They asked for an email address to which they could send a note.</p>
943
944
945
946<p class="wp-block-paragraph">&#8220;<em>This isn&#8217;t gonna be good</em>&#8220;, I assumed. Correctly. </p>
947
948
949
950<p class="wp-block-paragraph">After I <a href="https://textslashplain.com/2015/12/23/my-next-adventure/">left Telerik for Google in 2016</a>, development on the &#8220;Fiddler Classic&#8221; application had stagnated as the owners put their investments into a series of products they could monetize. </p>
951
952
953
954<p class="wp-block-paragraph">
954To be fair, this pivot was not unexpected. Initially, Telerik had purchased Fiddler largely for the community attention: the tool had a huge userbase of the exact developers the company was courting. Still, we always expected that eventually we&#8217;d have a <em>cross-platform</em> version of the product (a highly-requested improvement), and <em>that</em> non-Windows version could be sold like Telerik&#8217;s other professional tools.</p>
955
956
957
958<h3 class="wp-block-heading">Fiddler: Free Forever?</h3>
959
960
961
962<p class="wp-block-paragraph">Telerik had loudly promised that Fiddler would remain &#8220;free forever&#8221; to avoid expected <a href="https://weblog.west-wind.com/posts/2011/Mar/19/The-Red-Gate-and-NET-Reflector-Debacle">community outrage</a> about commercializing a previously-free tool. <em>Before Telerik, I had spoken to one potential acquirer who estimated the brand damage of their commercializing another previously-free tool at 25x their acquisition price, meaning they&#8217;d likely never turn a profit on it.</em></p>
963
964
965
966<p class="wp-block-paragraph">Telerik&#8217;s blog post announcing the change was explicit:</p>
967
968
969
970<figure class="wp-block-image size-full"><a href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-42.png?ssl=1"><img data-recalc-dims="1" loading="lazy" decoding="async" width="750" height="250" data-attachment-id="15132" data-permalink="https://textslashplain.com/2026/08/05/fiddler-in-2026/image-685/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-42.png?fit=874%2C291&amp;ssl=1" data-orig-size="874,291" data-comments-opened="1" data-image-meta="{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;,&quot;alt&quot;:&quot;&quot;}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-42.png?fit=750%2C250&amp;ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-42.png?resize=750%2C250&#038;ssl=1" alt="" class="wp-image-15132" srcset="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-42.png?w=874&amp;ssl=1 874w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-42.png?resize=300%2C100&amp;ssl=1 300w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-42.png?resize=768%2C256&amp;ssl=1 768w" sizes="auto, (max-width: 750px) 100vw, 750px" /></a></figure>
971
972
973
974<p class="wp-block-paragraph">&#8230; but even that wasn&#8217;t enough, so a follow-up post was made shortly after:</p>
975
976
977
978<figure class="wp-block-image size-full"><a href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-43.png?ssl=1"><img data-recalc-dims="1" loading="lazy" decoding="async" width="750" height="327" data-attachment-id="15134" data-permalink="https://textslashplain.com/2026/08/05/fiddler-in-2026/image-686/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-43.png?fit=868%2C378&amp;ssl=1" data-orig-size="868,378" data-comments-opened="1" data-image-meta="{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;,&quot;alt&quot;:&quot;&quot;}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-43.png?fit=750%2C327&amp;ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-43.png?resize=750%2C327&#038;ssl=1" alt="" class="wp-image-15134" srcset="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-43.png?w=868&amp;ssl=1 868w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-43.png?resize=300%2C131&amp;ssl=1 300w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-43.png?resize=768%2C334&amp;
978ssl=1 768w" sizes="auto, (max-width: 750px) 100vw, 750px" /></a></figure>
979
980
981
982<p class="wp-block-paragraph">The unambiguous clarity of this promise had meant that improving the &#8220;Fiddler Business&#8221; meant we&#8217;d need to: 1) monetize the technology behind Fiddler (we had several solid ideas), or 2) pivot to a new cross-platform product they could sell, or 3) renege on their promise and start charging for Fiddler for Windows, or 4) use Fiddler to showcase (and juice sales of) Telerik&#8217;s .NET component products.</p>
983
984
985
986<p class="wp-block-paragraph">While I was at Telerik, I worked a little on #1 &#8212; we created a licensable version of FiddlerCore, the core engine inside Fiddler, with the idea that other companies could sell products based on it. Telerik had used FiddlerCore inside their <a href="https://www.telerik.com/teststudio">Test Studio</a> product (that&#8217;s how I came to their attention to start with), and we assumed that other companies might want similar technology. Interest was&#8230; not very high&#8230; in part because we made little effort to evangelize, and partly because the license price would limit it to larger companies.</p>
987
988
989
990<p class="wp-block-paragraph">Very frustratingly and humiliatingly, my once-and-future employer wanted to use FiddlerCore inside their <a href="https://en.wikipedia.org/wiki/Microsoft_Network_Monitor">Message Analyzer</a> product. <em>But Microsoft didn&#8217;t want to pay the license fee</em>. So instead, the software juggernaut worth hundreds of billions of dollars wrote code to <em>prompt their end-users to </em>pirate <em>FiddlerCore</em>:</p>
991
992
993<div class="wp-block-image">
994<figure class="aligncenter size-full is-resized"><a href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-44.png?ssl=1"><img data-recalc-dims="1" loading="lazy" decoding="async" width="400" height="184" data-attachment-id="15139" data-permalink="https://textslashplain.com/2026/08/05/fiddler-in-2026/image-687/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-44.png?fit=400%2C184&amp;ssl=1" data-orig-size="400,184" data-comments-opened="1" data-image-meta="{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;,&quot;alt&quot;:&quot;&quot;}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-44.png?fit=400%2C184&amp;ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-44.png?resize=400%2C184&#038;ssl=1" alt="" class="wp-image-15139" style="width:530px;height:auto" srcset="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-44.png?w=400&amp;ssl=1 400w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-44.png?resize=300%2C138&amp;ssl=1 300w" sizes="auto, (max-width: 400px) 100vw, 400px" /></a></figure>
995</div>
996
997
998<p class="wp-block-paragraph">This is the sort of behavior then most often seen from shady apps trying to avoid paying MP3 patent fees. To this day, I remain <em>shocked</em> that the lawyers from both companies allowed this experience to ship. (<em>The fact that Microsoft-ecosystem developers made up virtually all of Telerik&#8217;s customers probably had something to do with Telerik not suing)</em>.</p>
999
1000
1001
1002<p class="wp-block-paragraph">Days after I started at Telerik, I started work on strategy #2 (build a cross-platform version). I spent months trying to get Fiddler running on <a href="https://en.wikipedia.org/wiki/Mono_(software)">Mono</a>, an early cross-platform version of the .NET Framework that ran on Mac and Linux. It didn&#8217;t go great. I built a <em>serviceable </em>version for Linux, but the UI port for MacOS would crash constantly. A hybrid strategy, using Mono for FiddlerCore, and building a new front-end on Electron, seemed like a plausible path forward. Alas, this vision was put on pause in 2014 after Telerik conducted broad US-based layoffs in advance of an expected IPO on the US stock market. After its aborted IPO and subsequent acquisition by <a href="https://en.wikipedia.org/wiki/Progress_Software">Progress Software</a>, Telerik eventually restarted this strategy, eventually shipping <a href="https://www.telerik.com/fiddler/fiddler-everywhere">Fiddler Everywhere</a>. Fiddler Everywhere offered several key advantages over the Windows-only Fiddler Classic (cross platform! some team features!) but it also had many shortcomings (fewer features, no extensibility model).</p>
1003
1004
1005
1006<p class="wp-block-paragraph">I&#8217;d hoped that Progress/Telerik might open-source Fiddler Classic at some point in order to grow the <em>ecosystem</em>&#8212; things like the Fiddler SAZ format would get even more popular and create the possibility of monetizable synergies. Alas, this never happened. Instead, Fiddler Classic just quietly <em>decayed</em>. As browsers adopted new standards (e.g. http2, h3, GREASE, tls1.3, <code>zstd</code> content compression), Fiddler Classic required more and more caveats and workarounds for continued use. However, Fiddler&#8217;s rich extensibility model means that I could keep <a href="https://textslashplain.com/2025/05/16/fiddler-in-2025/">building new capabilities</a> <a href="https://gist.github.com/ericlaw1979">in</a> <a href="https://textslashplain.com/2022/01/08/debug-native-messaging/">and on</a> Fiddler in the ten years since I lost the ability to commit updates to Fiddler&#8217;s source directly.</p>
1007
1008
1009
1010<p class="wp-block-paragraph">I still use Fiddler on Windows almost every single day, but in many cases I&#8217;m not even using Fiddler to <em>capture </em>traffic anymore, instead just using it as a viewer for traffic <a href="https://textslashplain.com/2020/04/08/analyzing-network-traffic-logs-netlog-json/">captured natively by Chromium</a>, or to use its TextEncoder and Inspectors, or even as a <a href="https://textslashplain.com/2022/01/08/debug-native-messaging/#:~:text=Tampering%20with%20Messages">frontend for other tools</a>.</p>
1011
1012
1013
1014<p class="wp-block-paragraph">Progress added a pre-download survey to collect user emails (<em>annoying!</em>) and periodically added surveys and advertisements directly inside the Fiddler Classic UI. But even if those were sometimes gratingly <a href="https://textslashplain.com/2025/05/16/fiddler-in-2025/#:~:text=Add%20a%20SingleBrowserMode%20button%20to%20Fiddler%E2%80%99s%20toolbar">misleading</a>, they weren&#8217;t <em>too </em>annoying.</p>
1015
1016
1017<div class="wp-block-image">
1018<figure class="aligncenter size-full"><a href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-48.png?ssl=1"><img data-recalc-dims="1" loading="lazy" decoding="async" width="391" height="159" data-attachment-id="15233" data-permalink="https://textslashplain.com/2026/08/05/fiddler-in-2026/image-691/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-48.png?fit=391%2C159&amp;ssl=1" data-orig-size="391,159" data-comments-opened="1" data-image-meta="{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;,&quot;alt&quot;:&quot;&quot;}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-48.png?fit=391%2C159&amp;ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-48.png?resize=391%2C159&#038;ssl=1" alt="" class="wp-image-15233" srcset="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-48.png?w=391&amp;ssl=1 391w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-48.png?resize=300%2C122&amp;
1018ssl=1 300w" sizes="auto, (max-width: 391px) 100vw, 391px" /></a></figure>
1019</div>
1020
1021
1022<p class="wp-block-paragraph">Other changes of <a href="https://textslashplain.com/2025/03/31/runtime-signature-checking-threat-model/">dubious value</a> were also only mildly annoying.</p>
1023
1024
1025
1026<h2 class="wp-block-heading">This Week&#8217;s Rug Pull</h2>
1027
1028
1029
1030<p class="wp-block-paragraph">Opening Fiddler on Monday, I was presented with a Fiddler Update announcement, including some neat improvements, particularly support for <code>ZSTD</code> decompression (obsoleting my <a href="https://textslashplain.com/2025/05/16/fiddler-in-2025/#:~:text=this%20decades%20ago.-,Disable%20ZSTD,-ZStandard%20is%20a">workaround</a>):</p>
1031
1032
1033<div class="wp-block-image">
1034<figure class="aligncenter size-full"><a href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-30.png?ssl=1"><img data-recalc-dims="1" loading="lazy" decoding="async" width="658" height="270" data-attachment-id="15026" data-permalink="https://textslashplain.com/2026/08/05/fiddler-in-2026/image-673/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-30.png?fit=658%2C270&amp;ssl=1" data-orig-size="658,270" data-comments-opened="1" data-image-meta="{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;,&quot;alt&quot;:&quot;&quot;}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-30.png?fit=658%2C270&amp;ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-30.png?resize=658%2C270&#038;ssl=1" alt="" class="wp-image-15026" srcset="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-30.png?w=658&amp;ssl=1 658w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-30.png?resize=300%2C123&amp;ssl=1 300w" sizes="auto, (max-width: 658px) 100vw, 658px" /></a></figure>
1035</div>
1036
1037
1038<p class="wp-block-paragraph">However, I didn&#8217;t accept the update straight away because I suspected something was afoot. (I <em>also</em> got distracted because Windows <a href="https://textslashplain.com/2026/08/03/authenticode-and-uac/#:~:text=Surprise%20%232%20%E2%80%93%20Chain%20Building">complained about the installer&#8217;s signature</a>).</p>
1039
1040
1041
1042<p class="wp-block-paragraph">Sure enough, the first screen of the installer mentions another <strong>IMPORTANT </strong>change in Fiddler that was not mentioned in that shiny update announcement:</p>
1043
1044
1045<div class="wp-block-image">
1046<figure class="aligncenter size-full"><a href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-31.png?ssl=1"><img data-recalc-dims="1" loading="lazy" decoding="async" width="422" height="290" data-attachment-id="15028" data-permalink="https://textslashplain.com/2026/08/05/fiddler-in-2026/image-674/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-31.png?fit=422%2C290&amp;ssl=1" data-orig-size="422,290" data-comments-opened="1" data-image-meta="{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;,&quot;alt&quot;:&quot;&quot;}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-31.png?fit=422%2C290&amp;ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-31.png?resize=422%2C290&#038;ssl=1" alt="" class="wp-image-15028" srcset="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-31.png?w=422&amp;ssl=1 422w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-31.png?resize=300%2C206&amp;ssl=1 300w" sizes="auto, (max-width: 422px) 100vw, 422px" /></a></figure>
1047</div>
1048
1049
1050<p class="wp-block-paragraph"><strong>Progress Telerik has decided to start demanding Fiddler Classic not be used for &#8220;<a href="https://www.telerik.com/fiddler/fiddler-classic/commercial-use">commercial</a>&#8221; purposes</strong>. Beyond the new text in the <a href="https://www.telerik.com/purchase/license-agreement/fiddler">
1050license</a>, Fiddler shows this big orange bar:</p>
1051
1052
1053
1054<figure class="wp-block-image size-large"><a href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-28.png?ssl=1"><img data-recalc-dims="1" loading="lazy" decoding="async" width="750" height="54" data-attachment-id="15019" data-permalink="https://textslashplain.com/2026/08/05/fiddler-in-2026/image-671/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-28.png?fit=1286%2C93&amp;ssl=1" data-orig-size="1286,93" data-comments-opened="1" data-image-meta="{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;,&quot;alt&quot;:&quot;&quot;}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-28.png?fit=750%2C54&amp;ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-28.png?resize=750%2C54&#038;ssl=1" alt="" class="wp-image-15019" srcset="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-28.png?resize=1024%2C74&amp;ssl=1 1024w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-28.png?resize=300%2C22&amp;ssl=1 300w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-28.png?resize=768%2C56&amp;ssl=1 768w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-28.png?resize=1200%2C87&amp;ssl=1 1200w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-28.png?w=1286&amp;ssl=1 1286w" sizes="auto, (max-width: 750px) 100vw, 750px" /></a></figure>
1055
1056
1057
1058<p class="wp-block-paragraph">So&#8230; it appears that the owners of Fiddler have reneged on their promise to the community and the product is no longer free.</p>
1059
1060
1061
1062<h2 class="wp-block-heading">Dialogue with Progress/Telerik</h2>
1063
1064
1065
1066<p class="wp-block-paragraph">Taken literally, the license agreement says <strong>you cannot use Fiddler Classic for commercial purposes, even if you pay!</strong> This is rather shocking, because it means that Fiddler&#8217;s most engaged users, who&#8217;ve built extensions and workflows around Fiddler, cannot use them, even if they&#8217;re willing to pay up. Such a position seems so wildly foolish that I<em> assumed </em>it must just be an oversight. I inquired, and Progress Telerik provided the following statement:</p>
1067
1068
1069
1070<blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow">
1071<p class="wp-block-paragraph">No, Progress is not planning to offer Fiddler Classic under a paid licence.&nbsp;</p>
1072
1073
1074
1075<p class="wp-block-paragraph">We recognise the important role Fiddler Classic has played in supporting developers&#8217; debugging workflows over many years. Continuing to invest in the product at the level required for commercial and enterprise customers, including ongoing feature development and platform modernisation, is not aligned with our long-term product strategy.&nbsp; Accordingly, in recent years, Progress has focused on maintaining and supporting Fiddler Classic, while directing its development efforts towards Fiddler Everywhere. &nbsp;</p>
1076
1077
1078
1079<p class="wp-block-paragraph">That said, we recognise the value of the extensibility capabilities available in Fiddler Classic. As a result, we will continue to work on scripting functionality in Fiddler Everywhere to help users continue their existing workflows with minimal disruption. We will also continue to evaluate additional feature requests based on customer needs and use cases. As always, we remain open to feedback and are committed to understanding how we can best support our users.&nbsp;</p>
1080</blockquote>
1081
1082
1083
1084<p class="wp-block-paragraph">Improved scripting functionality may satisfy <em>some </em>users, but it definitely will not encompass the wide range of scenarios enjoyed by Fiddler Classic today, especially for users who&#8217;ve built custom Inspectors, Transcoders, or other extensions that integrate Fiddler with other systems and processes used within their companies.</p>
1085
1086
1087
1088<p class="wp-block-paragraph">In a closing paragraph of their response, the Progress/Telerik product manager (or, more likely, their lawyer) appears to have attempted to suggest that I shouldn&#8217;t share my thoughts with you fine folks (emphasis mine):</p>
1089
1090
1091
1092<blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow">
1093<p class="wp-block-paragraph">
1093Last but not at least, no person outside Progress is authorized to make announcements, <strong>provide comments</strong>, or respond to customers’ inquiries regarding Progress’ business on behalf of the company. All questions should be directed to Progress’ official communication channels [email protected].&nbsp;</p>
1094</blockquote>
1095
1096
1097
1098<p class="wp-block-paragraph">Needless to say, I don&#8217;t speak <em>on behalf of</em> my former employer, but they&#8217;re also not going to stop me from talking about this change.</p>
1099
1100
1101
1102<h2 class="wp-block-heading">My Feelings</h2>
1103
1104
1105
1106<p class="wp-block-paragraph">Some folks have asked how I feel about this. In short, <strong><em>disappointed, somewhat betrayed, but ultimately not surprised</em></strong>. Fiddler for Windows is a powerful tool that provides a tremendous amount of value to its users, and the nature of short-term profit maximization is that companies with valuable assets often struggle to recognize the long-term value of not abusing their users.</p>
1107
1108
1109
1110<p class="wp-block-paragraph">As I talked about previously in my post about mistakes I made when building Fiddler, my <a href="https://textslashplain.com/2024/11/24/fiddler-my-mistakes/#:~:text=a%20billion%20dollars%3F-,Monetization,-As%20Fiddler%20usage">lack of a monetization plan</a> was a key shortcoming in the product&#8217;s strategy. When Telerik acquired Fiddler, I assumed that the business folks there would develop a strategy beyond &#8220;monetizing the eyeballs&#8221; of the tens of thousands of weekly downloaders (although it was a bargain for that traffic acquisition alone).</p>
1111
1112
1113
1114<p class="wp-block-paragraph">As I&#8217;ve described above, development of a monetizable product strategy never got any real attention. Meanwhile, the team over at <a href="https://en.wikipedia.org/wiki/Postman,_Inc.">Postman</a> hypothesized that a team-based product would be a winner, they tailored their offering accordingly, and their valuation skyrocketed to <strong>$5.6B </strong>after <strong>$433M</strong> in VC funding. I suspect that Postman&#8217;s true pre-IPO valuation may be lower, but for perspective, Progress Software&#8217;s <em>entire</em> market capitalization is currently just <strong><a href="https://finance.yahoo.com/quote/PRGS/">$1.7B</a>.</strong></p>
1115
1116
1117
1118<p class="wp-block-paragraph">I was excited to recently see Progress move Fiddler Everywhere toward the hottest trend in tech (Artificial Intelligence) by introducing support for <a href="https://www.telerik.com/support/whats-new/fiddler-everywhere/2025-q4">MCP and the popular agents</a>. Done right, this could be a <strong>killer feature </strong>that people are willing to pay big money for because of the value it can deliver.</p>
1119
1120
1121
1122<p class="wp-block-paragraph">However, I worry that Progress may have just vaporized the trust and goodwill that would&#8217;ve smoothed their plan to move users from a solid (if outdated) free product to an actively-developed paid product with a disjoint feature set. That&#8217;s especially true because Fiddler&#8217;s Session Archive Zip (SAZ) format could&#8217;ve allowed compatibility between the two.</p>
1123
1124
1125
1126<h2 class="wp-block-heading">Where Do We Go From Here?</h2>
1127
1128
1129
1130<p class="wp-block-paragraph">Many Fiddler Classic users can happily continue to use the product for free for their personal non-commercial needs. Some Fiddler Classic customers may be happy to switch to Fiddler Everywhere with <a href="https://www.telerik.com/purchase/fiddler">prices starting at $84/user/year</a> for a feature-limited version of the product, or $444/user/year for the full Fiddler Everywhere feature set (which does not, as noted above, have all of Fiddler Classic&#8217;s features or compatibility with its extensions).</p>
1131
1132
1133
1134<p class="wp-block-paragraph">Some users have told me that they&#8217;ve be taking measures to disable Fiddler 5.x&#8217;s upgrade logic and remain on the final free version forever under <a href="https://web.archive.org/web/20260414160505/https://www.telerik.com/purchase/license-agreement/fiddler">its original license</a>. They&#8217;ll use the extensibility model to <a href="https://textslashplain.com/2025/05/16/fiddler-in-2025/">keep it compatible</a> with the modern web. Unfortunately, public redistribution of the older installer is not permitted under its license.</p>
1135
1136
1137
1138<p class="wp-block-paragraph">Some users will likely just stop using Fiddler entirely. As browser developer tools have evolved, many web developers&#8217; needs are now fully met by the Network tab in their respective browsers.</p>
1139
1140
1141
1142<p class="wp-block-paragraph">Some users will likely move to competitive products, whether pay (<a href="https://postman.com">Postman</a>, <a href="https://www.charlesproxy.com/">Charles</a>) or free open-source (<a href="https://www.mitmproxy.org/">mitmproxy</a>) or hybrid (<a href="https://www.fluxzy.io/features">Fluxzy.io</a>).</p>
1143
1144
1145
1146<h2 class="wp-block-heading">Fiddler -&gt; CLeARINET?</h2>
1147
1148
1149
1150<p class="wp-block-paragraph">One thing that&#8217;s particularly baffling about Progress&#8217; decision is the timing. Crippling Fiddler might&#8217;ve made <em>some </em>(evil) sense back in 2020 or so, but if you haven&#8217;t noticed, times have changed. </p>
1151
1152
1153
1154<ul class="wp-block-list">
1155<li>AI agents have enabled <a href="https://textslashplain.com/2025/04/15/vibe-coding-for-security/">vibe-coding</a>
1155 of production-quality code rapidly and cheaply. When a pre-Telerik acquirer asked me how long it would take them to implement their own, I guessed about 2000 hours, or about 700 if I guided them. Using an AI coding agent, I suspect you could get 90% of the way there in about 160 hours.</li>
1156
1157
1158
1159<li>Much of the work in building Fiddler was in &#8220;figuring stuff out&#8221;, and the resources for doing that are dramatically better than ever before: we have better blogs, better tooling, better RFCs, and more open-source code than ever before. </li>
1160
1161
1162
1163<li>The .NET platform is dramatically more capable (particularly related to async) than the v2.0 framework that Fiddler mostly targeted. I&#8217;ve already laid out a set of <a href="https://textslashplain.com/2024/11/24/fiddler-my-mistakes/">mistakes</a> and pitfalls to avoid. </li>
1164
1165
1166
1167<li>There&#8217;s a large community of .NET developers who might be interested in lending a hand, including many hundreds that recently voluntarily retired from Microsoft. And there are some <em>amazingly </em>bright developers (Kevin, Jérôme, Chrisx3, etc) who have built extensions and other code for legacy Fiddler who might jump at the chance to get their PRs into an open-source replacement.</li>
1168
1169
1170
1171<li>Fiddler has no &#8220;moat&#8221; &#8212; the SAZ file format is simple and easily read and written. The product is designed to interact with protocols and formats based on open-standards. The true <em>value </em>of Fiddler was almost entirely &#8220;goodwill.&#8221;</li>
1172</ul>
1173
1174
1175
1176<p class="coblocks-animate wp-block-paragraph" data-coblocks-animation="slideInLeft"><strong><em>Times seem ripe for a change.</em></strong></p>
1177
1178
1179
1180<p class="wp-block-paragraph">When I named Fiddler, I did so because I was on the Microsoft Office clipart team and I knew we had plenty of free pictures of violins handy. Time has passed, and we have AI that can generate any images we want. An important kid in my life plays clarinet. If you squint at it, Clarinet sounds kinda like &#8220;Clear INET&#8221;, and seeing internet traffic in the clear is the whole point here. </p>
1181
1182
1183
1184<p class="wp-block-paragraph">In about 5 minutes, we&#8217;ve got a name, a <a href="https://clearinet.app">domain</a>, and a splash screen.</p>
1185
1186
1187<div class="wp-block-image">
1188<figure class="aligncenter size-full is-resized has-lightbox"><a href="https://clearinet.app"><img data-recalc-dims="1" loading="lazy" decoding="async" width="750" height="419" data-attachment-id="15195" data-permalink="https://textslashplain.com/2026/08/05/fiddler-in-2026/image-690/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-47.png?fit=1024%2C572&amp;ssl=1" data-orig-size="1024,572" data-comments-opened="1" data-image-meta="{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;,&quot;alt&quot;:&quot;&quot;}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-47.png?fit=750%2C419&amp;ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-47.png?resize=750%2C419&#038;ssl=1" alt="" class="wp-image-15195" style="aspect-ratio:1.7902739922536222;width:614px;height:auto" srcset="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-47.png?w=1024&amp;ssl=1 1024w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-47.png?resize=300%2C168&amp;ssl=1 300w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-47.png?resize=768%2C429&amp;ssl=1 768w" sizes="auto, (max-width: 750px) 100vw, 750px" /></a></figure>
1189</div>
1190
1191
1192<p class="wp-block-paragraph">Now we just need some code. :)<br><br>I&#8217;m currently in an especially busy period at work and in life (I&#8217;m moving houses this month) but I hope to have some progress and updates in this space sometime soon. <em>Unless Progress Software wants to save me the trouble and win tons of kudos for open-sourcing FiddlerClassic themselves! ;-) </em><br><br><br>-Eric</p>
1193
1194
1195
1196<h2 class="wp-block-heading">Appendix: Fiddler Origins</h2>
1197
1198
1199
1200<p class="wp-block-paragraph"><em>This section is from the <a href="https://fiddlerbook.com">Fiddler Book</a>.</em></p>
1201
1202
1203
1204<p class="wp-block-paragraph">First, a confession—the Fiddler Web Debugger is not the result of a grand vision or the ambition to develop the world’s most popular debugging proxy. A tool born of necessity, I never set out to build a platform so flexible, powerful, and complicated that I’d be forced to spend a year writing a book to explain how to fully take advantage of it. But here we are.</p>
1205
1206
1207
1208<p class="wp-block-paragraph">Before diving into the technical chapters, I will begin by sharing the story behind how Fiddler came to be.</p>
1209
1210
1211
1212<p class="wp-block-paragraph">As a student at the University of Maryland in the spring of 1999, I had the chance to interview for a Program Management internship on a new team at Microsoft. One of my final interviewer’s first questions was “<em>How does HTTP work?</em>” Knowing only the basics, I gave an incomplete and somewhat inaccurate answer, but didn’t embarrass myself too badly. That summer and the following, I worked on features for the first version of SharePoint. On rare occasions, I found myself looking at web traffic in Microsoft Network Monitor (NetMon), a powerful but then primitive and difficult-to-use packet sniffer. In the early summer of 2001, I joined Microsoft full-time as the Program Manager for the Office Clip Art client and website.</p>
1213
1214
1215
1216<p class="wp-block-paragraph">At that time, most of the developers and testers working on my team were new to web development, having previously been responsible for writing native code applications in C and C++. It was quickly apparent that the debugging process was overly cumbersome—many of my colleagues were loath to use NetMon. I even watched some developers debugging HTTP requests by hovering over variables in Visual Studio, examining the raw traffic in hex:</p>
1217
1218
1219<div class="wp-block-image">
1220<figure class="aligncenter size-full"><a href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-22.png?ssl=1"><img data-recalc-dims="1" loading="lazy" decoding="async" width="388" height="442" data-attachment-id="15005" data-permalink="https://textslashplain.com/2026/08/05/fiddler-in-2026/image-665/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-22.png?fit=388%2C442&amp;ssl=1" data-orig-size="388,442" data-comments-opened="1" data-image-meta="{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;,&quot;alt&quot;:&quot;&quot;}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-22.png?fit=388%2C442&amp;ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-22.png?resize=388%2C442&#038;ssl=1" alt="" class="wp-image-15005" srcset="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-22.png?w=388&amp;ssl=1 388w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-22.png?resize=263%2C300&amp;ssl=1 263w" sizes="auto, (max-width: 388px) 100vw, 388px" /></a></figure>
1221</div>
1222
1223
1224<p class="wp-block-paragraph">Having developed several small Windows utilities, I was confident that I could code something to make web debugging simpler. My first simplistic effort was based on taking an existing C++ proxy server and making minor modifications to it so that it would spew HTTP traffic to the system console:</p>
1225
1226
1227<div class="wp-block-image">
1228<figure class="aligncenter size-full"><a href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-23.png?ssl=1"><img data-recalc-dims="1" loading="lazy" decoding="async" width="750" height="284" data-attachment-id="15008" data-permalink="https://textslashplain.com/2026/08/05/fiddler-in-2026/image-666/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-23.png?fit=879%2C333&amp;ssl=1" data-orig-size="879,333" data-comments-opened="1" data-image-meta="{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;,&quot;alt&quot;:&quot;&quot;}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-23.png?fit=750%2C284&amp;ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-23.png?resize=750%2C284&#038;ssl=1" alt="" class="wp-image-15008" srcset="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-23.png?w=879&amp;ssl=1 879w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-23.png?resize=300%2C114&amp;ssl=1 300w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-23.png?resize=768%2C291&amp;
1228ssl=1 768w" sizes="auto, (max-width: 750px) 100vw, 750px" /></a></figure>
1229</div>
1230
1231
1232<p class="wp-block-paragraph">It’s generous to call this effort primitive—the proxy couldn’t handle secure traffic or authentication protocols. Non-text content was another problem—comically, the utility would try to render binary content as ASCII. Old-school console users may recall that the octet 0x07 represents the “bell” character, and when it’s displayed in the console, a system beep is played. Soon after its release, the hallways of the Office Online team sounded like a Las Vegas casino, as binary content flowed through the debug proxies running in each tester’s office.</p>
1233
1234
1235
1236<p class="wp-block-paragraph">Despite the very annoying limitations, this tool was still popular, and I was inspired to get started on the next version. I mocked up a quick little demo in Borland Delphi, a native code language used for most of my development work at the time. The colorful UI foreshadowed Fiddler’s eventual appearance:</p>
1237
1238
1239<div class="wp-block-image">
1240<figure class="aligncenter size-full"><a href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-24.png?ssl=1"><img data-recalc-dims="1" loading="lazy" decoding="async" width="635" height="451" data-attachment-id="15010" data-permalink="https://textslashplain.com/2026/08/05/fiddler-in-2026/image-667/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-24.png?fit=635%2C451&amp;ssl=1" data-orig-size="635,451" data-comments-opened="1" data-image-meta="{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;,&quot;alt&quot;:&quot;&quot;}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-24.png?fit=635%2C451&amp;ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-24.png?resize=635%2C451&#038;ssl=1" alt="" class="wp-image-15010" srcset="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-24.png?w=635&amp;ssl=1 635w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-24.png?resize=300%2C213&amp;ssl=1 300w" sizes="auto, (max-width: 635px) 100vw, 635px" /></a></figure>
1241</div>
1242
1243
1244<p class="wp-block-paragraph">However, as I pondered the security and memory-management implications of writing a proxy server in native code, I soon decided that my next effort would be developed in C#, a new language being developed by the Visual Studio team that my best friend had just joined. The notion of writing a HTTP proxy server from scratch in .NET posed just two significant challenges: I didn’t really know how HTTP worked, and I didn’t know how to code in C#.</p>
1245
1246
1247
1248<p class="wp-block-paragraph">Fortunately, given a few trips to the bookstore and a lot of spare weekends, both shortcomings would be remedied. Two books were my constant companions: <a href="https://www.amazon.com/HTTP-Definitive-Guide-Guides/dp/1565925092/ref=sr_1_1?crid=5KEMUR9HYE13&amp;dib=eyJ2IjoiMSJ9.LBObjKK5kMhgdv-6igreM_krQJmJfnXABb3lPgR3VzDQbV7-XXVB3eyClfqhdsXAjyZkbaZXF9d3aKl4RHBVHVrGgZEO5aswwXyzYI1DT6jiiJ73gM51C5VCob6Ve182a69p9lAyBZb7LvGjJ3FyyneBQ7kQVWDrqHqCBcevV27jCu3GgybxP2rYtSDdGPuU.9_9MWngG0abF
1248hOr0vmSRPzCj0_shROV21vtcJgwUqos&amp;dib_tag=se&amp;keywords=http+the+definitive+guide&amp;qid=1785953616&amp;sprefix=http+the+definitive+guid%2Caps%2C136&amp;sr=8-1">HTTP: The Definitive Guide</a> and the <a href="https://www.amazon.com/C-Cookbook-2nd-Cookbooks-OReilly/dp/0596100639/ref=sr_1_8?crid=3UPTPBGBODFR8&amp;dib=eyJ2IjoiMSJ9.jeviSN0Ah9DRbG9uGiIm-TUfwkG7JoZY30Zv2_-kihM8DjeYZvKNyj-A7kjjj6e8yRoWfvBNmEk4jGJK4kyF4Tf0Z5nteO2jb0OLD74iRcBlgHnvMPMoUD8Q1_tLEAdO0fcBK0xDHs9GIHYeiTjwx-2QkCD8iK15i9qPmsapTPGTvlpfOp0z4zYb6vvCdhzIaU3PMMzCXFHuxyHKIumdiwqmlSr88kKmf8t0IFqj780.CjxPsrrE5jznxopNWB3lcdao3FRHNtldS-u1V9nKOsg&amp;dib_tag=se&amp;keywords=C%23+cookbook&amp;qid=1785953631&amp;sprefix=c+cookbook%2Caps%2C168&amp;sr=8-8">C# Cookbook</a>. Chapter by chapter, I learned about HTTP and C#, and week-by-week Fiddler came to life. About six months after I started, I had a basic version of Fiddler ready:</p>
1249
1250
1251
1252<figure class="wp-block-image size-large"><a href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-25.png?ssl=1"><img data-recalc-dims="1" loading="lazy" decoding="async" width="750" height="327" data-attachment-id="15012" data-permalink="https://textslashplain.com/2026/08/05/fiddler-in-2026/image-668/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-25.png?fit=1317%2C573&amp;ssl=1" data-orig-size="1317,573" data-comments-opened="1" data-image-meta="{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;,&quot;alt&quot;:&quot;&quot;}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-25.png?fit=750%2C327&amp;ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-25.png?resize=750%2C327&#038;ssl=1" alt="" class="wp-image-15012" srcset="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-25.png?resize=1024%2C446&amp;ssl=1 1024w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-25.png?resize=300%2C131&amp;ssl=1 300w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-25.png?resize=768%2C334&amp;ssl=1 768w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-25.png?resize=1200%2C522&amp;ssl=1 1200w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-25.png?w=1317&amp;ssl=1 1317w" sizes="auto, (max-width: 750px) 100vw, 750px" /></a></figure>
1253
1254
1255
1256<p class="wp-block-paragraph">Like its predecessors, it too had a large number of limitations (and thousands of bugs) but it was eagerly adopted by colleagues whose PC speakers were in danger of burning out from the incessant beeps of my first proxy utility.</p>
1257
1258
1259
1260<p class="wp-block-paragraph">Over the subsequent years, Fiddler was progressively enhanced with two extensibility models, a mechanism to automatically generate and modify responses, and support for secure (HTTPS) traffic, FTP, and HTML5 WebSockets. In 2012, Fiddler was ported to the Mono Framework, enabling it to run directly on Mac and Linux PCs and virtual machines.</p>
1261
1262
1263<div class="wp-block-image">
1264<figure class="aligncenter size-full is-resized"><a href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-26.png?ssl=1"><img data-recalc-dims="1" loading="lazy" decoding="async" width="663" height="503" data-attachment-id="15014" data-permalink="https://textslashplain.com/2026/08/05/fiddler-in-2026/image-669/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-26.png?fit=663%2C503&amp;ssl=1" data-orig-size="663,503" data-comments-opened="1" data-image-meta="{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;,&quot;alt&quot;:&quot;&quot;}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-26.png?fit=663%2C503&amp;ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-26.png?resize=663%2C503&#038;ssl=1" alt="" class="wp-image-15014" style="width:387px;height:auto" srcset="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-26.png?w=663&amp;ssl=1 663w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-26.png?resize=300%2C228&amp;ssl=1 300w" sizes="auto, (max-width: 663px) 100vw, 663px" /></a><figcaption class="wp-element-caption">Fiddler&#8217;s &#8220;About&#8221; box shortly after Telerik&#8217;s acquisition</figcaption></figure>
1265</div>
1266
1267<div class="wp-block-image">
1268<figure class="aligncenter size-full is-resized"><a href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-29.png?ssl=1"><img data-recalc-dims="1" loading="lazy" decoding="async" width="332" height="318" data-attachment-id="15022" data-permalink="https://textslashplain.com/2026/08/05/fiddler-in-2026/image-672/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-29.png?fit=332%2C318&amp;ssl=1" data-orig-size="332,318" data-comments-opened="1" data-image-meta="{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;,&quot;alt&quot;:&quot;&quot;}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-29.png?fit=332%2C318&amp;ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-29.png?resize=332%2C318&#038;ssl=1" alt="" class="wp-image-15022" style="width:386px;height:auto" srcset="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-29.png?w=332&amp;ssl=1 332w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-29.png?resize=300%2C287&amp;ssl=1 300w" sizes="auto, (max-width: 332px) 100vw, 332px" /></a><figcaption class="wp-element-caption">The <a href="https://en.wikipedia.org/wiki/Easter_egg_(media)">Easter Egg</a> in Fiddler&#8217;s &#8220;About&#8221; box just before leaving Telerik</figcaption></figure>
1269</div>
1270
1271
1272<p class="wp-block-paragraph"></p>
1273
1274
1275
1276<h3 class="wp-block-heading">Appendix: Progress Announcement</h3>
1277
1278
1279
1280<p class="wp-block-paragraph">Progress sent all registered Fiddler users the following email:</p>
1281
1282
1283<div class="wp-block-image">
1284<figure class="aligncenter size-full"><a href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-46.png?ssl=1"><img data-recalc-dims="1" loading="lazy" decoding="async" width="455" height="801" data-attachment-id="15190" data-permalink="https://textslashplain.com/2026/08/05/fiddler-in-2026/image-689/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-46.png?fit=455%2C801&amp;ssl=1" data-orig-size="455,801" data-comments-opened="1" data-image-meta="{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;,&quot;alt&quot;:&quot;&quot;}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-46.png?fit=455%2C801&amp;ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-46.png?resize=455%2C801&#038;ssl=1" alt="" class="wp-image-15190" srcset="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-46.png?w=455&amp;ssl=1 455w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-46.png?resize=170%2C300&amp;
1284ssl=1 170w" sizes="auto, (max-width: 455px) 100vw, 455px" /></a></figure>
1285</div>	</div><!-- .entry-content -->
1286
1287	<footer class="entry-footer responsive-max-width">
1288		<span class="byline"><svg class="svg-icon" width="16" height="16" aria-hidden="true" role="img" focusable="false" viewBox="0 0 24 24" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><path d="M12 12c2.21 0 4-1.79 4-4s-1.79-4-4-4-4 1.79-4 4 1.79 4 4 4zm0 2c-2.67 0-8 1.34-8 4v2h16v-2c0-2.66-5.33-4-8-4z"></path><path d="M0 0h24v24H0z" fill="none"></path></svg><span class="screen-reader-text">Posted by</span><span class="author vcard"><a class="url fn n" href="https://textslashplain.com/author/ericlaw1979/">ericlaw</a></span></span><span class="posted-on"><svg class="svg-icon" width="16" height="16" aria-hidden="true" role="img" focusable="false" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><defs><path id="a" d="M0 0h24v24H0V0z"></path></defs><clipPath id="b"><use xlink:href="#a" overflow="visible"></use></clipPath><path clip-path="url(#b)" d="M12 2C6.5 2 2 6.5 2 12s4.5 10 10 10 10-4.5 10-10S17.5 2 12 2zm4.2 14.2L11 13V7h1.5v5.2l4.5 2.7-.8 1.3z"></path></svg><a href="https://textslashplain.com/2026/08/05/fiddler-in-2026/" rel="bookmark"><time class="entry-date published" datetime="2026-08-05T12:29:11-05:00">2026-08-05</time><time class="updated" datetime="2026-09-16T15:25:53-05:00">2026-09-16</time></a></span><span class="cat-links"><svg class="svg-icon" width="16" height="16" aria-hidden="true" role="img" focusable="false" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M10 4H4c-1.1 0-1.99.9-1.99 2L2 18c0 1.1.9 2 2 2h16c1.1 0 2-.9 2-2V8c0-1.1-.9-2-2-2h-8l-2-2z"></path><path d="M0 0h24v24H0z" fill="none"></path></svg><span class="screen-reader-text">Posted in</span><a href="https://textslashplain.com/category/fiddler-2/" rel="category tag">fiddler</a>, <a href="https://textslashplain.com/category/life/" rel="category tag">life</a>, <a href="https://textslashplain.com/category/storytelling/" rel="category tag">storytelling</a></span><span class="comments-link"><svg class="svg-icon" width="16" height="16" aria-hidden="true" role="img" focusable="false" viewBox="0 0 24 24" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><path d="M21.99 4c0-1.1-.89-2-1.99-2H4c-1.1 0-2 .9-2 2v12c0 1.1.9 2 2 2h14l4 4-.01-18z"></path><path d="M0 0h24v24H0z" fill="none"></path></svg><a href="https://textslashplain.com/2026/08/05/fiddler-in-2026/#comments">8 Comments<span class="screen-reader-text"> on Fiddler in 2026</span></a></span>	</footer><!-- .entry-footer -->
1289</article><!-- #post-${ID} -->
1290
1291	<nav class="navigation pagination" aria-label="Posts pagination">
1292		<h2 class="screen-reader-text">Posts pagination</h2>
1293		<div class="nav-links"><span aria-current="page" class="page-numbers current">1</span>
1294<a class="page-numbers" href="https://textslashplain.com/page/2/">2</a>
1295<a class="page-numbers" href="https://textslashplain.com/page/3/">3</a>
1296<span class="page-numbers dots">&hellip;</span>
1297<a class="page-numbers" href="https://textslashplain.com/page/87/">87</a>
1298<a class="next page-numbers" href="https://textslashplain.com/page/2/"><span class="nav-next-text">Older posts</span> <svg class="svg-icon" width="22" height="22" aria-hidden="true" role="img" focusable="false" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M10 6L8.59 7.41 13.17 12l-4.58 4.59L10 18l6-6z"></path><path d="M0 0h24v24H0z" fill="none"></path></svg></a></div>
1299	</nav>
1300		</main><!-- .site-main -->
1301	</section><!-- .content-area -->
1302
1303
1304	</div><!-- #content -->
1305
1306	
1307	<footer id="colophon" class="site-footer responsive-max-width">
1308			
1309	<aside class="widget-area responsive-max-width" role="complementary" aria-label="Footer">
1310		<section id="search-5" class="widget widget_search"><h2 class="widget-title">Search Text/Plain</h2><form role="search" method="get" class="search-form" action="https://textslashplain.com/">
1311				<label>
1312					<span class="screen-reader-text">Search for:</span>
1313					<input type="search" class="search-field" placeholder="Search &hellip;" value="" name="s" />
1314				</label>
1315				<input type="submit" class="search-submit" value="Search" />
1316			</form></section><section id="pages-3" class="widget widget_pages"><h2 class="widget-title">Pages</h2>
1317			<ul>
1318				<li class="page_item page-item-1"><a href="https://textslashplain.com/about/">About</a></li>
1319<li class="page_item page-item-5799"><a href="https://textslashplain.com/browse-all-posts/">Browse All Posts</a></li>
1320<li class="page_item page-item-7207"><a href="https://textslashplain.com/categories/">Categories</a></li>
1321<li class="page_item page-item-12129"><a href="https://textslashplain.com/cruises/">Cruises</a></li>
1322<li class="page_item page-item-3855"><a href="https://textslashplain.com/ieinternals-archive/">IEInternals Archive</a></li>
1323<li class="page_item page-item-12762"><a href="https://textslashplain.com/races/">Real-World Races</a></li>
1324			</ul>
1325
1326			</section><section id="rss_links-3" class="widget widget_rss_links"><h2 class="widget-title">RSS</h2><p><a target="_self" href="https://textslashplain.com/feed/" title="Subscribe to posts"><img src="https://textslashplain.com/wp-content/plugins/jetpack/images/rss/orange-small.png" alt="RSS feed" />&nbsp;RSS - Posts</a></p>
1327</section><section id="blog-stats-3" class="widget blog-stats"><h2 class="widget-title">Blog Stats</h2><ul><li>2,516,148 hits</li></ul></section><section id="categories-5" class="widget widget_categories"><h2 class="widget-title">Categories</h2><form action="https://textslashplain.com" method="get"><label class="screen-reader-text" for="cat">Categories</label><select  name='cat' id='cat' class='postform'>
1328	<option value='-1'>
1328Select Category</option>
1329	<option class="level-0" value="49635188">bluebadge&nbsp;&nbsp;(16)</option>
1330	<option class="level-0" value="178">books&nbsp;&nbsp;(3)</option>
1331	<option class="level-0" value="138">browsers&nbsp;&nbsp;(186)</option>
1332	<option class="level-0" value="148">design&nbsp;&nbsp;(27)</option>
1333	<option class="level-0" value="6504">dev&nbsp;&nbsp;(88)</option>
1334	<option class="level-0" value="10138408">fiddler&nbsp;&nbsp;(26)</option>
1335	<option class="level-0" value="124">life&nbsp;&nbsp;(55)</option>
1336	<option class="level-0" value="1054996">perf&nbsp;&nbsp;(20)</option>
1337	<option class="level-0" value="398">politics&nbsp;&nbsp;(2)</option>
1338	<option class="level-0" value="3279">privacy&nbsp;&nbsp;(27)</option>
1339	<option class="level-0" value="309">reviews&nbsp;&nbsp;(2)</option>
1340	<option class="level-0" value="1675">running&nbsp;&nbsp;(20)</option>
1341	<option class="level-0" value="801">security&nbsp;&nbsp;(177)</option>
1342	<option class="level-0" value="1400">storytelling&nbsp;&nbsp;(50)</option>
1343	<option class="level-0" value="318">tech&nbsp;&nbsp;(41)</option>
1344	<option class="level-0" value="200">travel&nbsp;&nbsp;(9)</option>
1345	<option class="level-0" value="1">Uncategorized&nbsp;&nbsp;(16)</option>
1346	<option class="level-0" value="151">web&nbsp;&nbsp;(155)</option>
1347	<option class="level-0" value="374741">windmills&nbsp;&nbsp;(12)</option>
1348</select>
1349</form>
1349<script>
1350( ( dropdownId ) => {
1351	const dropdown = document.getElementById( dropdownId );
1352	function onSelectChange() {
1353		setTimeout( () => {
1354			if ( 'escape' === dropdown.dataset.lastkey ) {
1355				return;
1356			}
1357			if ( dropdown.value && parseInt( dropdown.value ) > 0 && dropdown instanceof HTMLSelectElement ) {
1358				dropdown.parentElement.submit();
1359			}
1360		}, 250 );
1361	}
1362	function onKeyUp( event ) {
1363		if ( 'Escape' === event.key ) {
1364			dropdown.dataset.lastkey = 'escape';
1365		} else {
1366			delete dropdown.dataset.lastkey;
1367		}
1368	}
1369	function onClick() {
1370		delete dropdown.dataset.lastkey;
1371	}
1372	dropdown.addEventListener( 'keyup', onKeyUp );
1373	dropdown.addEventListener( 'click', onClick );
1374	dropdown.addEventListener( 'change', onSelectChange );
1375})( "cat" );
1376
1377//# sourceURL=WP_Widget_Categories%3A%3Awidget
1378</script>
1378
1379</section><section id="grofile-3" class="widget widget-grofile grofile">			<img
1380				src="https://2.gravatar.com/avatar/89c27d27b73dd3690b3dad59f3a539d1?s=320"
1381				srcset="https://2.gravatar.com/avatar/89c27d27b73dd3690b3dad59f3a539d1?s=320 1x, https://2.gravatar.com/avatar/89c27d27b73dd3690b3dad59f3a539d1?s=480 1.5x, https://2.gravatar.com/avatar/89c27d27b73dd3690b3dad59f3a539d1?s=640 2x, https://2.gravatar.com/avatar/89c27d27b73dd3690b3dad59f3a539d1?s=960 3x, https://2.gravatar.com/avatar/89c27d27b73dd3690b3dad59f3a539d1?s=1280 4x"
1382				class="grofile-thumbnail no-grav"
1383				alt="ericlaw"
1384				loading="lazy" />
1385			<div class="grofile-meta">
1386				<h4><a href="https://gravatar.com/ericlaw1979">ericlaw</a></h4>
1387				<p>Impatient optimist. Dad. Author/speaker. Created Fiddler &amp; SlickRun. PM @ Microsoft 2001-2012, and 2018-, working on Office, IE, and Edge. Now working on Microsoft Defender. My words are my own, I do not speak for any other entity.</p>
1388			</div>
1389
1390			
1391			<p><a href="https://gravatar.com/ericlaw1979" class="grofile-full-link">
1392				View Full Profile &rarr;			</a></p>
1393
1394			</section>	</aside><!-- .widget-area -->
1395
1396
1397	
1398		<div class="site-info">
1399		<a class="site-name" href="https://textslashplain.com/" rel="home">text/plain</a><span class="comma">,</span>
1400<a href="https://wordpress.com/?ref=footer_custom_powered">Powered by WordPress.com</a>.	</div><!-- .site-info -->
1401	</footer><!-- #colophon -->
1402
1403</div><!-- #page -->
1404
1405<!--  -->
1406<script type="speculationrules">
1407{"prefetch":[{"source":"document","where":{"and":[{"href_matches":"/*"},{"not":{"href_matches":["/wp-*.php","/wp-admin/*","/wp-content/uploads/*","/wp-content/*","/wp-content/plugins/*","/wp-content/themes/morden/*","/wp-content/themes/varia/*","/*\\?(.+)"]}},{"not":{"selector_matches":"a[rel~=\"nofollow\"]"}},{"not":{"selector_matches":".no-prefetch, .no-prefetch a"}}]},"eagerness":"conservative"}]}
1408</script>
1408
1409<meta id="bilmur" property="bilmur:data" content="" data-customproperties="{&quot;woo_active&quot;:&quot;0&quot;,&quot;logged_in&quot;:&quot;0&quot;,&quot;wptheme&quot;:&quot;morden&quot;,&quot;wptheme_is_block&quot;:&quot;0&quot;}" data-provider="wordpress.com" data-service="atomic"  data-site-tz="America/Chicago"  >
1410<script defer src="https://s0.wp.com/wp-content/js/bilmur.min.js?m=202639"></script>
1410
1411		<div id="jp-carousel-loading-overlay" style="display: none;">
1412			<div id="jp-carousel-loading-wrapper">
1413				<span id="jp-carousel-library-loading"><svg class="jetpack-spinner" width="40" height="40" viewBox="0 0 100 100" xmlns="http://www.w3.org/2000/svg" aria-hidden="true" focusable="false"><circle cx="50" cy="50" r="46" fill="none" stroke="#ddd" stroke-width="8"/><path d="M 50 4 A 46 46 0 0 1 96 50" fill="none" stroke="currentColor" stroke-width="8" stroke-linecap="round"><animateTransform attributeName="transform" type="rotate" dur="1.4s" from="0 50 50" to="360 50 50" repeatCount="indefinite"/></path></svg></span>
1414			</div>
1415		</div>
1416		<div class="jp-carousel-overlay" style="display: none;">
1417
1418		<div class="jp-carousel-container">
1419			<!-- The Carousel Swiper -->
1420			<div
1421				class="jp-carousel-wrap swiper jp-carousel-swiper-container jp-carousel-transitions"
1422				itemscope
1423				itemtype="https://schema.org/ImageGallery">
1424				<div class="jp-carousel swiper-wrapper"></div>
1425				<div class="jp-swiper-button-prev swiper-button-prev">
1426					<svg width="25" height="24" viewBox="0 0 25 24" fill="none" xmlns="http://www.w3.org/2000/svg">
1427						<mask id="maskPrev" mask-type="alpha" maskUnits="userSpaceOnUse" x="8" y="6" width="9" height="12">
1428							<path d="M16.2072 16.59L11.6496 12L16.2072 7.41L14.8041 6L8.8335 12L14.8041 18L16.2072 16.59Z" fill="white"/>
1429						</mask>
1430						<g mask="url(#maskPrev)">
1431							<rect x="0.579102" width="23.8823" height="24" fill="#FFFFFF"/>
1432						</g>
1433					</svg>
1434				</div>
1435				<div class="jp-swiper-button-next swiper-button-next">
1436					<svg width="25" height="24" viewBox="0 0 25 24" fill="none" xmlns="http://www.w3.org/2000/svg">
1437						<mask id="maskNext" mask-type="alpha" maskUnits="userSpaceOnUse" x="8" y="6" width="8" height="12">
1438							<path d="M8.59814 16.59L13.1557 12L8.59814 7.41L10.0012 6L15.9718 12L10.0012 18L8.59814 16.59Z" fill="white"/>
1439						</mask>
1440						<g mask="url(#maskNext)">
1441							<rect x="0.34375" width="23.8822" height="24" fill="#FFFFFF"/>
1442						</g>
1443					</svg>
1444				</div>
1445			</div>
1446			<!-- The main close buton -->
1447			<div class="jp-carousel-close-hint">
1448				<svg width="25" height="24" viewBox="0 0 25 24" fill="none" xmlns="http://www.w3.org/2000/svg">
1449					<mask id="maskClose" mask-type="alpha" maskUnits="userSpaceOnUse" x="5" y="5" width="15" height="14">
1450						<path d="M19.3166 6.41L17.9135 5L12.3509 10.59L6.78834 5L5.38525 6.41L10.9478 12L5.38525 17.59L6.78834 19L12.3509 13.41L17.9135 19L19.3166 17.59L13.754 12L19.3166 6.41Z" fill="white"/>
1451					</mask>
1452					<g mask="url(#maskClose)">
1453						<rect x="0.409668" width="23.8823" height="24" fill="#FFFFFF"/>
1454					</g>
1455				</svg>
1456			</div>
1457			<!-- Image info, comments and meta -->
1458			<div class="jp-carousel-info">
1459				<div class="jp-carousel-info-footer">
1460					<div class="jp-carousel-pagination-container">
1461						<div class="jp-swiper-pagination swiper-pagination"></div>
1462						<div class="jp-carousel-pagination"></div>
1463					</div>
1464					<div class="jp-carousel-photo-title-container">
1465						<div class="jp-carousel-photo-caption"></div>
1466					</div>
1467					<div class="jp-carousel-photo-icons-container">
1468						<a href="#" class="jp-carousel-icon-btn jp-carousel-icon-info" aria-label="Toggle photo metadata visibility">
1469							<span class="jp-carousel-icon">
1470								<svg width="25" height="24" viewBox="0 0 25 24" fill="none" xmlns="http://www.w3.org/2000/svg">
1471									<mask id="maskInfo" mask-type="alpha" maskUnits="userSpaceOnUse" x="2" y="2" width="21" height="20">
1472										<path fill-rule="evenodd" clip-rule="evenodd" d="M12.7537 2C7.26076 2 2.80273 6.48 2.80273 12C2.80273 17.52 7.26076 22 12.7537 22C18.2466 22 22.7046 17.52 22.7046 12C22.7046 6.48 18.2466 2 12.7537 2ZM11.7586 7V9H13.7488V7H11.7586ZM11.7586 11V17H13.7488V11H11.7586ZM4.79292 12C4.79292 16.41 8.36531 20 12.7537 20C17.142 20 20.7144 16.41 20.7144 12C20.7144 7.59 17.142 4 12.7537 4C8.36531 4 4.79292 7.59 4.79292 12Z" fill="white"/>
1473									</mask>
1474									<g mask="url(#maskInfo)">
1475										<rect x="0.8125" width="23.8823" height="24" fill="#FFFFFF"/>
1476									</g>
1477								</svg>
1478							</span>
1479						</a>
1480												<a href="#" class="jp-carousel-icon-btn jp-carousel-icon-comments" aria-label="Toggle photo comments visibility">
1481							<span class="jp-carousel-icon">
1482								<svg width="25" height="24" viewBox="0 0 25 24" fill="none" xmlns="http://www.w3.org/2000/svg">
1483									<mask id="maskComments" mask-type="alpha" maskUnits="userSpaceOnUse" x="2" y="2" width="21" height="20">
1484										<path fill-rule="evenodd" clip-rule="evenodd" d="M4.3271 2H20.2486C21.3432 2 22.2388 2.9 22.2388 4V16C22.2388 17.1 21.3432 18 20.2486 18H6.31729L2.33691 22V4C2.33691 2.9 3.2325 2 4.3271 2ZM6.31729 16H20.2486V4H4.3271V18L6.31729 16Z" fill="white"/>
1485									</mask>
1486									<g mask="url(#maskComments)">
1487										<rect x="0.34668" width="23.8823" height="24" fill="#FFFFFF"/>
1488									</g>
1489								</svg>
1490
1491								<span class="jp-carousel-has-comments-indicator" aria-label="This image has comments."></span>
1492							</span>
1493						</a>
1494											</div>
1495				</div>
1496				<div class="jp-carousel-info-extra">
1497					<div class="jp-carousel-info-content-wrapper">
1498						<div class="jp-carousel-photo-title-container">
1499							<div class="jp-carousel-photo-title"></div>
1500						</div>
1501						<div class="jp-carousel-comments-wrapper">
1502															<div id="jp-carousel-comments-loading">
1503									<span>Loading Comments...</span>
1504								</div>
1505								<div class="jp-carousel-comments"></div>
1506								<div id="jp-carousel-comment-form-container">
1507									<span id="jp-carousel-comment-form-spinner"><svg class="jetpack-spinner" width="20" height="20" viewBox="0 0 100 100" xmlns="http://www.w3.org/2000/svg" aria-hidden="true" focusable="false"><circle cx="50" cy="50" r="46" fill="none" stroke="#ddd" stroke-width="8"/><path d="M 50 4 A 46 46 0 0 1 96 50" fill="none" stroke="currentColor" stroke-width="8" stroke-linecap="round"><animateTransform attributeName="transform" type="rotate" dur="1.4s" from="0 50 50" to="360 50 50" repeatCount="indefinite"/></path></svg></span>
1508									<div id="jp-carousel-comment-post-results"></div>
1509																														<form id="jp-carousel-comment-form">
1510												<label for="jp-carousel-comment-form-comment-field" class="screen-reader-text">Write a Comment...</label>
1511												<textarea
1512													name="comment"
1513													class="jp-carousel-comment-form-field jp-carousel-comment-form-textarea"
1514													id="jp-carousel-comment-form-comment-field"
1515													placeholder="Write a Comment..."
1516												></textarea>
1517												<div id="jp-carousel-comment-form-submit-and-info-wrapper">
1518													<div id="jp-carousel-comment-form-commenting-as">
1519																													<fieldset>
1520																<label for="jp-carousel-comment-form-email-field">Email (Required)</label>
1521																<input type="text" name="email" class="jp-carousel-comment-form-field jp-carousel-comment-form-text-field" id="jp-carousel-comment-form-email-field" />
1522															</fieldset>
1523															<fieldset>
1524																<label for="jp-carousel-comment-form-author-field">Name (Required)</label>
1525																<input type="text" name="author" class="jp-carousel-comment-form-field jp-carousel-comment-form-text-field" id="jp-carousel-comment-form-author-field" />
1526															</fieldset>
1527															<fieldset>
1528																<label for="jp-carousel-comment-form-url-field">Website</label>
1529																<input type="text" name="url" class="jp-carousel-comment-form-field jp-carousel-comment-form-text-field" id="jp-carousel-comment-form-url-field" />
1530															</fieldset>
1531																											</div>
1532													<input
1533														type="submit"
1534														name="submit"
1535														class="jp-carousel-comment-form-button"
1536														id="jp-carousel-comment-form-button-submit"
1537														value="Post Comment" />
1538												</div>
1539											</form>
1540																											</div>
1541													</div>
1542						<div class="jp-carousel-image-meta">
1543							<div class="jp-carousel-title-and-caption">
1544								<div class="jp-carousel-photo-info">
1545									<div class="jp-carousel-caption" itemprop="caption description"></div>
1546								</div>
1547
1548								<div class="jp-carousel-photo-description"></div>
1549							</div>
1550							<a class="jp-carousel-image-download" href="#" aria-label="Download image" target="_blank" style="display: none;">
1551								<svg width="25" height="24" viewBox="0 0 25 24" fill="none" xmlns="http://www.w3.org/2000/svg">
1552									<mask id="mask0" mask-type="alpha" maskUnits="userSpaceOnUse" x="3" y="3" width="19" height="18">
1553										<path fill-rule="evenodd" clip-rule="evenodd" d="M5.84615 5V19H19.7775V12H21.7677V19C21.7677 20.1 20.8721 21 19.7775 21H5.84615C4.74159 21 3.85596 20.1 3.85596 19V5C3.85596 3.9 4.74159 3 5.84615 3H12.8118V5H5.84615ZM14.802 5V3H21.7677V10H19.7775V6.41L9.99569 16.24L8.59261 14.83L18.3744 5H14.802Z" fill="white"/>
1554									</mask>
1555									<g mask="url(#mask0)">
1556										<rect x="0.870605" width="23.8823" height="24" fill="#FFFFFF"/>
1557									</g>
1558								</svg>
1559								<span class="jp-carousel-download-text"></span>
1560							</a>
1561							<div class="jp-carousel-image-map" style="display: none;"></div>
1562						</div>
1563					</div>
1564				</div>
1565			</div>
1566		</div>
1567
1568		</div>
1569			
1569<script>
1570	/(trident|msie)/i.test(navigator.userAgent)&&document.getElementById&&window.addEventListener&&window.addEventListener("hashchange",function(){var t,e=location.hash.substring(1);/^[A-z0-9_-]+$/.test(e)&&(t=document.getElementById(e))&&(/^(?:a|select|input|button|textarea)$/i.test(t.tagName)||(t.tabIndex=-1),t.focus())},!1);
1571	</script>
1571
1572	
1572<script id="jetpack-carousel-js-extra">
1573var jetpackSwiperLibraryPath = {"url":"https://textslashplain.com/wp-content/plugins/jetpack/_inc/blocks/swiper.js"};
1574var jetpackCarouselStrings = {"widths":[370,700,1000,1200,1400,2000],"is_logged_in":"","lang":"en","ajaxurl":"https://textslashplain.com/wp-admin/admin-ajax.php","nonce":"311c7875d2","display_exif":"1","display_comments":"1","single_image_gallery":"1","single_image_gallery_media_file":"","background_color":"black","comment":"Comment","post_comment":"Post Comment","write_comment":"Write a Comment...","loading_comments":"Loading Comments...","image_label":"Open image in full-screen.","download_original":"View full size \u003Cspan class=\"photo-size\"\u003E{0}\u003Cspan class=\"photo-size-times\"\u003E\u00d7\u003C/span\u003E{1}\u003C/span\u003E","no_comment_text":"Please be sure to submit some text with your comment.","no_comment_email":"Please provide an email address to comment.","no_comment_author":"Please provide your name to comment.","comment_post_error":"Sorry, but there was an error posting your comment. Please try again later.","comment_approved":"Your comment was approved.","comment_unapproved":"Your comment is in moderation.","camera":"Camera","aperture":"Aperture","shutter_speed":"Shutter Speed","focal_length":"Focal Length","copyright":"Copyright","comment_registration":"0","require_name_email":"1","login_url":"https://textslashplain.com/wp-login.php?redirect_to=https%3A%2F%2Ftextslashplain.com%2F2026%2F09%2F11%2Fexperimentation-just-try-it%2F","blog_id":"1","meta_data":["camera","aperture","shutter_speed","focal_length","copyright"]};
1575//# sourceURL=jetpack-carousel-js-extra
1576</script>
vendor: 1 bytes, line 1576
1576
1577<script type='text/javascript'  src='https://textslashplain.com/_static/??wp-content/plugins/coblocks/dist/js/coblocks-animation.js,wp-content/plugins/jetpack/_inc/build/carousel/jetpack-carousel.min.js?m=1785801844'></script>
vendor: 1 bytes, line 1577
1577
1578<script data-wp-strategy="defer" defer id="tiled-gallery-js" src="https://textslashplain.com/wp-content/plugins/jetpack/_inc/build/tiled-gallery/tiled-gallery/tiled-gallery.min.js?ver=16.3-a.3"></script>
vendor: 1 bytes, line 1578
1578
1579<script id="jetpack-stats-js-before">
1580_stq = window._stq || [];
1581_stq.push([ "view", {"v":"ext","blog":"88727790","post":"0","tz":"-5","srv":"textslashplain.com","arch_home":"1","hp":"atomic","ac":"2","amp":"0","j":"1:16.3-a.3"} ]);
1582_stq.push([ "clickTrackerInit", "88727790", "0" ]);
1583//# sourceURL=jetpack-stats-js-before
1584</script>
vendor: 1 bytes, line 1584
1584
1585<script data-wp-strategy="defer" defer fetchpriority="low" id="jetpack-stats-js" src="https://stats.wp.com/e-202639.js"></script>
vendor: 1 bytes, line 1585
1585
1586<script id="wp-emoji-settings" type="application/json">
1587{"baseUrl":"https://s.w.org/images/core/emoji/17.0.2/72x72/","ext":".png","svgUrl":"https://s.w.org/images/core/emoji/17.0.2/svg/","svgExt":".svg","source":{"concatemoji":"https://textslashplain.com/wp-includes/js/wp-emoji-release.min.js?ver=7.1.2"}}
1588</script>
vendor: 1 bytes, line 1588
1588
1589<script type="module">
1590/*! This file is auto-generated */
1591var e="script#wp-emoji-settings",t=document.querySelector(e);if(!(t instanceof HTMLScriptElement))throw new Error("Element missing: "+e);const r=JSON.parse(t.text),s=(window._wpemojiSettings=r,"wpEmojiSettingsSupports"),o=["flag","emoji"];function i(e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessionStorage.setItem(s,JSON.stringify(t))}catch(e){}}function c(e,t,n){e.clearRect(0,0,e.canvas.width,e.canvas.height),e.fillText(t,0,0);t=new Uint32Array(e.getImageData(0,0,e.canvas.width,e.canvas.height).data);e.clearRect(0,0,e.canvas.width,e.canvas.height),e.fillText(n,0,0);const r=new Uint32Array(e.getImageData(0,0,e.canvas.width,e.canvas.height).data);return t.every((e,t)=>e===r[t])}function p(e,t){e.clearRect(0,0,e.canvas.width,e.canvas.height),e.fillText(t,0,0);var n=e.getImageData(16,16,1,1);for(let e=0;e<n.data.length;e++)if(0!==n.data[e])return!1;return!0}function u(e,t,n,r){switch(t){case"flag":return n(e,"\ud83c\udff3\ufe0f\u200d\u26a7\ufe0f","\ud83c\udff3\ufe0f\u200b\u26a7\ufe0f")?!1:!n(e,"\ud83c\udde8\ud83c\uddf6","\ud83c\udde8\u200b\ud83c\uddf6")&&!n(e,"\ud83c\udff4\udb40\udc67\udb40\udc62\udb40\udc65\udb40\udc6e\udb40\udc67\udb40\udc7f","\ud83c\udff4\u200b\udb40\udc67\u200b\udb40\udc62\u200b\udb40\udc65\u200b\udb40\udc6e\u200b\udb40\udc67\u200b\udb40\udc7f");case"emoji":return!r(e,"\ud83e\u1fac8")}return!1}function f(e,t,n,r){let a;const s=(a="undefined"!=typeof WorkerGlobalScope&&self instanceof WorkerGlobalScope?new OffscreenCanvas(300,150):document.createElement("canvas")).getContext("2d",{willReadFrequently:!0}),o=(s.textBaseline="top",s.font="600 32px Arial",{});return e.forEach(e=>{o[e]=t(s,e,n,r)}),o}function a(e){var t=document.createElement("script");t.src=e,t.defer=!0,document.head.appendChild(t)}r.supports={everything:!0,everythingExceptFlag:!0},new Promise(t=>{let n=function(){try{var e=JSON.parse(sessionStorage.getItem(s));if("object"==typeof e&&"number"==typeof e.timestamp&&(new Date).valueOf()<e.timestamp+604800&&"object"==typeof e.supportTests)return e.supportTests}catch(e){}return null}();if(!n){if("undefined"!=typeof Worker&&"undefined"!=typeof OffscreenCanvas&&"undefined"!=typeof URL&&URL.createObjectURL&&"undefined"!=typeof Blob)try{var e="postMessage("+f.toString()+"("+[JSON.stringify(o),u.toString(),c.toString(),p.toString()].join(",")+"));",r=new Blob([e],{type:"text/javascript"});const a=new Worker(URL.createObjectURL(r),{name:"wpTestEmojiSupports"});return void(a.onmessage=e=>{i(n=e.data),a.terminate(),t(n)})}catch(e){}i(n=f(o,u,c,p))}t(n)}).then(e=>{for(const n in e)r.supports[n]=e[n],r.supports.everything=r.supports.everything&&r.supports[n],"flag"!==n&&(r.supports.everythingExceptFlag=r.supports.everythingExceptFlag&&r.supports[n]);var t;r.supports.everythingExceptFlag=r.supports.everythingExceptFlag&&!r.supports.flag,r.supports.everything||((t=r.source||{}).concatemoji?a(t.concatemoji):t.wpemoji&&t.twemoji&&(a(t.twemoji),a(t.wpemoji)))});
1592//# sourceURL=https://textslashplain.com/wp-includes/js/wp-emoji-loader.min.js
1593</script>
1593
1594
1595</body>
1596</html>
1597<!--
1598	generated 82 seconds ago
1599	generated in 0.550 seconds
1600	served from batcache in 0.002 seconds
1601	expires in 218 seconds
1602-->

Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.