1<!doctype html> 2<html lang="en-US"> 3<head> 4 <meta charset="UTF-8" /> 5 <meta name="viewport" content="width=device-width, initial-scale=1" /> 6 <link rel="profile" href="https://gmpg.org/xfn/11" /> 7 <title>text/plain – ericlaw talks about security, the web, and software in general</title> 8<meta name='robots' content='max-image-preview:large' /> 9<!-- Jetpack Site Verification Tags --> 10<meta name="google-site-verification" content="FQ2m6-F6KlTeFSjsKwCccjZBjWTG1DhcwoATe-Vt8Tw"> 11<link rel='dns-prefetch' href='//secure.gravatar.com' /> 12<link rel='dns-prefetch' href='//fonts-api.wp.com' /> 13<link rel='dns-prefetch' href='//widgets.wp.com' /> 14<link rel='dns-prefetch' href='//jetpack.wordpress.com' /> 15<link rel='dns-prefetch' href='//s0.wp.com' /> 16<link rel='dns-prefetch' href='//public-api.wordpress.com' /> 17<link rel='dns-prefetch' href='//0.gravatar.com' /> 18<link rel='dns-prefetch' href='//1.gravatar.com' /> 19<link rel='dns-prefetch' href='//2.gravatar.com' /> 20<link rel='preconnect' href='//i0.wp.com' /> 21<link rel='preconnect' href='//c0.wp.com' /> 22<link rel="alternate" type="application/rss+xml" title="text/plain » Feed" href="https://textslashplain.com/feed/" /> 23<link rel="alternate" type="application/rss+xml" title="text/plain » Comments Feed" href="https://textslashplain.com/comments/feed/" /> 24<style id="wp-img-auto-sizes-contain-inline-css"> 25img:is([sizes=auto i],[sizes^="auto," i]){contain-intrinsic-size:3000px 1500px} 26/*# sourceURL=wp-img-auto-sizes-contain-inline-css */ 27</style> 28<style id="wp-emoji-styles-inline-css"> 29 30 img.wp-smiley, img.emoji { 31 display: inline !important; 32 border: none !important; 33 box-shadow: none !important; 34 height: 1em !important; 35 width: 1em !important; 36 margin: 0 0.07em !important; 37 vertical-align: -0.1em !important; 38 background: none !important; 39 padding: 0 !important; 40 } 41/*# sourceURL=wp-emoji-styles-inline-css */ 42</style> 43<style id="wp-block-library-inline-css"> 44:root{--wp-block-synced-color:#7a00df;--wp-block-synced-color--rgb:122,0,223;--wp-bound-block-color:var(--wp-block-synced-color);--wp-editor-canvas-background:#ddd;--wp-admin-theme-color:#007cba;--wp-admin-theme-color--rgb:0,124,186;--wp-admin-theme-color-darker-10:#006ba1;--wp-admin-theme-color-darker-10--rgb:0,107,160.5;--wp-admin-theme-color-darker-20:#005a87;--wp-admin-theme-color-darker-20--rgb:0,90,135;--wp-admin-border-width-focus:2px}@media (min-resolution:192dpi){:root{--wp-admin-border-width-focus:1.5px}}.wp-element-button{cursor:pointer}:root .has-very-light-gray-background-color{background-color:#eee}:root .has-very-dark-gray-background-color{background-color:#313131}:root .has-very-light-gray-color{color:#eee}:root .has-very-dark-gray-color{color:#313131}:root .has-vivid-green-cyan-to-vivid-cyan-blue-gradient-background{background:linear-gradient(135deg,#00d084,#0693e3)}:root .has-purple-crush-gradient-background{background:linear-gradient(135deg,#34e2e4,#4721fb 50%,#ab1dfe)}:root .has-hazy-dawn-gradient-background{background:linear-gradient(135deg,#faaca8,#dad0ec)}:root .has-subdued-olive-gradient-background{background:linear-gradient(135deg,#fafae1,#67a671)}:root .has-atomic-cream-gradient-background{background:linear-gradient(135deg,#fdd79a,#004a59)}:root .has-nightshade-gradient-background{background:linear-gradient(135deg,#330968,#31cdcf)}:root .has-midnight-gradient-background{background:linear-gradient(135deg,#020381,#2874fc)}:root{--wp--preset--font-size--normal:16px;
44--wp--preset--font-size--huge:42px}.has-regular-font-size{font-size:1em}.has-larger-font-size{font-size:2.625em}.has-normal-font-size{font-size:var(--wp--preset--font-size--normal)}.has-huge-font-size{font-size:var(--wp--preset--font-size--huge)}:root .has-text-align-center{text-align:center}:root .has-text-align-left{text-align:left}:root .has-text-align-right{text-align:right}.has-fit-text{white-space:nowrap!important}#end-resizable-editor-section{display:none}.aligncenter{clear:both}.items-justified-left{justify-content:flex-start}.items-justified-center{justify-content:center}.items-justified-right{justify-content:flex-end}.items-justified-space-between{justify-content:space-between}.screen-reader-text{word-wrap:normal!important;border:0;clip-path:inset(50%);height:1px;margin:-1px;overflow:hidden;padding:0;position:absolute;width:1px;word-break:normal!important}.screen-reader-text:focus{background-color:#ddd;clip-path:none;color:#444;display:block;font-size:1em;height:auto;left:5px;line-height:normal;padding:15px 23px 14px;text-decoration:none;top:5px;width:auto;z-index:100000}html :where(.has-border-color){border-style:solid}html :where([style^=border-color],[style*=";border-color"],[style*="; border-color"]){border-style:solid}html :where([style^=border-top-color],[style*=";border-top-color"],[style*="; border-top-color"]){border-top-style:solid}html :where([style^=border-right-color],[style*=";border-right-color"],[style*="; border-right-color"]){border-right-style:solid}html :where([style^=border-bottom-color],[style*=";border-bottom-color"],[style*="; border-bottom-color"]){border-bottom-style:solid}html :where([style^=border-left-color],[style*=";border-left-color"],[style*="; border-left-color"]){border-left-style:solid}html :where([style^=border-width],[style*=";border-width"],[style*="; border-width"]){border-style:solid}html :where([style^=border-top-width],[style*=";border-top-width"],[style*="; border-top-width"]){border-top-style:solid}html :where([style^=border-right-width],[style*=";border-right-width"],[style*="; border-right-width"]){border-right-style:solid}html :where([style^=border-bottom-width],[style*=";border-bottom-width"],[style*="; border-bottom-width"]){border-bottom-style:solid}html :where([style^=border-left-width],[style*=";border-left-width"],[style*="; border-left-width"]){border-left-style:solid}html :where(img[class*=wp-image-]){height:auto;max-width:100%}:where(figure){margin:0 0 1em}html :where(.is-position-sticky){--wp-admin--admin-bar--position-offset:var(--wp-admin--admin-bar--height,0px)}@media screen and (max-width:600px){html :where(.is-position-sticky){--wp-admin--admin-bar--position-offset:0px}} 45 46/*# sourceURL=https://textslashplain.com/wp-content/plugins/gutenberg/build/styles/block-library/common.min.css */ 47</style> 48<style id="wp-block-audio-inline-css"> 49.wp-block-audio{box-sizing:border-box}.wp-block-audio :where(figcaption){margin-bottom:1em;margin-top:.5em}.wp-block-audio audio{min-width:300px;width:100%} 50/*# sourceURL=https://textslashplain.com/wp-content/plugins/gutenberg/build/styles/block-library/audio/style.min.css */ 51</style> 52<style id="wp-block-audio-theme-inline-css"> 53.wp-block-audio :where(figcaption){color:#555;font-size:13px;text-align:center}.is-dark-theme .wp-block-audio :where(figcaption){color:hsla(0,0%,100%,.65)}.wp-block-audio{margin:0 0 1em} 54/*# sourceURL=https://textslashplain.com/wp-content/plugins/gutenberg/build/styles/block-library/audio/theme.min.css */ 55</style> 56<link rel='stylesheet' id='all-css-d373e116ff26052f6cc412cf36c8fc3e' href='https://textslashplain.com/wp-content/mu-plugins/wpcomsh/jetpack_vendor/automattic/jetpack-mu-wpcom/src/build/wpcom-blocks-code-style/wpcom-blocks-code-style.css?m=1790187559' type='text/css' media='all' /> 57<style id="wp-block-quote-inline-css"> 58.wp-block-quote{box-sizing:border-box;overflow-wrap:break-word}.wp-block-quote.is-large:where(:not(.is-style-plain)),.wp-block-quote.is-style-large:where(:not(.is-style-plain)){margin-bottom:1em;padding:0 1em}.wp-block-quote.is-large:where(:not(.is-style-plain)) p,.wp-block-quote.is-style-large:where(:not
58(.is-style-plain)) p{font-size:1.5em;font-style:italic;line-height:1.6}.wp-block-quote.is-large:where(:not(.is-style-plain)) cite,.wp-block-quote.is-large:where(:not(.is-style-plain)) footer,.wp-block-quote.is-style-large:where(:not(.is-style-plain)) cite,.wp-block-quote.is-style-large:where(:not(.is-style-plain)) footer{font-size:1.125em;text-align:right}.wp-block-quote>cite{display:block} 59/*# sourceURL=https://textslashplain.com/wp-content/plugins/gutenberg/build/styles/block-library/quote/style.min.css */ 60</style> 61<style id="wp-block-quote-theme-inline-css"> 62.wp-block-quote{border-left:.25em solid;margin:0 0 1.75em;padding-left:1em}.wp-block-quote cite,.wp-block-quote footer{color:currentColor;font-size:.8125em;font-style:normal;position:relative}.wp-block-quote:where(.has-text-align-right){border-left:none;border-right:.25em solid;padding-left:0;padding-right:1em}.wp-block-quote:where(.has-text-align-center){border:none;padding-left:0}.wp-block-quote.is-large,.wp-block-quote.is-style-large,.wp-block-quote:where(.is-style-plain){border:none} 63/*# sourceURL=https://textslashplain.com/wp-content/plugins/gutenberg/build/styles/block-library/quote/theme.min.css */ 64</style> 65<style id="wp-block-heading-inline-css"> 66h1:where(.wp-block-heading).has-background,h2:where(.wp-block-heading).has-background,h3:where(.wp-block-heading).has-background,h4:where(.wp-block-heading).has-background,h5:where(.wp-block-heading).has-background,h6:where(.wp-block-heading).has-background{padding:var(--wp--style--block-background-padding,1.25em 2.375em)}h1.has-text-align-left[style*=writing-mode]:where([style*=vertical-lr]),h1.has-text-align-right[style*=writing-mode]:where([style*=vertical-rl]),h2.has-text-align-left[style*=writing-mode]:where([style*=vertical-lr]),h2.has-text-align-right[style*=writing-mode]:where([style*=vertical-rl]),h3.has-text-align-left[style*=writing-mode]:where([style*=vertical-lr]),h3.has-text-align-right[style*=writing-mode]:where([style*=vertical-rl]),h4.has-text-align-left[style*=writing-mode]:where([style*=vertical-lr]),h4.has-text-align-right[style*=writing-mode]:where([style*=vertical-rl]),h5.has-text-align-left[style*=writing-mode]:where([style*=vertical-lr]),h5.has-text-align-right[style*=writing-mode]:where([style*=vertical-rl]),h6.has-text-align-left[style*=writing-mode]:where([style*=vertical-lr]),h6.has-text-align-right[style*=writing-mode]:where([style*=vertical-rl]){rotate:180deg} 67/*# sourceURL=https://textslashplain.com/wp-content/plugins/gutenberg/build/styles/block-library/heading/style.min.css */ 68</style> 69<style id="wp-block-image-inline-css"> 70.wp-block-image>a,.wp-block-image>figure>a{display:inline-block}.wp-block-image img{box-sizing:border-box;height:auto;max-width:100%;vertical-align:bottom}@media not (prefers-reduced-motion){.wp-block-image img.hide{visibility:hidden}.wp-block-image img.show{animation:show-content-image .4s}}.wp-block-image[style*=border-radius] img,.wp-block-image[style*=border-radius]>a{border-radius:inherit}.wp-block-image.has-custom-border img{box-sizing:border-box}.wp-block-image.aligncenter{text-align:center}.wp-block-image.alignfull>a,.wp-block-image.alignwide>a{width:100%}.wp-block-image.alignfull img,.wp-block-image.alignwide img{height:auto;width:100%}.wp-block-image .aligncenter,.wp-block-image .alignleft,.wp-block-image .alignright,.wp-block-image.aligncenter,.wp-block-image.alignleft,.wp-block-image.alignright{display:table}.wp-block-image .aligncenter>figcaption,.wp-block-image .alignleft>figcaption,.wp-block-image .alignright>figcaption,.wp-block-image.aligncenter>figcaption,.wp-block-image.alignleft>figcaption,.wp-block-image.alignright>figcaption{caption-side:bottom;display:table-caption}.wp-block-image .alignleft{float:left;margin:.5em 1em .5em 0}.wp-block-image .alignright{float:right;margin:.5em 0 .5em 1em}.wp-block-image .aligncenter{margin-left:auto;margin-right:auto}.wp-block-image :where(figcaption){margin-bottom:1em;margin-top:.5em}.wp-block-image.is-style-circle-mask img{border-radius:9999px}@supports ((-webkit-mask-image:none) or (mask-image:none)) or (-webkit-mask-image:none){.wp-block-image.is-style-circle-mask img{border-radius:0;-webkit-mask-image:url('data:image/svg+xml;utf8,<svg viewBox="0 0 100 100" xmlns="http://www.w3.org/2000/svg"><circle cx="50" cy="50" r="50"/></svg>');mask-image:url('data:image/svg+xml;utf8,<svg viewBox="0 0 100 100" xmlns="http://www.w3.org/2000/svg"><circle cx="50" cy="50" r="50"/></svg>');mask-mode:alpha;-webkit-mask-position:center;mask-position:center;-webkit-mask-repeat:no-repeat;mask-repeat:no-repeat;-webkit-mask-size:contain;mask-size:contain}}:root :where(.wp-block-image.is-style-rounded img,.wp-block-image .is-style-rounded img){border-radius:9999px}.wp-block-image figure{margin:0}.wp-lightbox-container{display:flex;flex-direction:column;position:relative}.wp-lightbox-container img{cursor:zoom-in}.wp-lightbox-container img:hover+button{opacity:1}.wp-lightbox-container button{align-items:center;backdrop-filter:blur(16px) saturate(180%);background-color:rgba(90,90,90,.25);border:none;border-radius:4px;cursor:zoom-in;display:flex;height:20px;justify-content:center;opacity:0;padding:0;position:absolute;right:16px;text-align:center;top:16px;width:20px;z-index:100}@media not (prefers-reduced-motion){.wp-lightbox-container button{transition:opacity .2s ease}}.wp-lightbox-container button:focus-visible{outline:3px auto rgba(90,90,90,.25);outline:3px auto -webkit-focus-ring-color;outline-offset:3px}.wp-lightbox-container button:hover{cursor:pointer;opacity:1}.wp-lightbox-container button:focus{opacity:1}.wp-lightbox-container button:focus,.wp-lightbox-container button:hover,.wp-lightbox-container button:not(:hover):not(:active):not(.has-background){background-color:rgba(90,90,90,.25);border:none}.wp-lightbox-overlay{box-sizing:border-box;
70cursor:zoom-out;height:100vh;left:0;overflow:hidden;position:fixed;top:0;visibility:hidden;width:100%;z-index:100000}.wp-lightbox-overlay .wp-lightbox-close-button{align-items:center;cursor:pointer;display:flex;font-family:inherit;gap:8px;justify-content:center;line-height:1;min-height:40px;min-width:40px;padding:0 4px;position:absolute;right:calc(env(safe-area-inset-right) + 16px);top:calc(env(safe-area-inset-top) + 16px);z-index:5000000}.wp-lightbox-overlay .wp-lightbox-close-button:focus,.wp-lightbox-overlay .wp-lightbox-close-button:hover,.wp-lightbox-overlay .wp-lightbox-close-button:not(:hover):not(:active):not(.has-background){background:none;border:none}.wp-lightbox-overlay .wp-lightbox-close-button:has(.wp-lightbox-close-text:not([hidden])) .wp-lightbox-close-icon svg{height:1em;width:1em}.wp-lightbox-overlay .wp-lightbox-close-icon svg{display:block}.wp-lightbox-overlay .wp-lightbox-navigation-button-next,.wp-lightbox-overlay .wp-lightbox-navigation-button-prev{align-items:center;bottom:16px;cursor:pointer;display:flex;font-family:inherit;gap:4px;justify-content:center;line-height:1;min-height:40px;min-width:40px;padding:0 8px;position:absolute;z-index:2000002}.wp-lightbox-overlay .wp-lightbox-navigation-button-next[hidden],.wp-lightbox-overlay .wp-lightbox-navigation-button-prev[hidden]{display:none}@media (min-width:960px){.wp-lightbox-overlay .wp-lightbox-navigation-button-next,.wp-lightbox-overlay .wp-lightbox-navigation-button-prev{bottom:50%;transform:translateY(-50%)}}.wp-lightbox-overlay .wp-lightbox-navigation-button-next:focus,.wp-lightbox-overlay .wp-lightbox-navigation-button-next:hover,.wp-lightbox-overlay .wp-lightbox-navigation-button-next:not(:hover):not(:active):not(.has-background),.wp-lightbox-overlay .wp-lightbox-navigation-button-prev:focus,.wp-lightbox-overlay .wp-lightbox-navigation-button-prev:hover,.wp-lightbox-overlay .wp-lightbox-navigation-button-prev:not(:hover):not(:active):not(.has-background){background:none;border:none;padding:0 8px}.wp-lightbox-overlay .wp-lightbox-navigation-button-next:has(.wp-lightbox-navigation-text:not([hidden])) .wp-lightbox-navigation-icon svg,.wp-lightbox-overlay .wp-lightbox-navigation-button-prev:has(.wp-lightbox-navigation-text:not([hidden])) .wp-lightbox-navigation-icon svg{display:block;height:1.5em;width:1.5em}.wp-lightbox-overlay .wp-lightbox-navigation-button-prev{left:calc(env(safe-area-inset-left) + 16px)}.wp-lightbox-overlay .wp-lightbox-navigation-button-next{right:calc(env(safe-area-inset-right) + 16px)}.wp-lightbox-overlay .wp-lightbox-navigation-icon svg{vertical-align:middle}.wp-lightbox-overlay .lightbox-image-container{height:var(--wp--lightbox-container-height);left:50%;overflow:hidden;position:absolute;top:50%;transform:translate(-50%,-50%);transform-origin:top left;width:var(--wp--lightbox-container-width);z-index:2000001}.wp-lightbox-overlay .wp-block-image{align-items:center;box-sizing:border-box;display:flex;height:100%;justify-content:center;margin:0;position:relative;transform-origin:0 0;width:100%;z-index:3000000}.wp-lightbox-overlay .wp-block-image img{height:var(--wp--lightbox-image-height);min-height:var(--wp--lightbox-image-height);min-width:var(--wp--lightbox-image-width);width:var(--wp--lightbox-image-width)}.wp-lightbox-overlay .wp-block-image figcaption{display:none}.wp-lightbox-overlay button{background:none;border:none}.wp-lightbox-overlay .scrim{background-color:#fff;height:100%;opacity:.9;position:absolute;width:100%;z-index:2000000}.wp-lightbox-overlay.active{visibility:visible}@media not (prefers-reduced-motion){.wp-lightbox-overlay.active{animation:turn-on-visibility .25s both}.wp-lightbox-overlay.active img{animation:turn-on-visibility .35s both}.wp-lightbox-overlay.show-closing-animation:not(.active){animation:turn-off-visibility .35s both}.wp-lightbox-overlay.show-closing-animation:not(.active) img{animation:turn-off-visibility .25s both}.wp-lightbox-overlay.zoom.active{animation:none;opacity:1;visibility:visible}.wp-lightbox-overlay.zoom.active .lightbox-image-container{animation:lightbox-zoom-in .4s}.wp-lightbox-overlay.zoom.active .lightbox-image-container img{animation:none}.wp-lightbox-overlay.zoom.active .scrim{animation:turn-on-visibility .4s forwards}.wp-lightbox-overlay.zoom.show-closing-animation:not(.active){animation:none}.wp-lightbox-overlay.zoom.show-closing-animation:not(.active) .lightbox-image-container{animation:lightbox-zoom-out .4s}.wp-lightbox-overlay.zoom.show-closing-animation:not(.active) .lightbox-image-container img{animation:none}.wp-lightbox-overlay.zoom.show-closing-animation:not(.active) .scrim{animation:turn-off-visibility .4s forwards}}
70@keyframes show-content-image{0%{visibility:hidden}99%{visibility:hidden}to{visibility:visible}}@keyframes turn-on-visibility{0%{opacity:0}to{opacity:1}}@keyframes turn-off-visibility{0%{opacity:1;visibility:visible}99%{opacity:0;visibility:visible}to{opacity:0;visibility:hidden}}@keyframes lightbox-zoom-in{0%{transform:translate(calc((-100vw + var(--wp--lightbox-scrollbar-width))/2 + var(--wp--lightbox-initial-left-position)),calc(-50vh + var(--wp--lightbox-initial-top-position))) scale(var(--wp--lightbox-scale))}to{transform:translate(-50%,-50%) scale(1)}}@keyframes lightbox-zoom-out{0%{transform:translate(-50%,-50%) scale(1);visibility:visible}99%{visibility:visible}to{transform:translate(calc((-100vw + var(--wp--lightbox-scrollbar-width))/2 + var(--wp--lightbox-initial-left-position)),calc(-50vh + var(--wp--lightbox-initial-top-position))) scale(var(--wp--lightbox-scale));visibility:hidden}} 71/*# sourceURL=https://textslashplain.com/wp-content/plugins/gutenberg/build/styles/block-library/image/style.min.css */ 72</style> 73<style id="wp-block-image-theme-inline-css"> 74:root :where(.wp-block-image figcaption){color:#555;font-size:13px;text-align:center}.is-dark-theme :root :where(.wp-block-image figcaption){color:hsla(0,0%,100%,.65)}.wp-block-image{margin:0 0 1em} 75/*# sourceURL=https://textslashplain.com/wp-content/plugins/gutenberg/build/styles/block-library/image/theme.min.css */ 76</style> 77<style id="wp-block-list-inline-css"> 78ol,ul{box-sizing:border-box}:root :where(.wp-block-list.has-background){padding:var(--wp--style--block-background-padding,1.25em 2.375em)} 79/*# sourceURL=https://textslashplain.com/wp-content/plugins/gutenberg/build/styles/block-library/list/style.min.css */ 80</style> 81<style id="wp-block-paragraph-inline-css"> 82.is-small-text{font-size:.875em}.is-regular-text{font-size:1em}.is-large-text{font-size:2.25em}.is-larger-text{font-size:3em}.has-drop-cap:not(:focus):first-letter{float:left;font-size:8.4em;font-style:normal;font-weight:100;line-height:.68;margin:.05em .1em 0 0;text-transform:uppercase}body.rtl .has-drop-cap:not(:focus):first-letter{float:none;margin-left:.1em}p.has-drop-cap.has-background{overflow:hidden}:root :where(p.has-background){padding:var(--wp--style--block-background-padding,1.25em 2.375em)}:where(p.has-text-color:not(.has-link-color)) a{color:inherit}p.has-text-align-left[style*="writing-mode:vertical-lr"],p.has-text-align-right[style*="writing-mode:vertical-rl"]{rotate:180deg} 83/*# sourceURL=https://textslashplain.com/wp-content/plugins/gutenberg/build/styles/block-library/paragraph/style.min.css */ 84</style> 85<style id="wp-block-library-inline-css-extra"> 86.has-text-align-justify{text-align:justify;} 87/*# sourceURL=wp-block-library-inline-css */ 88</style> 89 90<style id="classic-theme-styles-inline-css"> 91.wp-block-button__link{background-color:#32373c;border-radius:9999px;box-shadow:none;color:#fff;font-size:1.125em;padding:calc(.667em + 2px) calc(1.333em + 2px);text-decoration:none}.wp-block-file__button{background:#32373c;color:#fff}.wp-block-accordion-heading{margin:0}.wp-block-accordion-heading__toggle{background-color:inherit!important;color:inherit!important}.wp-block-accordion-heading__toggle:not(:focus-visible){outline:none}.wp-block-accordion-heading__toggle:focus,.wp-block-accordion-heading__toggle:hover{background-color:inherit!important;border:none;box-shadow:none;color:inherit;padding:var(--wp--preset--spacing--20,1em) 0;text-decoration:none}.wp-block-accordion-heading__toggle:focus-visible{outline:auto;outline-offset:0}.wp-block-tab:not(.has-text-color){color:inherit!important}.wp-block-tab:not(.has-background){background-color:inherit!important}.wp-block-tab:focus,.wp-block-tab:hover{text-decoration:none}.wp-block-tab:focus-visible{outline:auto;outline-offset:0} 92/*# sourceURL=https://textslashplain.com/wp-content/plugins/gutenberg/build/styles/block-library/classic.min.css */ 93</style> 94 95<link rel='stylesheet' id='all-css-fa5ea71b5c6a215968743319f2ee1bb5' href='https://textslashplain.com/_static/??-eJydyzEOwjAMQNELEUwrFCbEWdzEai1SJ4rdptyeMjAy0PXrv1ZcyGIkBiUtI4tCyEPK4akQWQ3UXonctzna9lc5i56D6qn9yVF4Rtv5Lz1WXNGwOpIJJVCEYeEUoaAZVVGnE1aKhzlFtsN4ZWof/Jjv3e168b7zff8G/i560g==' type='text/css' media='all' /> 96<style id="global-styles-inline-css"> 97:root{--wp--preset--aspect-ratio--square: 1;--wp--preset--aspect-ratio--4-3: 4/3;--wp--preset--aspect-ratio--3-4: 3/4;--wp--preset--aspect-ratio--3-2: 3/2;--wp--preset--aspect-ratio--2-3: 2/3;--wp--preset--aspect-ratio--16-9: 16/9;--wp--preset--aspect-ratio--9-16: 9/16;--wp--preset--color--black: #000000;--wp--preset--color--cyan-bluish-gray: #abb8c3;--wp--preset--color--white: #ffffff;--wp--preset--color--pale-pink: #f78da7;--wp--preset--color--vivid-red: #cf2e2e;--wp--preset--color--luminous-vivid-orange: #ff6900;--wp--preset--color--luminous-vivid-amber: #fcb900;--wp--preset--color--light-green-cyan: #7bdcb5;--wp--preset--color--vivid-green-cyan: #00d084;--wp--preset--color--pale-cyan-blue: #8ed1fc;--wp--preset--color--vivid-cyan-blue: #0693e3;--wp--preset--color--vivid-purple: #9b51e0;--wp--preset--color--primary: #CD2220;--wp--preset--color--secondary: #007AB7;--wp--preset--color--foreground: #303030;--wp--preset--color--background: #FFFFFF;--wp--preset--gradient--vivid-cyan-blue-to-vivid-purple: linear-gradient(135deg,rgb(6,147,227) 0%,rgb(155,81,224) 100%);--wp--preset--gradient--light-green-cyan-to-vivid-green-cyan: linear-gradient(135deg,rgb(122,220,180) 0%,rgb(0,208,130) 100%);--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange: linear-gradient(135deg,rgb(252,185,
970) 0%,rgb(255,105,0) 100%);--wp--preset--gradient--luminous-vivid-orange-to-vivid-red: linear-gradient(135deg,rgb(255,105,0) 0%,rgb(207,46,46) 100%);--wp--preset--gradient--very-light-gray-to-cyan-bluish-gray: linear-gradient(135deg,rgb(238,238,238) 0%,rgb(169,184,195) 100%);--wp--preset--gradient--cool-to-warm-spectrum: linear-gradient(135deg,rgb(74,234,220) 0%,rgb(151,120,209) 20%,rgb(207,42,186) 40%,rgb(238,44,130) 60%,rgb(251,105,98) 80%,rgb(254,248,76) 100%);--wp--preset--gradient--blush-light-purple: linear-gradient(135deg,rgb(255,206,236) 0%,rgb(152,150,240) 100%);--wp--preset--gradient--blush-bordeaux: linear-gradient(135deg,rgb(254,205,165) 0%,rgb(254,45,45) 50%,rgb(107,0,62) 100%);--wp--preset--gradient--luminous-dusk: linear-gradient(135deg,rgb(255,203,112) 0%,rgb(199,81,192) 50%,rgb(65,88,208) 100%);--wp--preset--gradient--pale-ocean: linear-gradient(135deg,rgb(255,245,203) 0%,rgb(182,227,212) 50%,rgb(51,167,181) 100%);--wp--preset--gradient--electric-grass: linear-gradient(135deg,rgb(202,248,128) 0%,rgb(113,206,126) 100%);--wp--preset--gradient--midnight: linear-gradient(135deg,rgb(2,3,129) 0%,rgb(40,116,252) 100%);--wp--preset--font-size--small: 16.6px;--wp--preset--font-size--medium: 20px;--wp--preset--font-size--large: 26.45px;--wp--preset--font-size--x-large: 42px;--wp--preset--font-size--normal: 20px;--wp--preset--font-size--huge: 30.4174px;--wp--preset--spacing--20: 0.44rem;--wp--preset--spacing--30: 0.67rem;--wp--preset--spacing--40: 1rem;--wp--preset--spacing--50: 1.5rem;--wp--preset--spacing--60: 2.25rem;--wp--preset--spacing--70: 3.38rem;--wp--preset--spacing--80: 5.06rem;--wp--preset--shadow--natural: 6px 6px 9px rgba(0, 0, 0, 0.2);--wp--preset--shadow--deep: 12px 12px 50px rgba(0, 0, 0, 0.4);--wp--preset--shadow--sharp: 6px 6px 0px rgba(0, 0, 0, 0.2);--wp--preset--shadow--outlined: 6px 6px 0px -3px rgb(255, 255, 255), 6px 6px rgb(0, 0, 0);--wp--preset--shadow--crisp: 6px 6px 0px rgb(0, 0, 0);}.wp-block-button{--wp--preset--dimension--25: 25%;--wp--preset--dimension--50: 50%;--wp--preset--dimension--75: 75%;--wp--preset--dimension--100: 100%;}:where(body) { margin: 0; }:where(.wp-site-blocks) > * { margin-block-start: 24px; margin-block-end: 0; }:where(.wp-site-blocks) > :first-child { margin-block-start: 0; }:where(.wp-site-blocks) > :last-child { margin-block-end: 0; }:root { --wp--style--block-gap: 24px; }:root :where(.is-layout-flow) > :first-child{margin-block-start: 0;}:root :where(.is-layout-flow) > :last-child{margin-block-end: 0;}:root :where(.is-layout-flow) > *{margin-block-start: 24px;margin-block-end: 0;}:root :where(.is-layout-constrained) > :first-child{margin-block-start: 0;}:root :where(.is-layout-constrained) > :last-child{margin-block-end: 0;}:root :where(.is-layout-constrained) > *{margin-block-start: 24px;margin-block-end: 0;}:root :where(.is-layout-flex){gap: 24px;}:root :where(.is-layout-grid){gap: 24px;}body .is-layout-flex{display: flex;}.is-layout-flex{flex-wrap: wrap;align-items: center;}.is-layout-flex > :is(*, div){margin: 0;}body .is-layout-grid{display: grid;}.is-layout-grid > :is(*, div){margin: 0;}body{padding-top: 0px;padding-right: 0px;padding-bottom: 0px;padding-left: 0px;}:root :where(.wp-element-button, .wp-block-button__link){background-color: #32373c;border-width: 0;color: #fff;font-family: inherit;font-size: inherit;font-style: inherit;font-weight: inherit;letter-spacing: inherit;line-height: inherit;padding-top: calc(0.667em + 2px);padding-right: calc(1.333em + 2px);padding-bottom: calc(0.667em + 2px);padding-left: calc(1.333em + 2px);text-decoration: none;text-transform: inherit;}.has-black-color{color: var(--wp--preset--color--black) !important;}.has-cyan-bluish-gray-color{color: var(--wp--preset--color--cyan-bluish-gray) !important;}.has-white-color{color: var(--wp--preset--color--white) !important;}.has-pale-pink-color{color: var(--wp--preset--color--pale-pink) !important;}.has-vivid-red-color{color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-color{color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-color{color: var(--wp--preset--color--luminous-vivid-amber) !important;}.has-light-green-cyan-color{color: var(--wp--preset--color--light-green-cyan) !important;}.has-vivid-green-cyan-color{color: var(--wp--preset--color--vivid-green-cyan) !important;}.has-pale-cyan-blue-color{color: var(--wp--preset--color--pale-cyan-blue) !important;}.has-vivid-cyan-blue-color{color: var(--wp--preset--color--vivid-cyan-blue) !important;}.has-vivid-purple-color{color: var(--wp--preset--color--vivid-purple) !important;}.has-primary-color{color: var(--wp--preset--color--primary) !important;}.has-secondary-color{color: var(--wp--preset--color--secondary) !important;}.has-foreground-color{color: var(--wp--preset--color--foreground) !important;}.has-background-color{color: var(--wp--preset--color--background) !important;}.has-black-background-color{background-color: var(--wp--preset--color--black) !important;}.has-cyan-bluish-gray-background-color{background-color: var(--wp--preset--color--cyan-bluish-gray) !important;}.has-white-background-color{background-color: var(--wp--preset--color--white) !important;}.has-pale-pink-background-color{background-color: var(--wp--preset--color--pale-pink) !important;}.has-vivid-red-background-color{background-color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-background-color{background-color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-background-color{background-color: var(--wp--preset--color--luminous-vivid-amber) !important;}.has-light-green-cyan-background-color{background-color: var(--wp--preset--color--light-green-cyan) !important;}.has-vivid-green-cyan-background-color{background-color: var(--wp--preset--color--vivid-green-cyan) !important;}.has-pale-cyan-blue-background-color{background-color: var(--wp--preset--color--pale-cyan-blue) !important;}.has-vivid-cyan-blue-background-color{background-color: var(--wp--preset--color--vivid-cyan-blue) !important;}.has-vivid-purple-background-color{background-color: var(--wp--preset--color--vivid-purple) !important;}.has-primary-background-color{background-color: var(--wp--preset--color--primary) !important;}.has-secondary-background-color{background-color: var(--wp--preset--color--secondary) !important;}.has-foreground-background-color{background-color: var(--wp--preset--color--foreground) !important;}.has-background-background-color{background-color: var(--wp--preset--color--background) !important;}.has-black-border-color{border-color: var(--wp--preset--color--black) !important;}.has-cyan-bluish-gray-border-color{border-color: var(--wp--preset--color--cyan-bluish-gray) !important;}.has-white-border-color{border-color: var(--wp--preset--color--white) !important;}.has-pale-pink-border-color{border-color: var(--wp--preset--color--pale-pink) !important;}.has-vivid-red-border-color{border-color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-border-color{border-color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-border-color{border-color: var(--wp--preset--color--luminous-vivid-amber) !important;}.has-light-green-cyan-border-color{border-color: var(--wp--preset--color--light-green-cyan) !important;}.has-vivid-green-cyan-border-color{border-color: var(--wp--preset--color--vivid-green-cyan) !important;}.has-pale-cyan-blue-border-color{border-color: var(--wp--preset--color--pale-cyan-blue) !important;}.has-vivid-cyan-blue-border-color{border-color: var(--wp--preset--color--vivid-cyan-blue) !important;}.has-vivid-purple-border-color{border-color: var(--wp--preset--color--vivid-purple) !important;}.has-primary-border-color{border-color: var(--wp--preset--color--primary) !important;}.has-secondary-border-color{border-color: var(--wp--preset--color--secondary) !important;}.has-foreground-border-color{border-color: var(--wp--preset--color--foreground) !important;}.has-background-border-color{border-color: var(--wp--preset--color--background) !important;}.has-vivid-cyan-blue-to-vivid-purple-gradient-background{background: var(--wp--preset--gradient--vivid-cyan-blue-to-vivid-purple) !important;}.has-light-green-cyan-to-vivid-green-cyan-gradient-background{background: var(--wp--preset--gradient--light-green-cyan-to-vivid-green-cyan) !important;}.has-luminous-vivid-amber-to-luminous-vivid-orange-gradient-background{background: var(--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange) !important;}.has-luminous-vivid-orange-to-vivid-red-gradient-background{background: var(--wp--preset--gradient--luminous-vivid-orange-to-vivid-red) !important;}
97.has-very-light-gray-to-cyan-bluish-gray-gradient-background{background: var(--wp--preset--gradient--very-light-gray-to-cyan-bluish-gray) !important;}.has-cool-to-warm-spectrum-gradient-background{background: var(--wp--preset--gradient--cool-to-warm-spectrum) !important;}.has-blush-light-purple-gradient-background{background: var(--wp--preset--gradient--blush-light-purple) !important;}.has-blush-bordeaux-gradient-background{background: var(--wp--preset--gradient--blush-bordeaux) !important;}.has-luminous-dusk-gradient-background{background: var(--wp--preset--gradient--luminous-dusk) !important;}.has-pale-ocean-gradient-background{background: var(--wp--preset--gradient--pale-ocean) !important;}.has-electric-grass-gradient-background{background: var(--wp--preset--gradient--electric-grass) !important;}.has-midnight-gradient-background{background: var(--wp--preset--gradient--midnight) !important;}.has-small-font-size{font-size: var(--wp--preset--font-size--small) !important;}.has-medium-font-size{font-size: var(--wp--preset--font-size--medium) !important;}.has-large-font-size{font-size: var(--wp--preset--font-size--large) !important;}.has-x-large-font-size{font-size: var(--wp--preset--font-size--x-large) !important;}.has-normal-font-size{font-size: var(--wp--preset--font-size--normal) !important;}.has-huge-font-size{font-size: var(--wp--preset--font-size--huge) !important;} 98/*# sourceURL=global-styles-inline-css */ 99</style> 100 101<style id="jetpack-stats-inline-css"> 102img#wpstats{display:none} 103/*# sourceURL=jetpack-stats-inline-css */ 104</style> 105<link rel='stylesheet' id='dashicons-css' href='https://textslashplain.com/wp-includes/css/dashicons.min.css?ver=7.1.2' media='all' /> 106<link rel='stylesheet' id='all-css-5637bb3f5c4191457f95b28bb1f10d1f' href='https://textslashplain.com/_static/??-eJyNjUEKwjAQRS9kO1Qo1YW4KXgAT9BOhhiazARnQuntjWQvLt/n896eOxQ2YoMciw+s4EvFld4e1hKiA7UjkoK9KBE40uC5M9mItU+Be1Q97X9bUFIWrkdtyy8FyhoFN4XAGEstw0yZ2BFjqPCQeXHugGczt0xcjNS+xnu6DdPlOo7jMJ0/oihXWg==' type='text/css' media='all' /> 107<link rel='stylesheet' id='print-css-fc6cea5c2493407b3b9187e241ceda9f' href='https://textslashplain.com/wp-content/themes/varia/print.css?m=1738187798' type='text/css' media='print' /> 108<link rel='stylesheet' id='all-css-80b178224cc40b234b612085deb0c0a2' href='https://textslashplain.com/_static/??-eJyNjEsKhDAQBS80mTagmI14lCHTNhLtfEgnhLn94MKl4rJe8aolhTEUCgUS19UFgY1KsrjDxwWEL0fcBaS5RPmNIq92/fBxqUwCaHOsQnwKdQ5PA8UxLWq1zJR/d3QEZz/p0Qym06bv/9xmTnk=' type='text/css' media='all' /> 109<style id="jetpack_likes-inline-css"> 110#jp-post-flair{padding-top:.5em}#content div.sharedaddy,#main div.sharedaddy,div.sharedaddy{clear:both}div.sharedaddy h3.sd-title{display:inline-block;font-size:9pt;font-weight:700;line-height:1.2;margin:0 0 1em}div.sharedaddy h3.sd-title:before{border-top:1px solid #dcdcde;content:"";display:block;margin-bottom:1em;min-width:30px;width:100%}div.jetpack-likes-widget-wrapper{min-height:50px;position:relative;width:100%}div.jetpack-likes-widget-wrapper .sd-link-color{font-size:12px}div.jetpack-comment-likes-widget-wrapper{min-height:31px;position:relative;width:100%}div.jetpack-comment-likes-widget-wrapper iframe{margin-bottom:0}#likes-other-gravatars{background-color:#fff;border:1px solid #dcdcde;border-radius:4px;box-shadow:none;display:none;height:auto;max-height:240px;min-width:220px;overflow:auto;padding:9px 12px 10px;position:absolute;z-index:1000}#likes-other-gravatars *{line-height:normal}#likes-other-gravatars .likes-text{color:#101517;font-size:12px;font-weight:500;padding-bottom:8px}#likes-other-gravatars :is(li,ul){list-style-type:none;margin:0;padding:0;text-indent:0}#likes-other-gravatars li:before{content:""}#likes-other-gravatars ul.wpl-avatars{display:block;max-height:190px;overflow:auto}#likes-other-gravatars ul.wpl-avatars li{float:none;height:28px;margin:0 0 4px;width:196px}#likes-other-gravatars ul.wpl-avatars li a{align-items:center;border-bottom:none!important;display:flex;gap:8px;margin:0 2px 0 0;text-decoration:none}#likes-other-gravatars ul.wpl-avatars li a span{color:#2c3338;font-size:12px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}#likes-other-gravatars ul.wpl-avatars li a img{background:none;border:none;border-radius:50%;box-sizing:border-box;margin:0!important;padding:1px!important;position:static}div.sd-box{border-top:1px solid #00000021}.jetpack-likes-widget-loaded iframe,.jetpack-likes-widget-loading .likes-widget-placeholder,.jetpack-likes-widget-unloaded .likes-widget-placeholder{display:block}.jetpack-likes-widget-loaded .likes-widget-placeholder,.jetpack-likes-widget-loading iframe,.jetpack-likes-widget-unloaded iframe{display:none}.comment-likes-widget,.entry-content .post-likes-widget,.post-likes-widget{border-width:0;margin:0}.comment-likes-widget-placeholder,.post-likes-widget-placeholder{border-width:0;margin:0;position:relative}.comment-likes-widget-placeholder{display:flex;font-family:-apple-system,BlinkMacSystemFont,Segoe UI,Roboto,Oxygen-Sans,Ubuntu,Cantarell,Helvetica Neue,sans-serif;height:18px;position:absolute}.comment-likes-widget-placeholder:before{background-image:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 24 24'%3E%3Cpath fill='none' d='M0 0h24v24H0z'/%3E%3Cpath fill='%232ea2cc' d='m12 2 2.582 6.953L22 9.257l-5.822 4.602L18.18 21 12 16.89 5.82 21l2.002-7.14L2 9.256l7.418-.304'/%3E%3C/svg%3E");background-repeat:no-repeat;background-size:16px 16px;color:#2ea2cc;content:"";display:inline-block;height:16px;padding-right:5px;position:relative;top:3px;width:16px}.post-likes-widget-placeholder .button{display:none}:is(.comment-likes-widget-placeholder,.post-likes-widget-placeholder) .loading{color:#999;font-size:12px}.comment-likes-widget-placeholder .loading{align-self:center;color:#4e4e4e;margin-top:4px;padding-left:5px}
110div.sharedaddy.sd-like-enabled .sd-like h3{display:none}div.sharedaddy.sd-like-enabled .sd-like .post-likes-widget{float:none;position:absolute;top:0;width:100%}.comment-likes-widget{width:100%}.cs-rating,.pd-rating{display:block!important}.sd-gplus .sd-title{display:none}@media print{.jetpack-likes-widget-wrapper{display:none}} 111/*# sourceURL=https://textslashplain.com/wp-content/plugins/jetpack/_inc/build/likes/style.min.css */ 112</style> 113<link rel='stylesheet' id='all-css-e8ef77940e185d27bf390aead6c358e3' href='https://textslashplain.com/_static/??wp-content/themes/morden/style.css,wp-content/themes/varia/inc/style-wpcom.css?m=1738187798' type='text/css' media='all' /> 114<link rel='stylesheet' id='morden-fonts-css' href='https://fonts-api.wp.com/css?family=Noto+Sans%3A400%2C400i%2C700%2C700i&subset=latin%2Clatin-ext' media='all' /> 115<link rel='stylesheet' id='all-css-7aa849586d0df372f8f5df5ea0492a17' href='https://textslashplain.com/wp-content/themes/morden/style.css?m=1738187798' type='text/css' media='all' /> 116<style id="jetpack-global-styles-frontend-style-inline-css"> 117:root { --font-headings: unset; --font-base: unset; --font-headings-default: -apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Oxygen-Sans,Ubuntu,Cantarell,"Helvetica Neue",sans-serif; --font-base-default: -apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Oxygen-Sans,Ubuntu,Cantarell,"Helvetica Neue",sans-serif;} 118/*# sourceURL=jetpack-global-styles-frontend-style-inline-css */ 119</style>
120<script id="jetpack-mu-wpcom-settings-js-before"> 121var JETPACK_MU_WPCOM_SETTINGS = {"assetsUrl":"https://textslashplain.com/wp-content/mu-plugins/wpcomsh/jetpack_vendor/automattic/jetpack-mu-wpcom/src/build/"}; 122//# sourceURL=jetpack-mu-wpcom-settings-js-before 123</script>
123 124<link rel="https://api.w.org/" href="https://textslashplain.com/wp-json/" /><link rel="EditURI" type="application/rsd+xml" title="RSD" href="https://textslashplain.com/xmlrpc.php?rsd" /> 125 126<link rel='shortlink' href='https://wp.me/60i9o' /> 127 <style type="text/css"> 128 .recentcomments a { 129 display: inline !important; 130 padding: 0 !important; 131 margin: 0 !important; 132 } 133 134 table.recentcommentsavatartop img.avatar, table.recentcommentsavatarend img.avatar { 135 border: 0; 136 margin: 0; 137 } 138 139 table.recentcommentsavatartop a, table.recentcommentsavatarend a { 140 border: 0 !important; 141 background-color: transparent !important; 142 } 143 144 td.recentcommentsavatarend, td.recentcommentsavatartop { 145 padding: 0 0 1px 0; 146 margin: 0; 147 } 148 149 td.recentcommentstextend { 150 border: none !important; 151 padding: 0 0 2px 10px; 152 } 153 154 .rtl td.recentcommentstextend { 155 padding: 0 10px 2px 0; 156 } 157 158 td.recentcommentstexttop { 159 border: none; 160 padding: 0 0 0 10px; 161 } 162 163 .rtl td.recentcommentstexttop { 164 padding: 0 10px 0 0; 165 } 166 </style> 167 <meta name="description" content="ericlaw talks about security, the web, and software in general" /> 168 169<!-- Jetpack Open Graph Tags --> 170<meta property="og:type" content="website" /> 171<meta property="og:title" content="text/plain" /> 172<meta property="og:description" content="ericlaw talks about security, the web, and software in general" /> 173<meta property="og:url" content="https://textslashplain.com/" /> 174<meta property="og:site_name" content="text/plain" /> 175<meta property="og:image" content="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/02/cropped-fb_img_1677942992666.jpg?fit=512%2C512&ssl=1" /> 176<meta property="og:image:width" content="512" /> 177<meta property="og:image:height" content="512" /> 178<meta property="og:image:alt" content="" /> 179<meta property="og:locale" content="en_US" /> 180 181<!-- End Jetpack Open Graph Tags --> 182<link rel="icon" href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/02/cropped-fb_img_1677942992666.jpg?fit=32%2C32&ssl=1" sizes="32x32" /> 183<link rel="icon" href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/02/cropped-fb_img_1677942992666.jpg?fit=192%2C192&ssl=1" sizes="192x192" /> 184<link rel="apple-touch-icon" href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/02/cropped-fb_img_1677942992666.jpg?fit=180%2C180&ssl=1" /> 185<meta name="msapplication-TileImage" content="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/02/cropped-fb_img_1677942992666.jpg?fit=270%2C270&ssl=1" /> 186<style type="text/css" id="wp-custom-css">/* 187Welcome to Custom CSS! 188 189To learn how this works, see https://wp.me/PEmnE-Bt 190*/ 191#masthead { 192 background: #0B61A5; 193} 194 195.entry-title { 196 text-decoration-line: overline underline; 197 color: #0B61A5; 198} 199 200:root { 201 --bg-color: #ffffff; 202 --text-color: #333333; 203} 204 205@media (prefers-color-scheme: dark) { 206 :root { 207 --bg-color: #1a1a1a; 208 --text-color: #f0f0f0; 209 } 210} 211 212footer, div#page.site, .site-main, body { 213 background-color: var(--bg-color); 214 color: var(--text-color); 215 transition: background-color 0.3s ease, color 0.3s ease; 216}</style><link rel='stylesheet' id='all-css-8381d57c63639341d67b857e4ecf2e89' href='https://textslashplain.com/wp-content/plugins/jetpack/modules/widgets/gravatar-profile.css?m=1764003632' type='text/css' media='all' /> 217<link rel='stylesheet' id='gravatar-card-services-css' href='https://secure.gravatar.com/css/services.css?ver=202639' media='all' /> 218 219</head> 220 221<body class="home blog wp-embed-responsive wp-theme-varia wp-child-theme-morden hfeed image-filters-enabled"> 222 223 224<div id="page" class="site"> 225 <a class="skip-link screen-reader-text" href="#content">Skip to content</a> 226 227 228<header id="masthead" class="site-header" role="banner"> 229 <div class="site-header-wrap responsive-max-width has-title-and-tagline"> 230 231 232 <h1 class="site-title"><a href="https://textslashplain.com/" rel="home">text/plain</a></h1> 233 234 <p class="site-description"> 235 ericlaw talks about security, the web, and software in general </p> 236 </div><!-- .site-header-wrap --> 237</header><!-- #masthead --> 238
239 <div id="content" class="site-content"> 240 241 <section id="primary" class="content-area"> 242 <main id="main" class="site-main"> 243 244 245<article id="post-15709" class="post-15709 post type-post status-publish format-standard hentry category-design category-dev category-tech category-web tag-browsers tag-defender tag-hsts entry"> 246 <header class="entry-header responsive-max-width"> 247 <h2 class="entry-title"><a href="https://textslashplain.com/2026/09/11/experimentation-just-try-it/" rel="bookmark">Experimentation: Just Try It!</a></h2> </header><!-- .entry-header --> 248 249 250 <div class="entry-content"> 251 252<p class="wp-block-paragraph">I’ve now been working in tech for 25 years, and in that time I’ve developed some wisdom. One theme I’ve discovered and blogged about repeatedly over the years is profound despite its simplicity:</p> 253 254 255 256<p class="has-text-align-center wp-block-paragraph"><em><strong>In many cases, the best way to know whether something will work is to <span style="text-decoration: underline;">just try it</span>.</strong></em></p> 257 258 259 260<p class="wp-block-paragraph">I’ve written numerous posts making fundamentally the same point:</p> 261 262 263 264<ul class="wp-block-list"> 265<li>Want to <a href="https://textslashplain.com/2023/05/15/detecting-when-the-user-is-offline/">detect if a user is online</a>? Just try sending a request!</li> 266 267 268 269<li>Want to know if a new feature will result in user churn or crashes? <a href="https://textslashplain.com/2019/07/16/updating-browsers-quickly-flags-respins-and-components/#:~:text=using%20ChromiumDash.-,Field%20Trial%20Flags,-In%20some%20cases">Conduct a field trial with feature flags</a>!</li> 270 271 272 273<li>Want to know how a setting, ASR Rule, or Group Policy will behave? Create a trivial test and <a href="https://textslashplain.com/2020/02/09/demystifying-browsers/#:~:text=it%E2%80%99s%20often%20easiest%20to%20definitively%20answer%20questions%20about%20how%20browsers%20work%20by%20trying%20things">try it out</a>!</li> 274 275 276 277<li>Want to know if your app or site will work after the next browser update? <a href="https://textslashplain.com/2022/08/04/understanding-browser-channels/">Try a pre-release channel</a>!</li> 278 279 280 281<li>Want to know if you’re likely to be broken in the future? Use a <a href="https://textslashplain.com/2021/10/01/practical-time-machines/">practical time machine</a> to check!</li> 282</ul> 283 284 285 286<p class="wp-block-paragraph">While I believe experimentation is usually the <em>best </em>approach, it’s not <em>always </em>practical to try things out — you might not have the time, resources, or expertise required to experiment. And sometimes your experiment might be flawed and talking to an expert or reading the spec or code might reveal hidden complexities you didn’t foresee. </p> 287 288 289 290<p class="wp-block-paragraph">Beyond that, unfortunately some systems weren’t designed to facilitate experimentation.</p> 291 292 293 294<h3 class="wp-block-heading">Experimentation vs. Trapdoors</h3> 295 296 297 298<p class="wp-block-paragraph">In this <a href="https://www.youtube.com/watch?v=rxsdOQa_QkM">short clip</a>, Jeff Bezos talks about decision making and the importance of recognizing the difference between a “two-way door” decision and a “one-way door” (trapdoor) decision. Put simply: If a decision can be easily reversed, you should make it quickly and without too much thought, avoiding analysis paralysis.<em> Just try it</em>! </p> 299 300 301 302<p class="wp-block-paragraph">In contrast, making a <strong>trapdoor </strong>decision requires much more thought: when a mistake would be very costly or unrecoverable, it is worthwhile to invest significant energy in making sure that your first choice is the best one. </p> 303 304 305<div class="wp-block-image"> 306<figure class="aligncenter size-large is-resized"><a href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/09/image-2.png?ssl=1"><img data-recalc-dims="1" fetchpriority="high" decoding="async" width="750" height="750" data-attachment-id="15720" data-permalink="https://textslashplain.com/2026/09/11/experimentation-just-try-it/image-743/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/09/image-2.png?fit=1254%2C1254&ssl=1" data-orig-size="1254,1254" data-comments-opened="1" data-image-meta="{"aperture":"0","credit":"","camera":"","caption":"","created_timestamp":"0","copyright":"","focal_length":"0","iso":"0","shutter_speed":"0","title":"","orientation":"0","alt":""}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/09/image-2.png?fit=750%2C750&ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/09/image-2.png?resize=750%2C750&ssl=1" alt="" class="wp-image-15720" style="width:594px;height:auto" srcset="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/09/image-2.png?resize=1024%2C1024&ssl=1 1024w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/09/image-2.png?resize=300%2C300&ssl=1 300w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/09/image-2.png?resize=150%2C150&ssl=1 150w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/09/image-2.png?resize=768%2C768&ssl=1 768w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/09/image-2.png?w=1254&
306ssl=1 1254w" sizes="(max-width: 750px) 100vw, 750px" /></a></figure> 307</div> 308 309 310<p class="wp-block-paragraph">In my experience, there are relatively few trapdoor actions in the real-world: yes, it’s often worthwhile to “<em>measure twice and cut once</em>“, but the number of actions with unrecoverable outcomes is small and such circumstances are typically obvious. </p> 311 312 313 314<h3 class="wp-block-heading">Design for Experimentation</h3> 315 316 317 318<p class="wp-block-paragraph">To the extent possible, designers should strive to build products and standards that facilitate experimentation, allowing easy recovery if the user makes a mistake. </p> 319 320 321 322<p class="wp-block-paragraph">Why? Customers <em>prefer </em>products where they can “<em>just play with it</em>” without fear of consequences. Fearless experimentation helps smooth over other product shortcomings, including inadequate/outdated documentation, excessive complexity, or confusing UX. </p> 323 324 325 326<h4 class="wp-block-heading">Observability</h4> 327 328 329 330<p class="wp-block-paragraph">An experiment is risky if the outcome cannot be determined.</p> 331 332 333 334<p class="wp-block-paragraph">One important characteristic of experiment-friendly designs is that the experimenter can determine the result of the experiment. In some cases, the user can directly observe the result– desktop publishing software got much easier to use with the invention of “print preview” and what-you-see-is-what-you-get (<a href="https://en.wikipedia.org/wiki/WYSIWYG">WYSIWYG</a>). In others, the product needs instrumentation and telemetry to determine the outcome (e.g. “<em>With the new compositor feature flag enabled, our crash rate increased by 4%</em>).</p> 335 336 337 338<p class="wp-block-paragraph">Sometimes the best way to make an experiment safe is to allow observation of the outcome <em>without actually making the change</em> (e.g. “print preview” shows the outcome without actually wasting paper); some products offer a “simulation” mode. </p> 339 340 341 342<h4 class="wp-block-heading">Revertability</h4> 343 344 345 346<p class="wp-block-paragraph">An experiment is risky if getting back to the default or prior state is impossible or difficult.</p> 347 348 349 350<p class="wp-block-paragraph">If getting back to the prior or default state requires that the user keep track of everything they changed and manually undo each operation, users will be reluctant to touch <em>anything</em> for fear of breaking a working configuration. You should strive to make it simple to go back to the prior configuration, or, at the very least offer a single click “Reset to defaults” button.</p> 351 352 353 354<h4 class="wp-block-heading">Latency</h4> 355 356 357 358<p class="wp-block-paragraph">An experiment is risky if undoing the experiment takes too much time.</p> 359 360 361 362<p class="wp-block-paragraph">For example, the Web Platform’s <a href="https://textslashplain.com/tag/hsts/">Strict Transport Security</a> feature allows a site to announce that it is only loadable over HTTPS, refusing to load over HTTP. A site owner can even decree that browsers should “pre-load” this enforcement to protect every visitor’s first visit. The problem is that the browser’s <a href="https://hstspreload.org/">HSTS Preload list</a> only updates every few weeks, meaning <a href="https://textslashplain.com/2018/04/09/hsts-preload-and-subdomains/">a common mistake</a> is that a site owner preloads their entire domain but quickly learns that some overlooked subdomains only support HTTP. Then they panic and beg the browser vendors for help, but it’s too late — it’ll be weeks before their domain can be removed from the preload list. <em>Oops</em>.</p> 363 364 365<div class="wp-block-image"> 366<figure class="aligncenter size-full is-resized"><a href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/09/image-4.png?ssl=1"><img data-recalc-dims="1" decoding="async" width="750" height="277" data-attachment-id="15731" data-permalink="https://textslashplain.com/2026/09/11/experimentation-just-try-it/image-745/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/09/image-4.png?fit=750%2C277&ssl=1" data-orig-size="750,277" data-comments-opened="1" data-image-meta="{"aperture":"0","credit":"","camera":"","caption":"","created_timestamp":"0","copyright":"","focal_length":"0","iso":"0","shutter_speed":"0","title":"","orientation":"0","alt":""}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/09/image-4.png?fit=750%2C277&ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/09/image-4.png?resize=750%2C277&ssl=1" alt="" class="wp-image-15731" style="aspect-ratio:2.7076775540136513;width:624px;height:auto" srcset="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/09/image-4.png?w=750&ssl=1 750w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/09/image-4.png?resize=300%2C111&
366ssl=1 300w" sizes="(max-width: 750px) 100vw, 750px" /></a><figcaption class="wp-element-caption">Timeline of misery (Browsers now ship even faster, but the time-to-recover is still very long)</figcaption></figure> 367</div> 368 369 370<p class="wp-block-paragraph">The Web Platform’s <a href="https://tools.ietf.org/html/rfc7469">HTTP Public Key Pinning feature</a> was so often a source of self-inflicted outages that the feature was <a href="https://chromestatus.com/feature/5903385005916160">removed from Chrome entirely</a> in version 72.</p> 371 372 373 374<p class="wp-block-paragraph">As a less extreme example, <a href="https://textslashplain.com/2025/04/07/understanding-smartscreen-and-network-protection/">Microsoft Defender’s Network Protection</a> Indicators feature allows an organization to block any “indicator” (domain, IP address, code-signing certificate or executable file’s hash). When the Security Operation Center adds a block against an indicator, Defender will prevent access to the resource. For example, if your IT department configures a Defender Custom Certificate Indicator to forbid use of Notepad++ inside your enterprise, attempting to download or run the installer will <a href="https://textslashplain.com/2026/01/27/microsoft-defender-false-positives/#:~:text=block%20from%20Company%20Policy">result in a block</a>:</p> 375 376 377<div class="wp-block-image"> 378<figure class="aligncenter size-full is-resized"><a href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/09/image-3.png?ssl=1"><img data-recalc-dims="1" decoding="async" width="750" height="671" data-attachment-id="15725" data-permalink="https://textslashplain.com/2026/09/11/experimentation-just-try-it/image-744/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/09/image-3.png?fit=964%2C863&ssl=1" data-orig-size="964,863" data-comments-opened="1" data-image-meta="{"aperture":"0","credit":"","camera":"","caption":"","created_timestamp":"0","copyright":"","focal_length":"0","iso":"0","shutter_speed":"0","title":"","orientation":"0","alt":""}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/09/image-3.png?fit=750%2C671&ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/09/image-3.png?resize=750%2C671&ssl=1" alt="" class="wp-image-15725" style="aspect-ratio:1.1170560329394916;width:494px;height:auto" srcset="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/09/image-3.png?w=964&ssl=1 964w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/09/image-3.png?resize=300%2C269&ssl=1 300w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/09/image-3.png?resize=768%2C688&ssl=1 768w" sizes="(max-width: 750px) 100vw, 750px" /></a></figure> 379</div> 380 381 382<p class="wp-block-paragraph">But what happens if the SOC administrator read some threat intelligence and naively decided to block <code>s3.amazonaws.com</code> via a network indicator? They would very quickly find that a huge number of websites that use Amazon S3 storage fail to load correctly, preventing their colleagues from loading mission-critical web applications. The SOC admin would immediately delete the errant indicator, but because changes to Defender’s indicators typically take <strong>two hours </strong>to propagate to all devices, they’ve just created an expensive <strong>outage</strong>. </p> 383 384 385 386<p class="wp-block-paragraph">Custom Indicators are an extremely powerful feature, but to experiment with them safely the admin cannot blindly “<em>set it and forget it</em>.”</p> 387 388 389 390<h4 class="wp-block-heading">Audit/ReportOnly Mode</h4> 391 392 393 394<p class="wp-block-paragraph">An experiment is safe if running the experiment is harmless. </p> 395 396 397 398<p class="wp-block-paragraph">Defender’s Indicators feature allows the admin to specify that the indicator should run in <strong>
398<a href="https://learn.microsoft.com/en-us/defender-endpoint/indicators-overview#:~:text=on%20your%20devices.-,Audit,-%3A%20an%20alert%20is">audit mode</a></strong>. While an indicator is in Audit mode, the SOC will receive a notice if the indicator <em>would have</em> triggered in warn/block mode. To safely deploy an indicator, admins should always first deploy the indicator in audit mode and wait, watching for any alerts that indicate unexpected blocking. Only after a successful trial period should an IOC be set to warn/block mode. </p> 399 400 401 402<p class="wp-block-paragraph">System designers can design systems that encourage safe experimentation, for instance, by not allowing an Indicator to directly be set to block mode until an audit period has elapsed.</p> 403 404 405 406<p class="wp-block-paragraph">Audit/Report modes don’t just exist for Defender Indicators, of course. Web Platform features like <code>Content-Security-Policy</code> allow a <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy-Report-Only"><code>report only</code> mode</a> where content that violates the directives results in a telemetry report that can be <a href="https://report-uri.com/">logged</a> for validation before moving into enforcement mode. </p> 407 408 409 410<h4 class="wp-block-heading">“<em>Careful This Thing’s Loaded!</em>“</h4> 411 412 413 414<p class="wp-block-paragraph">When it’s not possible to make decisions easily reversible, there should be prominent warnings to alert the user to the risk. </p> 415 416 417 418<figure class="wp-block-image size-large"><a href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/09/image.png?ssl=1"><img data-recalc-dims="1" loading="lazy" decoding="async" width="750" height="576" data-attachment-id="15716" data-permalink="https://textslashplain.com/2026/09/11/experimentation-just-try-it/image-741/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/09/image.png?fit=1383%2C1061&ssl=1" data-orig-size="1383,1061" data-comments-opened="1" data-image-meta="{"aperture":"0","credit":"","camera":"","caption":"","created_timestamp":"0","copyright":"","focal_length":"0","iso":"0","shutter_speed":"0","title":"","orientation":"0","alt":""}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/09/image.png?fit=750%2C576&ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/09/image.png?resize=750%2C576&ssl=1" alt="" class="wp-image-15716" srcset="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/09/image.png?resize=1024%2C786&ssl=1 1024w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/09/image.png?resize=300%2C230&ssl=1 300w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/09/image.png?resize=768%2C589&ssl=1 768w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/09/image.png?w=1383&ssl=1 1383w" sizes="auto, (max-width: 750px) 100vw, 750px" /></a></figure> 419 420 421 422<p class="wp-block-paragraph">The HSTSPreload website requires that the admin undertake a number of technical steps, and warns (although arguably not sufficiently prominently) of the implications of preloading:</p> 423 424 425 426<figure class="wp-block-image size-full"><a href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/09/image-5.png?ssl=1"><img data-recalc-dims="1" loading="lazy" decoding="async" width="750" height="290" data-attachment-id="15733" data-permalink="https://textslashplain.com/2026/09/11/experimentation-just-try-it/image-746/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/09/image-5.png?fit=920%2C356&ssl=1" data-orig-size="920,356" data-comments-opened="1" data-image-meta="{"aperture":"0","credit":"","camera":"","caption":"","created_timestamp":"0","copyright":"","focal_length":"0","iso":"0","shutter_speed":"0","title":"","orientation":"0","alt":""}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/09/image-5.png?fit=750%2C290&ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/09/image-5.png?resize=750%2C290&ssl=1" alt="" class="wp-image-15733" srcset="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/09/image-5.png?w=920&ssl=1 920w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/09/image-5.png?resize=300%2C116&ssl=1 300w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/09/image-5.png?resize=768%2C297&
426ssl=1 768w" sizes="auto, (max-width: 750px) 100vw, 750px" /></a></figure> 427 428 429 430<p class="wp-block-paragraph"></p> 431 432 433 434<h3 class="wp-block-heading">Constant Vigilence</h3> 435 436 437 438<p class="wp-block-paragraph">I’ve <a href="https://textslashplain.com/2021/10/01/practical-time-machines/">previously argued</a> â<em>The definition of insanity is doing the same thing over and over again, and expecting the</em> same <em>results</em>” and my linked blog post explains why. You cannot assume that just because you’ve carefully experimented and tuned before setting a policy that the resulting behavior will never cause you problems. Over time, your devices will get software updates, your users will try out new scenarios, and you will probably even get new employees that exercise new functionality. Even if you follow <a href="https://textslashplain.com/2021/10/01/practical-time-machines/#:~:text=Practical%20Time%20Machine%20%E2%80%93%20Channels">best practices to stay ahead of your users</a>, you will always need to have appropriate monitoring in place to get notice of any behavioral breakages that slip by your testing. </p> 439 440 441 442<p class="wp-block-paragraph"></p> 443 444 445 446<p class="wp-block-paragraph">Thanks for your help in building better products and using them more effectively!</p> 447 448 449 450<p class="wp-block-paragraph">-Eric</p> 451 </div><!-- .entry-content --> 452 453 <footer class="entry-footer responsive-max-width"> 454 <span class="byline"><svg class="svg-icon" width="16" height="16" aria-hidden="true" role="img" focusable="false" viewBox="0 0 24 24" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><path d="M12 12c2.21 0 4-1.79 4-4s-1.79-4-4-4-4 1.79-4 4 1.79 4 4 4zm0 2c-2.67 0-8 1.34-8 4v2h16v-2c0-2.66-5.33-4-8-4z"></path><path d="M0 0h24v24H0z" fill="none"></path></svg><span class="screen-reader-text">Posted by</span><span class="author vcard"><a class="url fn n" href="https://textslashplain.com/author/ericlaw1979/">ericlaw</a></span></span><span class="posted-on"><svg class="svg-icon" width="16" height="16" aria-hidden="true" role="img" focusable="false" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><defs><path id="a" d="M0 0h24v24H0V0z"></path></defs><clipPath id="b"><use xlink:href="#a" overflow="visible"></use></clipPath><path clip-path="url(#b)" d="M12 2C6.5 2 2 6.5 2 12s4.5 10 10 10 10-4.5 10-10S17.5 2 12 2zm4.2 14.2L11 13V7h1.5v5.2l4.5 2.7-.8 1.3z"></path></svg><a href="https://textslashplain.com/2026/09/11/experimentation-just-try-it/" rel="bookmark"><time class="entry-date published" datetime="2026-09-11T16:32:23-05:00">2026-09-11</time><time class="updated" datetime="2026-09-17T10:27:08-05:00">2026-09-17</time></a></span><span class="cat-links"><svg class="svg-icon" width="16" height="16" aria-hidden="true" role="img" focusable="false" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M10 4H4c-1.1 0-1.99.9-1.99 2L2 18c0 1.1.9 2 2 2h16c1.1 0 2-.9 2-2V8c0-1.1-.9-2-2-2h-8l-2-2z"></path><path d="M0 0h24v24H0z" fill="none"></path></svg><span class="screen-reader-text">Posted in</span><a href="https://textslashplain.com/category/design/" rel="category tag">design</a>, <a href="https://textslashplain.com/category/dev/" rel="category tag">dev</a>, <a href="https://textslashplain.com/category/tech/" rel="category tag">tech</a>, <a href="https://textslashplain.com/category/tech/web/" rel="category tag">web</a></span><span class="tags-links"><svg class="svg-icon" width="16" height="16" aria-hidden="true" role="img" focusable="false" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M21.41 11.58l-9-9C12.05 2.22 11.55 2 11 2H4c-1.1 0-2 .9-2 2v7c0 .55.22 1.05.59 1.42l9 9c.36.36.86.58 1.41.58.55 0 1.05-.22 1.41-.59l7-7c.37-.36.59-.86.59-1.41 0-.55-.23-1.06-.59-1.42zM5.5 7C4.67 7 4 6.33 4 5.5S4.67 4 5.5 4 7 4.67 7 5.5 6.33 7 5.5 7z"></path><path d="M0 0h24v24H0z" fill="none"></path></svg><span class="screen-reader-text">Tags:</span><a href="https://textslashplain.com/tag/browsers/" rel="tag">browsers</a>, <a href="https://textslashplain.com/tag/defender/" rel="tag">Defender</a>, <a href="https://textslashplain.com/tag/hsts/" rel="tag">HSTS</a></span><span class="comments-link"><svg class="svg-icon" width="16" height="16" aria-hidden="true" role="img" focusable="false" viewBox="0 0 24 24" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><path d="M21.99 4c0-1.1-.89-2-1.99-2H4c-1.1 0-2 .9-2 2v12c0 1.1.9 2 2 2h14l4 4-.01-18z"></path><path d="M0 0h24v24H0z" fill="none"></path></svg><a href="https://textslashplain.com/2026/09/11/experimentation-just-try-it/#respond">Leave a comment<span class="screen-reader-text"> on Experimentation: Just Try It!</span></a></span> </footer><!-- .entry-footer --> 455</article><!-- #post-${ID} --> 456 457<article id="post-15699" class="post-15699 post type-post status-publish format-standard hentry category-browsers category-design category-security entry"> 458 <header class="entry-header responsive-max-width"> 459 <h2 class="entry-title"><a href="https://textslashplain.com/2026/09/10/simple-browser-security-improvements/" rel="bookmark">Simple Browser Security Improvements</a></h2> </header><!-- .entry-header --> 460 461 462 <div class="entry-content"> 463 464<p class="wp-block-paragraph">Security Engineering is all about tradeoffs: </p> 465 466 467 468<ul class="wp-block-list"> 469<li><a href="https://textslashplain.com/2023/10/04/security-tradeoffs-privacy/">Security vs. Privacy</a></li> 470 471 472 473<li>Security vs. Performance</li> 474 475 476 477<li>Security vs. Compatibility</li> 478 479 480 481<li>Security vs. Usability</li> 482</ul> 483 484 485 486<p class="wp-block-paragraph">Web Browsers attempt to achieve an absolutely bananas goal: Allow safe execution of untrusted content on a user’s device.</p> 487 488 489 490<p class="wp-block-paragraph">Browsers are a huge vector for compromise of users’ devices and personal information, owing to the power and complexity. Much of the vulnerability induced by browsers occur where tradeoffs were either made poorly initially, or where the tradeoff would be made differently knowing what we know now.</p> 491 492 493 494<p class="wp-block-paragraph">So, what should we do? Here’s a modest list of proposals, many of which could be achieved in less than one dev day:</p> 495 496 497 498<ol class="wp-block-list"> 499<li>Disallow <a href="https://textslashplain.com/2023/09/12/attack-techniques-fullscreen-abuse/">random websites from going fullscreen</a> without permission</li> 500 501 502 503<li>Allow simple Enterprise control of what <a href="https://textslashplain.com/2023/04/05/file-types/">types of files</a> are allowed to download — current controls are <a href="https://textslashplain.com/2021/05/19/download-blocking-by-file-type/#:~:text=for%20dangerous%20content.-,Group%20Policies,-DownloadRestrictions%20is%20a">comically underpowered</a>. (<a href="https://issues.chromium.org/issues/40265750">https://issues.chromium.org/issues/40265750</a>)</li> 504 505 506 507<li>Block download UI launch of <a href="https://textslashplain.com/2024/05/20/attack-techniques-full-trust-script-downloads/">high-risk file types</a> that the OS has inexplicably failed to secure</li> 508 509 510 511<li>Introduce a pre-fetch security check to allow security software to block malicious requests (similar to <a href="https://textslashplain.com/2025/06/10/apple-url-filter-api/">this</a>)</li> 512 513 514 515<li>Call <a href="https://textslashplain.com/2024/10/25/defensive-technology-antimalware-scan-interface-amsi/">AMSI</a> to <a href="https://textslashplain.com/2025/04/15/vibe-coding-for-security/">detect malicious content copied to the clipboard</a> (<a href="https://issues.chromium.org/issues/440381280">https://issues.chromium.org/issues/440381280</a>)</li> 516 517 518 519<li>Call AMSI when installing a new <a href="https://textslashplain.com/2024/03/07/browser-extensions-powerful-and-potentially-dangerous/">browser extension</a> or restarting the browser to allow local security software insight of what code can impact the user’s browsing experience</li> 520 521 522 523<li>Stop supporting <a href="https://textslashplain.com/2023/03/22/attack-techniques-spoofing-via-userinfo/">UserInfo in URLs</a> or introduce a warning</li> 524 525 526 527<li>Disallow user-navigation to <code>javascript:</code> URLs or introduce a warning (<a href="https://issues.chromium.org/issues/559142626">https://issues.chromium.org/issues/559142626</a>)</li> 528 529 530 531<li>Further restrict notification permissions to prevent <a href="https://textslashplain.com/2022/09/27/badware-techniques-notification-spam/">scams and spam</a></li> 532 533 534 535<li><em>more to come, I’m sure</em></li> 536</ol> 537 538 539 540<p class="wp-block-paragraph"></p> 541 </div><!-- .entry-content --> 542 543 <footer class="entry-footer responsive-max-width"> 544 <span class="byline"><svg class="svg-icon" width="16" height="16" aria-hidden="true" role="img" focusable="false" viewBox="0 0 24 24" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><path d="M12 12c2.21 0 4-1.79 4-4s-1.79-4-4-4-4 1.79-4 4 1.79 4 4 4zm0 2c-2.67 0-8 1.34-8 4v2h16v-2c0-2.66-5.33-4-8-4z"></path><path d="M0 0h24v24H0z" fill="none"></path></svg><span class="screen-reader-text">Posted by</span><span class="author vcard"><a class="url fn n" href="https://textslashplain.com/author/ericlaw1979/">ericlaw</a></span></span><span class="posted-on"><svg class="svg-icon" width="16" height="16" aria-hidden="true" role="img" focusable="false" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><defs><path id="a" d="M0 0h24v24H0V0z"></path></defs><clipPath id="b"><use xlink:href="#a" overflow="visible"></use></clipPath><path clip-path="url(#b)" d="M12 2C6.5 2 2 6.5 2 12s4.5 10 10 10 10-4.5 10-10S17.5 2 12 2zm4.2 14.2L11 13V7h1.5v5.2l4.5 2.7-.8 1.3z"></path></svg><a href="https://textslashplain.com/2026/09/10/simple-browser-security-improvements/" rel="bookmark"><time class="entry-date published" datetime="2026-09-10T16:18:09-05:00">2026-09-10</time><time class="updated" datetime="2026-09-10T16:20:26-05:00">2026-09-10</time></a></span><span class="cat-links"><svg class="svg-icon" width="16" height="16" aria-hidden="true" role="img" focusable="false" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
544<path d="M10 4H4c-1.1 0-1.99.9-1.99 2L2 18c0 1.1.9 2 2 2h16c1.1 0 2-.9 2-2V8c0-1.1-.9-2-2-2h-8l-2-2z"></path><path d="M0 0h24v24H0z" fill="none"></path></svg><span class="screen-reader-text">Posted in</span><a href="https://textslashplain.com/category/browsers/" rel="category tag">browsers</a>, <a href="https://textslashplain.com/category/design/" rel="category tag">design</a>, <a href="https://textslashplain.com/category/security/" rel="category tag">security</a></span><span class="comments-link"><svg class="svg-icon" width="16" height="16" aria-hidden="true" role="img" focusable="false" viewBox="0 0 24 24" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><path d="M21.99 4c0-1.1-.89-2-1.99-2H4c-1.1 0-2 .9-2 2v12c0 1.1.9 2 2 2h14l4 4-.01-18z"></path><path d="M0 0h24v24H0z" fill="none"></path></svg><a href="https://textslashplain.com/2026/09/10/simple-browser-security-improvements/#comments">1 Comment<span class="screen-reader-text"> on Simple Browser Security Improvements</span></a></span> </footer><!-- .entry-footer --> 545</article><!-- #post-${ID} --> 546 547<article id="post-15472" class="post-15472 post type-post status-publish format-standard hentry category-security category-tech tag-defender tag-security tag-ui tag-windows entry"> 548 <header class="entry-header responsive-max-width"> 549 <h2 class="entry-title"><a href="https://textslashplain.com/2026/08/31/the-windows-security-app/" rel="bookmark">The Windows Security App</a></h2> </header><!-- .entry-header --> 550 551 552 <div class="entry-content"> 553 554<p class="wp-block-paragraph">Going back as far as the 2004 release of Windows XP SP2, Windows has offered <a href="https://en.wikipedia.org/wiki/Security_and_Maintenance">various GUIs</a> to help users understand the security state of their PC. In modern Windows 10 (<a href="https://en.wikipedia.org/wiki/Windows_10_version_history#:~:text=It%20was%20codenamed%20%22-,Redstone%202,-%22%20(RS2)%20during">RS2</a>+) and Windows 11, the latest version of this graphical user interface is called the “<a href="https://learn.microsoft.com/en-us/windows/security/operating-system-security/system-security/windows-defender-security-center/windows-defender-security-center">Windows Security Center/App</a>“.</p> 555 556 557 558<p class="wp-block-paragraph">The Windows Security App (WSA) is a surface upon which Windows exposes various settings and information, including lightweight status for antivirus and firewall products (including those built by third-parties) and entry points to those products’ user-experiences. </p> 559 560 561 562<p class="wp-block-paragraph">The WSA can be launched via the Start Menu, or by clicking on various toast notifications sent by features within the app.</p> 563 564 565<div class="wp-block-image"> 566<figure class="aligncenter size-full"><a href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-65.png?ssl=1"><img data-recalc-dims="1" loading="lazy" decoding="async" width="334" height="227" data-attachment-id="15483" data-permalink="https://textslashplain.com/2026/08/31/the-windows-security-app/image-717/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-65.png?fit=334%2C227&ssl=1" data-orig-size="334,227" data-comments-opened="1" data-image-meta="{"aperture":"0","credit":"","camera":"","caption":"","created_timestamp":"0","copyright":"","focal_length":"0","iso":"0","shutter_speed":"0","title":"","orientation":"0","alt":""}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-65.png?fit=334%2C227&ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-65.png?resize=334%2C227&ssl=1" alt="" class="wp-image-15483" srcset="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-65.png?w=334&ssl=1 334w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-65.png?resize=300%2C204&ssl=1 300w" sizes="auto, (max-width: 334px) 100vw, 334px" /></a></figure> 567</div> 568 569 570<p class="wp-block-paragraph">The default view aims to provide a “single status screen” showing the state of the system’s security components:</p> 571 572 573<div class="wp-block-image"> 574<figure class="aligncenter size-full is-resized"><a href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-66.png?ssl=1"><img data-recalc-dims="1" loading="lazy" decoding="async" width="750" height="724" data-attachment-id="15484" data-permalink="https://textslashplain.com/2026/08/31/the-windows-security-app/image-718/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-66.png?fit=842%2C813&ssl=1" data-orig-size="842,813" data-comments-opened="1" data-image-meta="{"aperture":"0","credit":"","camera":"","caption":"","created_timestamp":"0","copyright":"","focal_length":"0","iso":"0","shutter_speed":"0","title":"","orientation":"0","alt":""}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-66.png?fit=750%2C724&ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-66.png?resize=750%2C724&ssl=1" alt="" class="wp-image-15484" style="aspect-ratio:1.0356639004149377;width:575px;height:auto" srcset="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-66.png?w=842&
574ssl=1 842w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-66.png?resize=300%2C290&ssl=1 300w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-66.png?resize=768%2C742&ssl=1 768w" sizes="auto, (max-width: 750px) 100vw, 750px" /></a></figure> 575</div> 576 577 578<p class="wp-block-paragraph">This UI provides entry points into configuring <a href="https://textslashplain.com/2025/04/07/understanding-smartscreen-and-network-protection/">SmartScreen network reputation</a>, <a href="https://textslashplain.com/2023/08/23/smartscreen-application-reputation-in-pictures/">SmartScreen Application Reputation</a>, <a href="https://textslashplain.com/2026/04/28/smart-app-control/">Smart App Control</a>, <a href="https://textslashplain.com/2024/11/15/defensive-technology-controlled-folder-access/">controlled folder access</a>, <a href="https://textslashplain.com/2025/11/19/defensive-technology-ransomware-data-recovery/">ransomware recovery</a>, <a href="https://textslashplain.com/2025/04/01/defensive-technology-exploit-protection/">exploit protection</a>, <a href="https://textslashplain.com/2025/03/31/defensive-technology-windows-filtering-platform/#:~:text=features%20in%20Windows.-,Windows%20Firewall,-Most%20prominently%2C%20WFP">Windows Firewall</a>, and the device’s hardware security features.</p> 579 580 581 582<h2 class="wp-block-heading">Defender Antivirus</h2> 583 584 585 586<p class="wp-block-paragraph">By default, Windows includes Microsoft Defender Antivirus (MDAV) and the “Virus and Threat Protection” section of the WSA shows the state of MDAV, including details about the most recent scan, any previously-allowed threats, and the “Protection history” which outlines any threats previously encountered. </p> 587 588 589 590<p class="wp-block-paragraph">Notably, the WSA is also the <em>only </em>client graphical user-interface for Microsoft Defender Antivirus and Microsoft Defender for Endpoint security products: unlike all third-party security products on Windows there is not today a separate Defender app (<em>except our D4I product; keep reading</em>).</p> 591 592 593<div class="wp-block-image"> 594<figure class="aligncenter size-full"><a href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-68.png?ssl=1"><img data-recalc-dims="1" loading="lazy" decoding="async" width="582" height="483" data-attachment-id="15523" data-permalink="https://textslashplain.com/2026/08/31/the-windows-security-app/image-721/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-68.png?fit=582%2C483&ssl=1" data-orig-size="582,483" data-comments-opened="1" data-image-meta="{"aperture":"0","credit":"","camera":"","caption":"","created_timestamp":"0","copyright":"","focal_length":"0","iso":"0","shutter_speed":"0","title":"","orientation":"0","alt":""}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-68.png?fit=582%2C483&ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-68.png?resize=582%2C483&ssl=1" alt="" class="wp-image-15523" srcset="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-68.png?w=582&ssl=1 582w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-68.png?resize=300%2C249&ssl=1 300w" sizes="auto, (max-width: 582px) 100vw, 582px" /></a></figure> 595</div> 596 597 598<p class="wp-block-paragraph">The <strong>Quick scan</strong> button allows invoking a quick scan of sensitive system locations (primarily, locations used by malware to establish persistence), while the Scan options link allows invoking other types of scans:</p> 599 600 601<div class="wp-block-image"> 602<figure class="aligncenter size-full is-resized"><a href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-69.png?ssl=1"><img data-recalc-dims="1" loading="lazy" decoding="async" width="750" height="668" data-attachment-id="15525" data-permalink="https://textslashplain.com/2026/08/31/the-windows-security-app/image-722/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-69.png?fit=796%2C709&ssl=1" data-orig-size="796,709" data-comments-opened="1" data-image-meta="{"aperture":"0","credit":"","camera":"","caption":"","created_timestamp":"0","copyright":"","focal_length":"0","iso":"0","shutter_speed":"0","title":"","orientation":"0","alt":""}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-69.png?fit=750%2C668&ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-69.png?resize=750%2C668&ssl=1" alt="" class="wp-image-15525" style="aspect-ratio:1.1227340200620755;width:479px;height:auto" srcset="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-69.png?w=796&ssl=1 796w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-69.png?resize=300%2C267&ssl=1 300w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-69.png?resize=768%2C684&
602ssl=1 768w" sizes="auto, (max-width: 750px) 100vw, 750px" /></a></figure> 603</div> 604 605 606<p class="wp-block-paragraph">With that said, as outlined previously in my post about <a href="https://textslashplain.com/2026/04/10/understanding-defender-av-scans/">Understanding Defender AV Scans</a>, there is rarely any need to manually kick off an AV Scan.</p> 607 608 609 610<h2 class="wp-block-heading">Defender for Endpoint</h2> 611 612 613 614<p class="wp-block-paragraph">Until recently, the WSA would not show anything special if a device was onboarded to <a href="https://textslashplain.com/2024/11/18/security-software-an-overview/#:~:text=Microsoft%20Defender%20for%20Endpoint">Microsoft Defender for Endpoint (MDE),</a> the corporate version of Defender that adds numerous additional protection features beyond the free MDAV included with Windows. As I explained last month, it was previously non-trivial to determine whether a PC was <a href="https://textslashplain.com/2026/07/22/offboarding-from-microsoft-defender-for-endpoint/">onboarded to Defender for Endpoint’s XDR</a> and monitored by a Security Operations Center. </p> 615 616 617 618<p class="wp-block-paragraph">Fortunately, this has recently changed, and the WSA now shows specific information when a device is onboarded, including which MDE features are enabled:</p> 619 620 621<div class="wp-block-image"> 622<figure class="aligncenter size-full is-resized"><a href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-70.png?ssl=1"><img data-recalc-dims="1" loading="lazy" decoding="async" width="750" height="728" data-attachment-id="15530" data-permalink="https://textslashplain.com/2026/08/31/the-windows-security-app/image-723/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-70.png?fit=796%2C773&ssl=1" data-orig-size="796,773" data-comments-opened="1" data-image-meta="{"aperture":"0","credit":"","camera":"","caption":"","created_timestamp":"0","copyright":"","focal_length":"0","iso":"0","shutter_speed":"0","title":"","orientation":"0","alt":""}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-70.png?fit=750%2C728&ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-70.png?resize=750%2C728&ssl=1" alt="" class="wp-image-15530" style="aspect-ratio:1.0297673075336249;width:472px;height:auto" srcset="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-70.png?w=796&ssl=1 796w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-70.png?resize=300%2C291&ssl=1 300w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-70.png?resize=768%2C746&ssl=1 768w" sizes="auto, (max-width: 750px) 100vw, 750px" /></a></figure> 623</div> 624 625 626<p class="wp-block-paragraph">The <strong>Device Details </strong>link in the footer reveals more information, including status and version numbers of the protection components:</p> 627 628 629<div class="wp-block-image"> 630<figure class="aligncenter size-full is-resized"><a href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-71.png?ssl=1"><img data-recalc-dims="1" loading="lazy" decoding="async" width="647" height="714" data-attachment-id="15532" data-permalink="https://textslashplain.com/2026/08/31/the-windows-security-app/image-724/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-71.png?fit=647%2C714&ssl=1" data-orig-size="647,714" data-comments-opened="1" data-image-meta="{"aperture":"0","credit":"","camera":"","caption":"","created_timestamp":"0","copyright":"","focal_length":"0","iso":"0","shutter_speed":"0","title":"","orientation":"0","alt":""}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-71.png?fit=647%2C714&ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-71.png?resize=647%2C714&ssl=1" alt="" class="wp-image-15532" style="aspect-ratio:0.9061802424826016;width:377px;height:auto" srcset="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-71.png?w=647&ssl=1 647w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-71.png?resize=272%2C300&
630ssl=1 272w" sizes="auto, (max-width: 647px) 100vw, 647px" /></a></figure> 631</div> 632 633 634<h2 class="wp-block-heading">Third Party Antivirus</h2> 635 636 637 638<p class="wp-block-paragraph">When a 3rd party security product installs on a client version of Windows, it calls the Windows Security Center API to announce its presence and status. Supported products include <strong>Virus and Threat Protection</strong> products and <strong>Firewall </strong>products. <em>WSA previously showed a <strong>Web Protection </strong>category intended to indicate the status of any <a href="https://textslashplain.com/2020/02/03/microsofts-three-browsers/">Edge Legacy</a> browser protection extensions, but this section was removed in a recent update because Edge Legacy was removed years ago.</em></p> 639 640 641 642<p class="wp-block-paragraph">Registering a product in the Virus and Threat Protection category causes MDAV to <a href="https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-antivirus-compatibility#antivirus-protection-without-defender-for-endpoint:~:text=summarizes%20the%20state%20of%20Microsoft%20Defender%20Antivirus">either</a> <a href="https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-antivirus-compatibility#antivirus-protection-without-defender-for-endpoint">enter “passive mode”</a><sup>1</sup> (disabling real-time protection and other features) or disable entirely<sup>1</sup>, allowing the 3rd party product to be the active protection component of the system. The product in question has short window after each system startup to register with the API: if it fails to do so, or if it indicates that it is not working properly, MDAV resumes Active protection. The APIs for registering with the Windows Security Center are not fully public, and only callable by members of <a href="https://learn.microsoft.com/en-us/unified-secops/virus-initiative-criteria">the MVI program</a>.</p> 643 644 645 646<p class="wp-block-paragraph">When a 3P security product registers, the UI of the Windows Security Center is updated to show lightweight status information from that product and offer an <strong>Open app</strong> entry point into the 3P product’s (typically) richer user-interface. </p> 647 648 649<div class="wp-block-image"> 650<figure class="aligncenter size-full is-resized"><a href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-60.png?ssl=1"><img data-recalc-dims="1" loading="lazy" decoding="async" width="750" height="586" data-attachment-id="15476" data-permalink="https://textslashplain.com/2026/08/31/the-windows-security-app/image-712/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-60.png?fit=814%2C636&ssl=1" data-orig-size="814,636" data-comments-opened="1" data-image-meta="{"aperture":"0","credit":"","camera":"","caption":"","created_timestamp":"0","copyright":"","focal_length":"0","iso":"0","shutter_speed":"0","title":"","orientation":"0","alt":""}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-60.png?fit=750%2C586&ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-60.png?resize=750%2C586&ssl=1" alt="" class="wp-image-15476" style="aspect-ratio:1.2799087226296086;width:642px;height:auto" srcset="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-60.png?w=814&ssl=1 814w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-60.png?resize=300%2C234&ssl=1 300w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-60.png?resize=768%2C600&ssl=1 768w" sizes="auto, (max-width: 750px) 100vw, 750px" /></a><figcaption class="wp-element-caption">Windows Security App behind the 3P Sophos Home application spawned from the “Open app” button.</figcaption></figure> 651</div> 652 653 654<p class="wp-block-paragraph">Multiple 3P products (AV and Firewall) may be installed at one time, although it’s generally recommended to only have one product of each time active to avoid conflicts and performance impact.</p> 655 656 657<div class="wp-block-image"> 658<figure class="aligncenter size-full is-resized"><a href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-62.png?ssl=1"><img data-recalc-dims="1" loading="lazy" decoding="async" width="429" height="550" data-attachment-id="15478" data-permalink="https://textslashplain.com/2026/08/31/the-windows-security-app/image-714/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-62.png?fit=429%2C550&ssl=1" data-orig-size="429,550" data-comments-opened="1" data-image-meta="{"aperture":"0","credit":"","camera":"","caption":"","created_timestamp":"0","copyright":"","focal_length":"0","iso":"0","shutter_speed":"0","title":"","orientation":"0","alt":""}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-62.png?fit=429%2C550&ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-62.png?resize=429%2C550&ssl=1" alt="" class="wp-image-15478" style="aspect-ratio:0.7799937498224382;width:389px;height:auto" srcset="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-62.png?w=429&ssl=1 429w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-62.png?resize=234%2C300&ssl=1 234w" sizes="auto, (max-width: 429px) 100vw, 429px" /></a></figure> 659</div> 660 661<div class="wp-block-image"> 662<figure class="aligncenter size-full is-resized"><a href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-61.png?ssl=1"><img data-recalc-dims="1" loading="lazy" decoding="async" width="750" height="624" data-attachment-id="15477" data-permalink="https://textslashplain.com/2026/08/31/the-windows-security-app/image-713/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-61.png?fit=843%2C701&ssl=1" data-orig-size="843,701" data-comments-opened="1" data-image-meta="{"aperture":"0","credit":"","camera":"","caption":"","created_timestamp":"0","copyright":"","focal_length":"0","iso":"0","shutter_speed":"0","title":"","orientation":"0","alt":""}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-61.png?fit=750%2C624&ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-61.png?resize=750%2C624&ssl=1" alt="" class="wp-image-15477" style="aspect-ratio:1.20257769212238;width:568px;height:auto" srcset="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-61.png?w=843&ssl=1 843w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-61.png?resize=300%2C249&ssl=1 300w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-61.png?resize=768%2C639&
662ssl=1 768w" sizes="auto, (max-width: 750px) 100vw, 750px" /></a></figure> 663</div> 664 665 666<p class="wp-block-paragraph">Notably, many consumers who buy PCs from major vendors may find that they have a “time-limited trial” of a 3rd party antivirus product pre-installed on their PC, leaving Defender in passive mode. Antivirus product vendors commonly pay PC vendors for such installations as a way to acquire customers for their security product subscriptions. As mentioned, uninstalling the trial product should automatically move MDAV back into “Active” mode.</p> 667 668 669 670<h3 class="wp-block-heading">Passive Mode</h3> 671 672 673 674<p class="wp-block-paragraph">You may wonder what MDAV’s “<a href="https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-passive-mode">Passive Mode</a>” is used for– if MDAV is not providing its normal “real-time” threat protection (with active <a href="https://textslashplain.com/2024/11/18/security-software-an-overview/#:~:text=EPP%20Protection%20Components">filesystem minifilters, network monitoring</a>, etc), what is it doing?</p> 675 676 677 678<p class="wp-block-paragraph">In Passive Mode, MDAV can evaluate file trust/reputation for <a href="https://textslashplain.com/2026/04/28/smart-app-control/">Smart App Control</a>, and, for MDE onboarded devices, work with <a href="https://learn.microsoft.com/en-us/defender-endpoint/edr-in-block-mode">EDR in Block Mode</a> to provide protections against detected threats. It can also provide services to other products, like Purview DLP.</p> 679 680 681 682<p class="wp-block-paragraph">End users can also optionally enable “<a href="https://learn.microsoft.com/en-us/defender-endpoint/limited-periodic-scanning-microsoft-defender-antivirus">limited periodic scans</a>” to provide additional protections on top of their third-party product.</p> 683 684 685<div class="wp-block-image"> 686<figure class="aligncenter size-full"><a href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-72.png?ssl=1"><img data-recalc-dims="1" loading="lazy" decoding="async" width="475" height="314" data-attachment-id="15539" data-permalink="https://textslashplain.com/2026/08/31/the-windows-security-app/image-725/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-72.png?fit=475%2C314&ssl=1" data-orig-size="475,314" data-comments-opened="1" data-image-meta="{"aperture":"0","credit":"","camera":"","caption":"","created_timestamp":"0","copyright":"","focal_length":"0","iso":"0","shutter_speed":"0","title":"","orientation":"0","alt":""}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-72.png?fit=475%2C314&ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-72.png?resize=475%2C314&ssl=1" alt="" class="wp-image-15539" srcset="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-72.png?w=475&ssl=1 475w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-72.png?resize=300%2C198&ssl=1 300w" sizes="auto, (max-width: 475px) 100vw, 475px" /></a></figure> 687</div> 688 689 690<h2 class="wp-block-heading">Navigating the WSA Programmatically</h2> 691 692 693 694<p class="wp-block-paragraph">Individual pages of the WSA can be accessed via commands to the <code>windowsdefender://</code> <a href="https://textslashplain.com/2019/08/29/web-to-app-communication-app-protocols/">App Protocol</a>:</p> 695 696 697<div class="wp-block-code"> 698 <div class="cm-editor"> 699 <div class="cm-scroller"> 700 701<pre> 702<code><div class="cm-line">home, threat, quarantinehistory, threatsettings, network,</div><div class="cm-line">perfhealth, appbrowser, family, fullhistory, history,</div><div class="cm-line">accountprotection, devicesecurity, updateandquickscan,</div><div class="cm-line">
702customscan, samples, settings, protectedfolders, allowedapps,</div><div class="cm-line">allowappthroughfolder, exploitprotection, ransomwareprotection,</div><div class="cm-line">coreisolation, securityprocessor, securityprocessortroubleshooting</div></code></pre> 703 </div> 704 </div> 705</div> 706 707 708<p class="wp-block-paragraph">For example, <code>windowsdefender://appbrowser/</code> opens the App & Browser control page of the app:</p> 709 710 711<div class="wp-block-image"> 712<figure class="aligncenter size-full is-resized"><a href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-67.png?ssl=1"><img data-recalc-dims="1" loading="lazy" decoding="async" width="673" height="527" data-attachment-id="15489" data-permalink="https://textslashplain.com/2026/08/31/the-windows-security-app/image-719/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-67.png?fit=673%2C527&ssl=1" data-orig-size="673,527" data-comments-opened="1" data-image-meta="{"aperture":"0","credit":"","camera":"","caption":"","created_timestamp":"0","copyright":"","focal_length":"0","iso":"0","shutter_speed":"0","title":"","orientation":"0","alt":""}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-67.png?fit=673%2C527&ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-67.png?resize=673%2C527&ssl=1" alt="" class="wp-image-15489" style="aspect-ratio:1.2770480623832539;width:453px;height:auto" srcset="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-67.png?w=673&ssl=1 673w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-67.png?resize=300%2C235&ssl=1 300w" sizes="auto, (max-width: 673px) 100vw, 673px" /></a></figure> 713</div> 714 715 716<h2 class="wp-block-heading">Defender for Individuals app</h2> 717 718 719 720<p class="wp-block-paragraph">Above, I mentioned that Defender does not have its own app, relying on WSA for all of its graphical user-interface. That’s generally true with the exception of the <strong>Defender for Individuals</strong> (D4I) product bundled into <a href="https://www.microsoft.com/en-us/microsoft-365/p/microsoft-365-family/cfq7ttc0k5dm">Microsoft 365 subscriptions</a> for individuals and families. When installing D4I, you get a <a href="https://apps.microsoft.com/detail/9p6pmztm93lr?hl=en-US&gl=US">new app named “Microsoft Defender”</a> that exposes the additional capabilities provided by your subscription, which include a unified dashboard across multiple devices (e.g. to see your kids’ PC’s status) and other features which vary per-market (e.g. identity protections and dark web scanning services).</p> 721 722 723<div class="wp-block-image"> 724<figure class="aligncenter size-large is-resized"><a href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-73.png?ssl=1"><img data-recalc-dims="1" loading="lazy" decoding="async" width="750" height="423" data-attachment-id="15548" data-permalink="https://textslashplain.com/2026/08/31/the-windows-security-app/image-726/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-73.png?fit=1372%2C773&ssl=1" data-orig-size="1372,773" data-comments-opened="1" data-image-meta="{"aperture":"0","credit":"","camera":"","caption":"","created_timestamp":"0","copyright":"","focal_length":"0","iso":"0","shutter_speed":"0","title":"","orientation":"0","alt":""}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-73.png?fit=750%2C423&ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-73.png?resize=750%2C423&ssl=1" alt="" class="wp-image-15548" style="aspect-ratio:1.7747084755403868;width:637px;height:auto" srcset="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-73.png?resize=1024%2C577&ssl=1 1024w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-73.png?resize=300%2C169&ssl=1 300w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-73.png?resize=768%2C433&ssl=1 768w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-73.png?w=1372&
724ssl=1 1372w" sizes="auto, (max-width: 750px) 100vw, 750px" /></a></figure> 725</div> 726 727 728<p class="wp-block-paragraph">Even when a D4I subscription is active, the underlying Virus and Threat Protections are provided by MDAV included in Windows. Entry points for antivirus-related activities in the D4I Microsoft Defender app ultimately navigate to the appropriate pages in the WSA.</p> 729 730 731 732<h2 class="wp-block-heading">Windows Server</h2> 733 734 735 736<p class="wp-block-paragraph">The underlying Windows Security Center APIs that would allow 3P security products to register with Windows are not present on Windows Server. Instead, if a third-party product is installed on a Windows Server being onboarded to Microsoft Defender for Endpoint, the <code>ForceDefenderPassiveMode</code> <a href="https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-passive-mode#set-the-registry-key">registry key</a> must be set explicitly to put Defender in passive mode.</p> 737 738 739 740<p class="wp-block-paragraph">On servers, Windows Security features are typically configured via PowerShell, Group Policy, the MDE Security Portal, or similar management mechanisms. For Server 2019 and later, WSA is present when the Desktop Experience Installation option is chosen. For Server 2016, it <a href="https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-antivirus-windows-server-configure#enable-the-microsoft-defender-antivirus-user-interface-on-windows-server-2016">can be enabled</a> via <code>Install-WindowsFeature -Name Windows-Defender-GUI</code>.</p> 741 742 743 744<p class="wp-block-paragraph"></p> 745 746 747 748<p class="wp-block-paragraph">Stay safe out there!</p> 749 750 751 752<p class="wp-block-paragraph">-Eric</p> 753 754 755 756<p class="wp-block-paragraph"><sup>1</sup> <em>Technically</em>, if Smart App Control is enabled, Defenders status will be:</p> 757 758 759 760<ul class="wp-block-list"> 761<li>Active Mode if the Device is MDE-onboarded</li> 762 763 764 765<li><a href="https://textslashplain.com/2026/04/28/smart-app-control/#:~:text=special%20%E2%80%9CHybrid%E2%80%9D%20mode">Hybrid mode</a> if not onboarded but MDAV is the primary AV</li> 766 767 768 769<li>Passive mode if not onboarded and a 3P AV has replaced MDAV. </li> 770</ul> 771 772 773 774<p class="wp-block-paragraph">Yes, this stuff is <em>incredibly </em>subtle and intricate.</p> 775 </div><!-- .entry-content --> 776 777 <footer class="entry-footer responsive-max-width"> 778 <span class="byline"><svg class="svg-icon" width="16" height="16" aria-hidden="true" role="img" focusable="false" viewBox="0 0 24 24" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><path d="M12 12c2.21 0 4-1.79 4-4s-1.79-4-4-4-4 1.79-4 4 1.79 4 4 4zm0 2c-2.67 0-8 1.34-8 4v2h16v-2c0-2.66-5.33-4-8-4z"></path><path d="M0 0h24v24H0z" fill="none"></path></svg><span class="screen-reader-text">Posted by</span><span class="author vcard"><a class="url fn n" href="https://textslashplain.com/author/ericlaw1979/">ericlaw</a></span></span><span class="posted-on"><svg class="svg-icon" width="16" height="16" aria-hidden="true" role="img" focusable="false" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><defs><path id="a" d="M0 0h24v24H0V0z"></path></defs><clipPath id="b"><use xlink:href="#a" overflow="visible"></use></clipPath><path clip-path="url(#b)" d="M12 2C6.5 2 2 6.5 2 12s4.5 10 10 10 10-4.5 10-10S17.5 2 12 2zm4.2 14.2L11 13V7h1.5v5.2l4.5 2.7-.8 1.3z"></path></svg><a href="https://textslashplain.com/2026/08/31/the-windows-security-app/" rel="bookmark"><time class="entry-date published" datetime="2026-08-31T10:50:41-05:00">2026-08-31</time><time class="updated" datetime="2026-09-03T12:57:21-05:00">2026-09-03</time></a></span><span class="cat-links"><svg class="svg-icon" width="16" height="16" aria-hidden="true" role="img" focusable="false" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M10 4H4c-1.1 0-1.99.9-1.99 2L2 18c0 1.1.9 2 2 2h16c1.1 0 2-.9 2-2V8c0-1.1-.9-2-2-2h-8l-2-2z"></path><path d="M0 0h24v24H0z" fill="none"></path></svg><span class="screen-reader-text">Posted in</span><a href="https://textslashplain.com/category/security/" rel="category tag">security</a>, <a href="https://textslashplain.com/category/tech/" rel="category tag">tech</a></span><span class="tags-links"><svg class="svg-icon" width="16" height="16" aria-hidden="true" role="img" focusable="false" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
778<path d="M21.41 11.58l-9-9C12.05 2.22 11.55 2 11 2H4c-1.1 0-2 .9-2 2v7c0 .55.22 1.05.59 1.42l9 9c.36.36.86.58 1.41.58.55 0 1.05-.22 1.41-.59l7-7c.37-.36.59-.86.59-1.41 0-.55-.23-1.06-.59-1.42zM5.5 7C4.67 7 4 6.33 4 5.5S4.67 4 5.5 4 7 4.67 7 5.5 6.33 7 5.5 7z"></path><path d="M0 0h24v24H0z" fill="none"></path></svg><span class="screen-reader-text">Tags:</span><a href="https://textslashplain.com/tag/defender/" rel="tag">Defender</a>, <a href="https://textslashplain.com/tag/security/" rel="tag">security</a>, <a href="https://textslashplain.com/tag/ui/" rel="tag">UI</a>, <a href="https://textslashplain.com/tag/windows/" rel="tag">Windows</a></span><span class="comments-link"><svg class="svg-icon" width="16" height="16" aria-hidden="true" role="img" focusable="false" viewBox="0 0 24 24" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><path d="M21.99 4c0-1.1-.89-2-1.99-2H4c-1.1 0-2 .9-2 2v12c0 1.1.9 2 2 2h14l4 4-.01-18z"></path><path d="M0 0h24v24H0z" fill="none"></path></svg><a href="https://textslashplain.com/2026/08/31/the-windows-security-app/#comments">1 Comment<span class="screen-reader-text"> on The Windows Security App</span></a></span> </footer><!-- .entry-footer --> 779</article><!-- #post-${ID} --> 780 781<article id="post-15316" class="post-15316 post type-post status-publish format-standard hentry category-browsers category-security tag-ai tag-infosecttp tag-scam tag-security entry"> 782 <header class="entry-header responsive-max-width"> 783 <h2 class="entry-title"><a href="https://textslashplain.com/2026/08/12/attack-technique-ai-clones/" rel="bookmark">Attack Technique: AI Clones</a></h2> </header><!-- .entry-header --> 784 785 786 <div class="entry-content"> 787 788<p class="wp-block-paragraph">Attackers are adept at using new technologies to enhance their attacks. Earlier this afternoon, for example, I got call from “American Express” suggesting that I needed to “verify a transaction.” The caller used a robotic voice similar to the one used by American Express’ automated systems, and only obvious signals that it was a scam were a) they didn’t have my name or card number, b) I have been using my Visa exclusively for the past few weeks, and c) I have their app, and I get push notifications from it.</p> 789 790 791 792<p class="wp-block-paragraph">Recently, there’s been some excited press about attackers abusing AI-powered “deepfake” technology to persuade users to take unsafe actions (for instance, sending money or sharing secrets) by using a trusted person’s voice or appearance to make the pitch more compelling. Attackers no longer need to limit themselves to <a href="https://textslashplain.com/2023/08/12/sms-gift-card-scams/">spoofed phone numbers or names</a>, they now can use a real-looking voice or video.</p> 793 794 795 796<p class="wp-block-paragraph">But is cloning still an advanced technique, or are we soon going to see it everywhere?</p> 797 798 799 800<h2 class="wp-block-heading">Free Voice Cloning</h2> 801 802 803 804<p class="wp-block-paragraph">The best AI models require money to use and I don’t have the time or attention span to fully explore them, but as a <a href="https://textslashplain.com/2020/02/09/demystifying-browsers/">browser lover/enthusiast</a>, I’m intrigued to look at how convincing a spoof I can do using an <strong>in-browser speech cloning</strong> tool. </p> 805 806 807 808<p class="wp-block-paragraph">Beyond being free, such a tool will allow an attacker to generate speech without calling a web service that might keep logs that could be used to catch the attacker. Behold <a href="https://soundtools.io/voice-cloning/">SoundTools.io</a>. It’s <a href="https://soundtools.io/about/#:~:text=always%20be%20free%20to%20use">free</a>, trivial to use, and is very upfront about its market position and level of quality vs. competitors:</p> 809 810 811 812<figure class="wp-block-image size-large"><a href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-57.png?ssl=1"><img data-recalc-dims="1" loading="lazy" decoding="async" width="750" height="349" data-attachment-id="15380" data-permalink="https://textslashplain.com/2026/08/12/attack-technique-ai-clones/image-704/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-57.png?fit=1223%2C569&ssl=1" data-orig-size="1223,569" data-comments-opened="1" data-image-meta="{"aperture":"0","credit":"","camera":"","caption":"","created_timestamp":"0","copyright":"","focal_length":"0","iso":"0","shutter_speed":"0","title":"","orientation":"0","alt":""}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-57.png?fit=750%2C349&ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-57.png?resize=750%2C349&ssl=1" alt="" class="wp-image-15380" srcset="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-57.png?resize=1024%2C476&ssl=1 1024w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-57.png?resize=300%2C140&ssl=1 300w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-57.png?resize=768%2C357&ssl=1 768w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-57.png?resize=1200%2C558&ssl=1 1200w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-57.png?w=1223&
812ssl=1 1223w" sizes="auto, (max-width: 750px) 100vw, 750px" /></a></figure> 813 814 815 816<p class="wp-block-paragraph">Throughout, the tool includes clear explanations of how it works:</p> 817 818 819 820<figure class="wp-block-image size-full"><a href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-54.png?ssl=1"><img data-recalc-dims="1" loading="lazy" decoding="async" width="750" height="177" data-attachment-id="15353" data-permalink="https://textslashplain.com/2026/08/12/attack-technique-ai-clones/image-701/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-54.png?fit=1015%2C240&ssl=1" data-orig-size="1015,240" data-comments-opened="1" data-image-meta="{"aperture":"0","credit":"","camera":"","caption":"","created_timestamp":"0","copyright":"","focal_length":"0","iso":"0","shutter_speed":"0","title":"","orientation":"0","alt":""}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-54.png?fit=750%2C177&ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-54.png?resize=750%2C177&ssl=1" alt="" class="wp-image-15353" srcset="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-54.png?w=1015&ssl=1 1015w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-54.png?resize=300%2C71&ssl=1 300w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-54.png?resize=768%2C182&ssl=1 768w" sizes="auto, (max-width: 750px) 100vw, 750px" /></a></figure> 821 822 823 824<p class="wp-block-paragraph">To use it, you can either feed it previously recorded audio, or (preferably) a live recording of a paragraph of text:</p> 825 826 827<div class="wp-block-image"> 828<figure class="aligncenter size-full is-resized"><a href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-50.png?ssl=1"><img data-recalc-dims="1" loading="lazy" decoding="async" width="750" height="318" data-attachment-id="15333" data-permalink="https://textslashplain.com/2026/08/12/attack-technique-ai-clones/image-697/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-50.png?fit=1020%2C433&ssl=1" data-orig-size="1020,433" data-comments-opened="1" data-image-meta="{"aperture":"0","credit":"","camera":"","caption":"","created_timestamp":"0","copyright":"","focal_length":"0","iso":"0","shutter_speed":"0","title":"","orientation":"0","alt":""}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-50.png?fit=750%2C318&ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-50.png?resize=750%2C318&ssl=1" alt="" class="wp-image-15333" style="aspect-ratio:2.355669859846161;width:598px;height:auto" srcset="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-50.png?w=1020&ssl=1 1020w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-50.png?resize=300%2C127&ssl=1 300w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-50.png?resize=768%2C326&ssl=1 768w" sizes="auto, (max-width: 750px) 100vw, 750px" /></a></figure> 829</div> 830 831 832<p class="wp-block-paragraph">After collecting the audio sample, the page downloads several large models (just over a gigabyte, cached for later use), to generate a cloned voice. It then allows the user to provide text that should be read aloud, and a desired quality level (lower-quality reproduction is faster):</p> 833 834 835<div class="wp-block-image"> 836<figure class="aligncenter size-full is-resized"><a href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-52.png?ssl=1"><img data-recalc-dims="1" loading="lazy" decoding="async" width="750" height="537" data-attachment-id="15339" data-permalink="https://textslashplain.com/2026/08/12/attack-technique-ai-clones/image-699/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-52.png?fit=938%2C671&ssl=1" data-orig-size="938,671" data-comments-opened="1" data-image-meta="{"aperture":"0","credit":"","camera":"","caption":"","created_timestamp":"0","copyright":"","focal_length":"0","iso":"0","shutter_speed":"0","title":"","orientation":"0","alt":""}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-52.png?fit=750%2C537&ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-52.png?resize=750%2C537&ssl=1" alt="" class="wp-image-15339" style="aspect-ratio:1.3979388949564535;width:604px;
836height:auto" srcset="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-52.png?w=938&ssl=1 938w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-52.png?resize=300%2C215&ssl=1 300w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-52.png?resize=768%2C549&ssl=1 768w" sizes="auto, (max-width: 750px) 100vw, 750px" /></a></figure> 837</div> 838 839 840<p class="wp-block-paragraph">The time required depends on the quality chosen and the performance of the browser on your device. In my quick test, the “High quality” level, which requires 60 to 150 seconds per sentence, seems to generate pretty good results. <em>If it’s enabled, you’ll definitely want to turn off Edge’s “Enhanced Security Mode” for this site because its WebAssembly runs much more slowly in interpreted mode.</em> <em>The site makes heavy use of the system GPU:</em></p> 841 842 843<div class="wp-block-image"> 844<figure class="aligncenter size-full is-resized"><a href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-59.png?ssl=1"><img data-recalc-dims="1" loading="lazy" decoding="async" width="750" height="582" data-attachment-id="15443" data-permalink="https://textslashplain.com/2026/08/12/attack-technique-ai-clones/image-711/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-59.png?fit=883%2C685&ssl=1" data-orig-size="883,685" data-comments-opened="1" data-image-meta="{"aperture":"0","credit":"","camera":"","caption":"","created_timestamp":"0","copyright":"","focal_length":"0","iso":"0","shutter_speed":"0","title":"","orientation":"0","alt":""}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-59.png?fit=750%2C582&ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-59.png?resize=750%2C582&ssl=1" alt="" class="wp-image-15443" style="aspect-ratio:1.2890639122014202;width:555px;height:auto" srcset="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-59.png?w=883&ssl=1 883w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-59.png?resize=300%2C233&ssl=1 300w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-59.png?resize=768%2C596&ssl=1 768w" sizes="auto, (max-width: 750px) 100vw, 750px" /></a></figure> 845</div> 846 847 848<p class="wp-block-paragraph"><em>…and surprisingly to me, <a href="https://bsky.app/profile/ericlawrence.com/post/3msxrv65uc22j">doesn’t seem to work</a> on Windows ARM devices like Surface Laptop 7.</em></p> 849 850 851 852<p class="wp-block-paragraph">Finally, when the generation completes, the recording is available to play or download. </p> 853 854 855<div class="wp-block-image"> 856<figure class="aligncenter size-full is-resized"><a href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-51.png?ssl=1"><img data-recalc-dims="1" loading="lazy" decoding="async" width="750" height="663" data-attachment-id="15336" data-permalink="https://textslashplain.com/2026/08/12/attack-technique-ai-clones/image-698/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-51.png?fit=802%2C709&ssl=1" data-orig-size="802,709" data-comments-opened="1" data-image-meta="{"aperture":"0","credit":"","camera":"","caption":"","created_timestamp":"0","copyright":"","focal_length":"0","iso":"0","shutter_speed":"0","title":"","orientation":"0","alt":""}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-51.png?fit=750%2C663&ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-51.png?resize=750%2C663&ssl=1" alt="" class="wp-image-15336" style="aspect-ratio:1.1311806027645592;width:603px;height:auto" srcset="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-51.png?w=802&ssl=1 802w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-51.png?resize=300%2C265&ssl=1 300w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-51.png?resize=768%2C679&
856ssl=1 768w" sizes="auto, (max-width: 750px) 100vw, 750px" /></a></figure> 857</div> 858 859 860<p class="wp-block-paragraph">Folks who have heard me speak would probably agree that the results are pretty plausible. While <a href="https://www.ericlawrence.com/dl/CodeMash2015-LuckingIn-64kbps.mp3">my real voice</a> has more “ums”, “uhs”, variable pauses, and animation, careful preparation of the source text would yield even more compelling output. (<em>For example, the web app doesn’t currently handle “smart quotes” properly, voicing contractions like “Canât” as “Can Tee”.</em>) </p> 861 862 863 864<p class="wp-block-paragraph">High Quality example (text from <a href="https://textslashplain.com/2026/08/05/fiddler-in-2026/#:~:text=Fiddler%20Book.-,First%2C%20a%20confession,-%E2%80%94the%20Fiddler%20Web">this post</a>):</p> 865 866 867 868<figure class="wp-block-audio"><audio controls src="https://textslashplain.com/wp-content/uploads/2026/08/HighQuality-48.mp3"></audio></figure> 869 870 871 872<p class="wp-block-paragraph">Ultra Quality example (text from <a href="https://textslashplain.com/2020/11/16/objectively-the-best-cat/">this post</a>):</p> 873 874 875 876<figure class="wp-block-audio"><audio controls src="https://textslashplain.com/wp-content/uploads/2026/08/UltraQuality-64.mp3"></audio></figure> 877 878 879 880<p class="wp-block-paragraph">Both of these are pretty solid, and attackers who worry about the quality of the clone would also likely simulate the speaker being in a noisy environment or suffering from a poor phone signal.</p> 881 882 883 884<h2 class="wp-block-heading">Not just voice, obviously</h2> 885 886 887 888<p class="wp-block-paragraph">Don’t even get me started about how trivial <a href="https://photoeditorai.io/">photo editing</a> has gotten:</p> 889 890 891<div class="wp-block-image"> 892<figure class="aligncenter size-large is-resized"><a href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-53.png?ssl=1"><img data-recalc-dims="1" loading="lazy" decoding="async" width="750" height="498" data-attachment-id="15348" data-permalink="https://textslashplain.com/2026/08/12/attack-technique-ai-clones/image-700/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-53.png?fit=2312%2C1536&ssl=1" data-orig-size="2312,1536" data-comments-opened="1" data-image-meta="{"aperture":"0","credit":"","camera":"","caption":"","created_timestamp":"0","copyright":"","focal_length":"0","iso":"0","shutter_speed":"0","title":"","orientation":"0","alt":""}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-53.png?fit=750%2C498&ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-53.png?resize=750%2C498&ssl=1" alt="" class="wp-image-15348" style="aspect-ratio:1.505897613804338;width:520px;height:auto" srcset="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-53.png?resize=1024%2C680&ssl=1 1024w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-53.png?resize=300%2C199&ssl=1 300w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-53.png?resize=768%2C510&ssl=1 768w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-53.png?resize=1536%2C1020&ssl=1 1536w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-53.png?resize=2048%2C1361&ssl=1 2048w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-53.png?resize=1200%2C797&ssl=1 1200w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-53.png?resize=1568%2C1042&ssl=1 1568w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-53.png?w=2250&ssl=1 2250w" sizes="auto, (max-width: 750px) 100vw, 750px" /></a><figcaption class="wp-element-caption">Dating profiles where guys hold a giant fish will never be believable again ð¤£</figcaption></figure> 893</div> 894 895<div class="wp-block-image"> 896<figure class="aligncenter size-large is-resized"><a href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-56.png?ssl=1"><img data-recalc-dims="1" loading="lazy" decoding="async" width="750" height="849" data-attachment-id="15365" data-permalink="https://textslashplain.com/2026/08/12/attack-technique-ai-clones/image-703/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-56.png?fit=1405%2C1590&ssl=1" data-orig-size="1405,1590" data-comments-opened="1" data-image-meta="{"aperture":"0","credit":"","camera":"","caption":"","created_timestamp":"0","copyright":"","focal_length":"0","iso":"0","shutter_speed":"0","title":"","orientation":"0","alt":""}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-56.png?fit=750%2C849&ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-56.png?resize=750%2C849&ssl=1" alt="" class="wp-image-15365" style="aspect-ratio:0.8837880424198431;width:528px;height:auto" srcset="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-56.png?resize=905%2C1024&ssl=1 905w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-56.png?resize=265%2C300&ssl=1 265w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-56.png?resize=768%2C869&ssl=1 768w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-56.png?resize=1357%2C1536&ssl=1 1357w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-56.png?resize=1200%2C1358&ssl=1 1200w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-56.png?w=1405&
896ssl=1 1405w" sizes="auto, (max-width: 750px) 100vw, 750px" /></a><figcaption class="wp-element-caption">Running with my buddy</figcaption></figure> 897</div> 898 899 900<p class="wp-block-paragraph">Even today’s high schools can afford to generate <a href="https://www.youtube.com/watch?v=WDgzL8Z3SfM">sizzle videos</a> for marching bands that would’ve cost millions of dollars to render when <em>I</em> was high school.</p> 901 902 903 904<p class="wp-block-paragraph"><strong>Exciting </strong>stuff! But <strong>scary </strong>in the hands of bad guys. I don’t even know what to suggest folks do to stay safe, other than <strong><a href="https://textslashplain.com/2023/10/16/security-the-impact-of-time/#:~:text=fast%2Dmoving%20attackers.-,The%20Human%20Factor,-Many%20forms%20of">slow down and think</a></strong>, be extra skeptical of situations where someone unexpectedly contacts <em>you</em>, and be cautious of all non-in-person interactions, <em>especially </em>when it’s not a real-time conversation (which <a href="https://www.youtube.com/playlist?list=PLxgMOEESA8vgmkkQM_jsD94AZfH9Ve2Vd">can <em>still </em>be faked</a>, but it’s harder). </p> 905 906 907 908<p class="wp-block-paragraph">For years, it’s been easy to <a href="https://textslashplain.com/2025/04/24/attack-techniques-fake-literally-everything/">fake an entire company</a>, but today it’s not too hard to shallowly fake a family member or close friend. Perhaps in the future, we will all share a <a href="https://en.wikipedia.org/wiki/Shibboleth">Shibboleth</a> with close friends, or demand out-of-band confirmations of all requests?</p> 909 910 911 912<p class="wp-block-paragraph">Stay safe out there, and <strong>don’t believe everything you hear, or see</strong>!</p> 913 914 915 916<p class="wp-block-paragraph">-Eric</p> 917 </div><!-- .entry-content --> 918 919 <footer class="entry-footer responsive-max-width"> 920 <span class="byline"><svg class="svg-icon" width="16" height="16" aria-hidden="true" role="img" focusable="false" viewBox="0 0 24 24" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><path d="M12 12c2.21 0 4-1.79 4-4s-1.79-4-4-4-4 1.79-4 4 1.79 4 4 4zm0 2c-2.67 0-8 1.34-8 4v2h16v-2c0-2.66-5.33-4-8-4z"></path><path d="M0 0h24v24H0z" fill="none"></path></svg><span class="screen-reader-text">Posted by</span><span class="author vcard"><a class="url fn n" href="https://textslashplain.com/author/ericlaw1979/">ericlaw</a></span></span><span class="posted-on"><svg class="svg-icon" width="16" height="16" aria-hidden="true" role="img" focusable="false" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><defs><path id="a" d="M0 0h24v24H0V0z"></path></defs><clipPath id="b"><use xlink:href="#a" overflow="visible"></use></clipPath><path clip-path="url(#b)" d="M12 2C6.5 2 2 6.5 2 12s4.5 10 10 10 10-4.5 10-10S17.5 2 12 2zm4.2 14.2L11 13V7h1.5v5.2l4.5 2.7-.8 1.3z"></path></svg><a href="https://textslashplain.com/2026/08/12/attack-technique-ai-clones/" rel="bookmark"><time class="entry-date published" datetime="2026-08-12T18:08:07-05:00">2026-08-12</time><time class="updated" datetime="2026-08-18T16:17:26-05:00">2026-08-18</time></a></span><span class="cat-links"><svg class="svg-icon" width="16" height="16" aria-hidden="true" role="img" focusable="false" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M10 4H4c-1.1 0-1.99.9-1.99 2L2 18c0 1.1.9 2 2 2h16c1.1 0 2-.9 2-2V8c0-1.1-.9-2-2-2h-8l-2-2z"></path><path d="M0 0h24v24H0z" fill="none"></path></svg><span class="screen-reader-text">Posted in</span><a href="https://textslashplain.com/category/browsers/" rel="category tag">browsers</a>, <a href="https://textslashplain.com/category/security/" rel="category tag">security</a></span><span class="tags-links"><svg class="svg-icon" width="16" height="16" aria-hidden="true" role="img" focusable="false" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M21.41 11.58l-9-9C12.05 2.22 11.55 2 11 2H4c-1.1 0-2 .9-2 2v7c0 .55.22 1.05.59 1.42l9 9c.36.36.86.58 1.41.58.55 0 1.05-.22 1.41-.59l7-7c.37-.36.59-.86.59-1.41 0-.55-.23-1.06-.59-1.42zM5.5 7C4.67 7 4 6.33 4 5.5S4.67 4 5.5 4 7 4.67 7 5.5 6.33 7 5.5 7z"></path><path d="M0 0h24v24H0z" fill="none"></path></svg><span class="screen-reader-text">Tags:</span><a href="https://textslashplain.com/tag/ai/" rel="tag">AI</a>, <a href="https://textslashplain.com/tag/infosecttp/" rel="tag">InfoSecTTP</a>, <a href="https://textslashplain.com/tag/scam/" rel="tag">scam</a>, <a href="https://textslashplain.com/tag/security/" rel="tag">security</a></span><span class="comments-link"><svg class="svg-icon" width="16" height="16" aria-hidden="true" role="img" focusable="false" viewBox="0 0 24 24" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><path d="M21.99 4c0-1.1-.89-2-1.99-2H4c-1.1 0-2 .9-2 2v12c0 1.1.9 2 2 2h14l4 4-.01-18z"></path><path d="M0 0h24v24H0z" fill="none"></path></svg><a href="https://textslashplain.com/2026/08/12/attack-technique-ai-clones/#respond">Leave a comment<span class="screen-reader-text"> on Attack Technique: AI Clones</span></a></span> </footer><!-- .entry-footer --> 921</article><!-- #post-${ID} --> 922 923<article id="post-15003" class="post-15003 post type-post status-publish format-standard hentry category-fiddler-2 category-life category-storytelling entry"> 924 <header class="entry-header responsive-max-width"> 925 <h2 class="entry-title"><a href="https://textslashplain.com/2026/08/05/fiddler-in-2026/" rel="bookmark">Fiddler in 2026</a></h2> </header><!-- .entry-header --> 926 927 928 <div class="entry-content"> 929 930<p class="wp-block-paragraph">I’ve shared the stories behind the Fiddler Web Debugger a fair bit over the years, in the <a href="https://fiddlerbook.com/">Fiddler Book</a>, in <a href="https://github.com/ericlaw1979/CodeMash2015/tree/master/LuckingIn">a talk</a> at the CodeMash conference in 2015, and <a href="https://textslashplain.com/2024/11/24/fiddler-my-mistakes/">on this blog</a>. It features prominently in my <a href="https://bluebadgebook.com/bbb/">to-be-completed (some day?) memoir</a>, and I’ve enjoyed telling Fiddler stories to folks who ask over the years. (I’ve also written a ton of content about <a href="https://textslashplain.com/category/fiddler-2/"><em>using </em>Fiddler</a>.) </p> 931 932 933 934<p class="wp-block-paragraph">Over two decades, what was once a little side project came to influence a very meaningful percentage of my life, including where I live today and so many of my life’s experiences.</p> 935 936 937<div class="wp-block-image"> 938<figure class="aligncenter size-full"><a href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-45.png?ssl=1"><img data-recalc-dims="1" loading="lazy" decoding="async" width="299" height="268" data-attachment-id="15162" data-permalink="https://textslashplain.com/2026/08/05/fiddler-in-2026/image-688/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-45.png?fit=299%2C268&ssl=1" data-orig-size="299,268" data-comments-opened="1" data-image-meta="{"aperture":"0","credit":"","camera":"","caption":"","created_timestamp":"0","copyright":"","focal_length":"0","iso":"0","shutter_speed":"0","title":"","orientation":"0","alt":""}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-45.png?fit=299%2C268&ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-45.png?resize=299%2C268&ssl=1" alt="" class="wp-image-15162"/></a><figcaption class="wp-element-caption">Receiving the Engineering Excellence Award for Fiddler, circa 2007</figcaption></figure> 939</div> 940 941 942<p class="wp-block-paragraph">On Monday morning, I got a ping from someone from Progress Software, acquirers of Telerik in 2014, after Telerik acquired Fiddler (and for a few years, me) back in 2012. They asked for an email address to which they could send a note.</p> 943 944 945 946<p class="wp-block-paragraph">“<em>This isn’t gonna be good</em>“, I assumed. Correctly. </p> 947 948 949 950<p class="wp-block-paragraph">After I <a href="https://textslashplain.com/2015/12/23/my-next-adventure/">left Telerik for Google in 2016</a>, development on the “Fiddler Classic” application had stagnated as the owners put their investments into a series of products they could monetize. </p> 951 952 953 954<p class="wp-block-paragraph">
954To be fair, this pivot was not unexpected. Initially, Telerik had purchased Fiddler largely for the community attention: the tool had a huge userbase of the exact developers the company was courting. Still, we always expected that eventually we’d have a <em>cross-platform</em> version of the product (a highly-requested improvement), and <em>that</em> non-Windows version could be sold like Telerik’s other professional tools.</p> 955 956 957 958<h3 class="wp-block-heading">Fiddler: Free Forever?</h3> 959 960 961 962<p class="wp-block-paragraph">Telerik had loudly promised that Fiddler would remain “free forever” to avoid expected <a href="https://weblog.west-wind.com/posts/2011/Mar/19/The-Red-Gate-and-NET-Reflector-Debacle">community outrage</a> about commercializing a previously-free tool. <em>Before Telerik, I had spoken to one potential acquirer who estimated the brand damage of their commercializing another previously-free tool at 25x their acquisition price, meaning they’d likely never turn a profit on it.</em></p> 963 964 965 966<p class="wp-block-paragraph">Telerik’s blog post announcing the change was explicit:</p> 967 968 969 970<figure class="wp-block-image size-full"><a href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-42.png?ssl=1"><img data-recalc-dims="1" loading="lazy" decoding="async" width="750" height="250" data-attachment-id="15132" data-permalink="https://textslashplain.com/2026/08/05/fiddler-in-2026/image-685/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-42.png?fit=874%2C291&ssl=1" data-orig-size="874,291" data-comments-opened="1" data-image-meta="{"aperture":"0","credit":"","camera":"","caption":"","created_timestamp":"0","copyright":"","focal_length":"0","iso":"0","shutter_speed":"0","title":"","orientation":"0","alt":""}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-42.png?fit=750%2C250&ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-42.png?resize=750%2C250&ssl=1" alt="" class="wp-image-15132" srcset="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-42.png?w=874&ssl=1 874w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-42.png?resize=300%2C100&ssl=1 300w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-42.png?resize=768%2C256&ssl=1 768w" sizes="auto, (max-width: 750px) 100vw, 750px" /></a></figure> 971 972 973 974<p class="wp-block-paragraph">… but even that wasn’t enough, so a follow-up post was made shortly after:</p> 975 976 977 978<figure class="wp-block-image size-full"><a href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-43.png?ssl=1"><img data-recalc-dims="1" loading="lazy" decoding="async" width="750" height="327" data-attachment-id="15134" data-permalink="https://textslashplain.com/2026/08/05/fiddler-in-2026/image-686/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-43.png?fit=868%2C378&ssl=1" data-orig-size="868,378" data-comments-opened="1" data-image-meta="{"aperture":"0","credit":"","camera":"","caption":"","created_timestamp":"0","copyright":"","focal_length":"0","iso":"0","shutter_speed":"0","title":"","orientation":"0","alt":""}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-43.png?fit=750%2C327&ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-43.png?resize=750%2C327&ssl=1" alt="" class="wp-image-15134" srcset="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-43.png?w=868&ssl=1 868w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-43.png?resize=300%2C131&ssl=1 300w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-43.png?resize=768%2C334&
978ssl=1 768w" sizes="auto, (max-width: 750px) 100vw, 750px" /></a></figure> 979 980 981 982<p class="wp-block-paragraph">The unambiguous clarity of this promise had meant that improving the “Fiddler Business” meant we’d need to: 1) monetize the technology behind Fiddler (we had several solid ideas), or 2) pivot to a new cross-platform product they could sell, or 3) renege on their promise and start charging for Fiddler for Windows, or 4) use Fiddler to showcase (and juice sales of) Telerik’s .NET component products.</p> 983 984 985 986<p class="wp-block-paragraph">While I was at Telerik, I worked a little on #1 — we created a licensable version of FiddlerCore, the core engine inside Fiddler, with the idea that other companies could sell products based on it. Telerik had used FiddlerCore inside their <a href="https://www.telerik.com/teststudio">Test Studio</a> product (that’s how I came to their attention to start with), and we assumed that other companies might want similar technology. Interest was… not very high… in part because we made little effort to evangelize, and partly because the license price would limit it to larger companies.</p> 987 988 989 990<p class="wp-block-paragraph">Very frustratingly and humiliatingly, my once-and-future employer wanted to use FiddlerCore inside their <a href="https://en.wikipedia.org/wiki/Microsoft_Network_Monitor">Message Analyzer</a> product. <em>But Microsoft didn’t want to pay the license fee</em>. So instead, the software juggernaut worth hundreds of billions of dollars wrote code to <em>prompt their end-users to </em>pirate <em>FiddlerCore</em>:</p> 991 992 993<div class="wp-block-image"> 994<figure class="aligncenter size-full is-resized"><a href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-44.png?ssl=1"><img data-recalc-dims="1" loading="lazy" decoding="async" width="400" height="184" data-attachment-id="15139" data-permalink="https://textslashplain.com/2026/08/05/fiddler-in-2026/image-687/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-44.png?fit=400%2C184&ssl=1" data-orig-size="400,184" data-comments-opened="1" data-image-meta="{"aperture":"0","credit":"","camera":"","caption":"","created_timestamp":"0","copyright":"","focal_length":"0","iso":"0","shutter_speed":"0","title":"","orientation":"0","alt":""}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-44.png?fit=400%2C184&ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-44.png?resize=400%2C184&ssl=1" alt="" class="wp-image-15139" style="width:530px;height:auto" srcset="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-44.png?w=400&ssl=1 400w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-44.png?resize=300%2C138&ssl=1 300w" sizes="auto, (max-width: 400px) 100vw, 400px" /></a></figure> 995</div> 996 997 998<p class="wp-block-paragraph">This is the sort of behavior then most often seen from shady apps trying to avoid paying MP3 patent fees. To this day, I remain <em>shocked</em> that the lawyers from both companies allowed this experience to ship. (<em>The fact that Microsoft-ecosystem developers made up virtually all of Telerik’s customers probably had something to do with Telerik not suing)</em>.</p> 999 1000 1001 1002<p class="wp-block-paragraph">Days after I started at Telerik, I started work on strategy #2 (build a cross-platform version). I spent months trying to get Fiddler running on <a href="https://en.wikipedia.org/wiki/Mono_(software)">Mono</a>, an early cross-platform version of the .NET Framework that ran on Mac and Linux. It didn’t go great. I built a <em>serviceable </em>version for Linux, but the UI port for MacOS would crash constantly. A hybrid strategy, using Mono for FiddlerCore, and building a new front-end on Electron, seemed like a plausible path forward. Alas, this vision was put on pause in 2014 after Telerik conducted broad US-based layoffs in advance of an expected IPO on the US stock market. After its aborted IPO and subsequent acquisition by <a href="https://en.wikipedia.org/wiki/Progress_Software">Progress Software</a>, Telerik eventually restarted this strategy, eventually shipping <a href="https://www.telerik.com/fiddler/fiddler-everywhere">Fiddler Everywhere</a>. Fiddler Everywhere offered several key advantages over the Windows-only Fiddler Classic (cross platform! some team features!) but it also had many shortcomings (fewer features, no extensibility model).</p> 1003 1004 1005 1006<p class="wp-block-paragraph">I’d hoped that Progress/Telerik might open-source Fiddler Classic at some point in order to grow the <em>ecosystem</em>— things like the Fiddler SAZ format would get even more popular and create the possibility of monetizable synergies. Alas, this never happened. Instead, Fiddler Classic just quietly <em>decayed</em>. As browsers adopted new standards (e.g. http2, h3, GREASE, tls1.3, <code>zstd</code> content compression), Fiddler Classic required more and more caveats and workarounds for continued use. However, Fiddler’s rich extensibility model means that I could keep <a href="https://textslashplain.com/2025/05/16/fiddler-in-2025/">building new capabilities</a> <a href="https://gist.github.com/ericlaw1979">in</a> <a href="https://textslashplain.com/2022/01/08/debug-native-messaging/">and on</a> Fiddler in the ten years since I lost the ability to commit updates to Fiddler’s source directly.</p> 1007 1008 1009 1010<p class="wp-block-paragraph">I still use Fiddler on Windows almost every single day, but in many cases I’m not even using Fiddler to <em>capture </em>traffic anymore, instead just using it as a viewer for traffic <a href="https://textslashplain.com/2020/04/08/analyzing-network-traffic-logs-netlog-json/">captured natively by Chromium</a>, or to use its TextEncoder and Inspectors, or even as a <a href="https://textslashplain.com/2022/01/08/debug-native-messaging/#:~:text=Tampering%20with%20Messages">frontend for other tools</a>.</p> 1011 1012 1013 1014<p class="wp-block-paragraph">Progress added a pre-download survey to collect user emails (<em>annoying!</em>) and periodically added surveys and advertisements directly inside the Fiddler Classic UI. But even if those were sometimes gratingly <a href="https://textslashplain.com/2025/05/16/fiddler-in-2025/#:~:text=Add%20a%20SingleBrowserMode%20button%20to%20Fiddler%E2%80%99s%20toolbar">misleading</a>, they weren’t <em>too </em>annoying.</p> 1015 1016 1017<div class="wp-block-image"> 1018<figure class="aligncenter size-full"><a href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-48.png?ssl=1"><img data-recalc-dims="1" loading="lazy" decoding="async" width="391" height="159" data-attachment-id="15233" data-permalink="https://textslashplain.com/2026/08/05/fiddler-in-2026/image-691/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-48.png?fit=391%2C159&ssl=1" data-orig-size="391,159" data-comments-opened="1" data-image-meta="{"aperture":"0","credit":"","camera":"","caption":"","created_timestamp":"0","copyright":"","focal_length":"0","iso":"0","shutter_speed":"0","title":"","orientation":"0","alt":""}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-48.png?fit=391%2C159&ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-48.png?resize=391%2C159&ssl=1" alt="" class="wp-image-15233" srcset="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-48.png?w=391&ssl=1 391w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-48.png?resize=300%2C122&
1018ssl=1 300w" sizes="auto, (max-width: 391px) 100vw, 391px" /></a></figure> 1019</div> 1020 1021 1022<p class="wp-block-paragraph">Other changes of <a href="https://textslashplain.com/2025/03/31/runtime-signature-checking-threat-model/">dubious value</a> were also only mildly annoying.</p> 1023 1024 1025 1026<h2 class="wp-block-heading">This Week’s Rug Pull</h2> 1027 1028 1029 1030<p class="wp-block-paragraph">Opening Fiddler on Monday, I was presented with a Fiddler Update announcement, including some neat improvements, particularly support for <code>ZSTD</code> decompression (obsoleting my <a href="https://textslashplain.com/2025/05/16/fiddler-in-2025/#:~:text=this%20decades%20ago.-,Disable%20ZSTD,-ZStandard%20is%20a">workaround</a>):</p> 1031 1032 1033<div class="wp-block-image"> 1034<figure class="aligncenter size-full"><a href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-30.png?ssl=1"><img data-recalc-dims="1" loading="lazy" decoding="async" width="658" height="270" data-attachment-id="15026" data-permalink="https://textslashplain.com/2026/08/05/fiddler-in-2026/image-673/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-30.png?fit=658%2C270&ssl=1" data-orig-size="658,270" data-comments-opened="1" data-image-meta="{"aperture":"0","credit":"","camera":"","caption":"","created_timestamp":"0","copyright":"","focal_length":"0","iso":"0","shutter_speed":"0","title":"","orientation":"0","alt":""}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-30.png?fit=658%2C270&ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-30.png?resize=658%2C270&ssl=1" alt="" class="wp-image-15026" srcset="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-30.png?w=658&ssl=1 658w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-30.png?resize=300%2C123&ssl=1 300w" sizes="auto, (max-width: 658px) 100vw, 658px" /></a></figure> 1035</div> 1036 1037 1038<p class="wp-block-paragraph">However, I didn’t accept the update straight away because I suspected something was afoot. (I <em>also</em> got distracted because Windows <a href="https://textslashplain.com/2026/08/03/authenticode-and-uac/#:~:text=Surprise%20%232%20%E2%80%93%20Chain%20Building">complained about the installer’s signature</a>).</p> 1039 1040 1041 1042<p class="wp-block-paragraph">Sure enough, the first screen of the installer mentions another <strong>IMPORTANT </strong>change in Fiddler that was not mentioned in that shiny update announcement:</p> 1043 1044 1045<div class="wp-block-image"> 1046<figure class="aligncenter size-full"><a href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-31.png?ssl=1"><img data-recalc-dims="1" loading="lazy" decoding="async" width="422" height="290" data-attachment-id="15028" data-permalink="https://textslashplain.com/2026/08/05/fiddler-in-2026/image-674/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-31.png?fit=422%2C290&ssl=1" data-orig-size="422,290" data-comments-opened="1" data-image-meta="{"aperture":"0","credit":"","camera":"","caption":"","created_timestamp":"0","copyright":"","focal_length":"0","iso":"0","shutter_speed":"0","title":"","orientation":"0","alt":""}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-31.png?fit=422%2C290&ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-31.png?resize=422%2C290&ssl=1" alt="" class="wp-image-15028" srcset="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-31.png?w=422&ssl=1 422w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-31.png?resize=300%2C206&ssl=1 300w" sizes="auto, (max-width: 422px) 100vw, 422px" /></a></figure> 1047</div> 1048 1049 1050<p class="wp-block-paragraph"><strong>Progress Telerik has decided to start demanding Fiddler Classic not be used for “<a href="https://www.telerik.com/fiddler/fiddler-classic/commercial-use">commercial</a>” purposes</strong>. Beyond the new text in the <a href="https://www.telerik.com/purchase/license-agreement/fiddler">
1050license</a>, Fiddler shows this big orange bar:</p> 1051 1052 1053 1054<figure class="wp-block-image size-large"><a href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-28.png?ssl=1"><img data-recalc-dims="1" loading="lazy" decoding="async" width="750" height="54" data-attachment-id="15019" data-permalink="https://textslashplain.com/2026/08/05/fiddler-in-2026/image-671/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-28.png?fit=1286%2C93&ssl=1" data-orig-size="1286,93" data-comments-opened="1" data-image-meta="{"aperture":"0","credit":"","camera":"","caption":"","created_timestamp":"0","copyright":"","focal_length":"0","iso":"0","shutter_speed":"0","title":"","orientation":"0","alt":""}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-28.png?fit=750%2C54&ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-28.png?resize=750%2C54&ssl=1" alt="" class="wp-image-15019" srcset="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-28.png?resize=1024%2C74&ssl=1 1024w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-28.png?resize=300%2C22&ssl=1 300w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-28.png?resize=768%2C56&ssl=1 768w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-28.png?resize=1200%2C87&ssl=1 1200w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-28.png?w=1286&ssl=1 1286w" sizes="auto, (max-width: 750px) 100vw, 750px" /></a></figure> 1055 1056 1057 1058<p class="wp-block-paragraph">So… it appears that the owners of Fiddler have reneged on their promise to the community and the product is no longer free.</p> 1059 1060 1061 1062<h2 class="wp-block-heading">Dialogue with Progress/Telerik</h2> 1063 1064 1065 1066<p class="wp-block-paragraph">Taken literally, the license agreement says <strong>you cannot use Fiddler Classic for commercial purposes, even if you pay!</strong> This is rather shocking, because it means that Fiddler’s most engaged users, who’ve built extensions and workflows around Fiddler, cannot use them, even if they’re willing to pay up. Such a position seems so wildly foolish that I<em> assumed </em>it must just be an oversight. I inquired, and Progress Telerik provided the following statement:</p> 1067 1068 1069 1070<blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow"> 1071<p class="wp-block-paragraph">No, Progress is not planning to offer Fiddler Classic under a paid licence. </p> 1072 1073 1074 1075<p class="wp-block-paragraph">We recognise the important role Fiddler Classic has played in supporting developers’ debugging workflows over many years. Continuing to invest in the product at the level required for commercial and enterprise customers, including ongoing feature development and platform modernisation, is not aligned with our long-term product strategy. Accordingly, in recent years, Progress has focused on maintaining and supporting Fiddler Classic, while directing its development efforts towards Fiddler Everywhere. </p> 1076 1077 1078 1079<p class="wp-block-paragraph">That said, we recognise the value of the extensibility capabilities available in Fiddler Classic. As a result, we will continue to work on scripting functionality in Fiddler Everywhere to help users continue their existing workflows with minimal disruption. We will also continue to evaluate additional feature requests based on customer needs and use cases. As always, we remain open to feedback and are committed to understanding how we can best support our users. </p> 1080</blockquote> 1081 1082 1083 1084<p class="wp-block-paragraph">Improved scripting functionality may satisfy <em>some </em>users, but it definitely will not encompass the wide range of scenarios enjoyed by Fiddler Classic today, especially for users who’ve built custom Inspectors, Transcoders, or other extensions that integrate Fiddler with other systems and processes used within their companies.</p> 1085 1086 1087 1088<p class="wp-block-paragraph">In a closing paragraph of their response, the Progress/Telerik product manager (or, more likely, their lawyer) appears to have attempted to suggest that I shouldn’t share my thoughts with you fine folks (emphasis mine):</p> 1089 1090 1091 1092<blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow"> 1093<p class="wp-block-paragraph">
1093Last but not at least, no person outside Progress is authorized to make announcements, <strong>provide comments</strong>, or respond to customersâ inquiries regarding Progressâ business on behalf of the company. All questions should be directed to Progressâ official communication channels [email protected]. </p> 1094</blockquote> 1095 1096 1097 1098<p class="wp-block-paragraph">Needless to say, I don’t speak <em>on behalf of</em> my former employer, but they’re also not going to stop me from talking about this change.</p> 1099 1100 1101 1102<h2 class="wp-block-heading">My Feelings</h2> 1103 1104 1105 1106<p class="wp-block-paragraph">Some folks have asked how I feel about this. In short, <strong><em>disappointed, somewhat betrayed, but ultimately not surprised</em></strong>. Fiddler for Windows is a powerful tool that provides a tremendous amount of value to its users, and the nature of short-term profit maximization is that companies with valuable assets often struggle to recognize the long-term value of not abusing their users.</p> 1107 1108 1109 1110<p class="wp-block-paragraph">As I talked about previously in my post about mistakes I made when building Fiddler, my <a href="https://textslashplain.com/2024/11/24/fiddler-my-mistakes/#:~:text=a%20billion%20dollars%3F-,Monetization,-As%20Fiddler%20usage">lack of a monetization plan</a> was a key shortcoming in the product’s strategy. When Telerik acquired Fiddler, I assumed that the business folks there would develop a strategy beyond “monetizing the eyeballs” of the tens of thousands of weekly downloaders (although it was a bargain for that traffic acquisition alone).</p> 1111 1112 1113 1114<p class="wp-block-paragraph">As I’ve described above, development of a monetizable product strategy never got any real attention. Meanwhile, the team over at <a href="https://en.wikipedia.org/wiki/Postman,_Inc.">Postman</a> hypothesized that a team-based product would be a winner, they tailored their offering accordingly, and their valuation skyrocketed to <strong>$5.6B </strong>after <strong>$433M</strong> in VC funding. I suspect that Postman’s true pre-IPO valuation may be lower, but for perspective, Progress Software’s <em>entire</em> market capitalization is currently just <strong><a href="https://finance.yahoo.com/quote/PRGS/">$1.7B</a>.</strong></p> 1115 1116 1117 1118<p class="wp-block-paragraph">I was excited to recently see Progress move Fiddler Everywhere toward the hottest trend in tech (Artificial Intelligence) by introducing support for <a href="https://www.telerik.com/support/whats-new/fiddler-everywhere/2025-q4">MCP and the popular agents</a>. Done right, this could be a <strong>killer feature </strong>that people are willing to pay big money for because of the value it can deliver.</p> 1119 1120 1121 1122<p class="wp-block-paragraph">However, I worry that Progress may have just vaporized the trust and goodwill that would’ve smoothed their plan to move users from a solid (if outdated) free product to an actively-developed paid product with a disjoint feature set. That’s especially true because Fiddler’s Session Archive Zip (SAZ) format could’ve allowed compatibility between the two.</p> 1123 1124 1125 1126<h2 class="wp-block-heading">Where Do We Go From Here?</h2> 1127 1128 1129 1130<p class="wp-block-paragraph">Many Fiddler Classic users can happily continue to use the product for free for their personal non-commercial needs. Some Fiddler Classic customers may be happy to switch to Fiddler Everywhere with <a href="https://www.telerik.com/purchase/fiddler">prices starting at $84/user/year</a> for a feature-limited version of the product, or $444/user/year for the full Fiddler Everywhere feature set (which does not, as noted above, have all of Fiddler Classic’s features or compatibility with its extensions).</p> 1131 1132 1133 1134<p class="wp-block-paragraph">Some users have told me that they’ve be taking measures to disable Fiddler 5.x’s upgrade logic and remain on the final free version forever under <a href="https://web.archive.org/web/20260414160505/https://www.telerik.com/purchase/license-agreement/fiddler">its original license</a>. They’ll use the extensibility model to <a href="https://textslashplain.com/2025/05/16/fiddler-in-2025/">keep it compatible</a> with the modern web. Unfortunately, public redistribution of the older installer is not permitted under its license.</p> 1135 1136 1137 1138<p class="wp-block-paragraph">Some users will likely just stop using Fiddler entirely. As browser developer tools have evolved, many web developers’ needs are now fully met by the Network tab in their respective browsers.</p> 1139 1140 1141 1142<p class="wp-block-paragraph">Some users will likely move to competitive products, whether pay (<a href="https://postman.com">Postman</a>, <a href="https://www.charlesproxy.com/">Charles</a>) or free open-source (<a href="https://www.mitmproxy.org/">mitmproxy</a>) or hybrid (<a href="https://www.fluxzy.io/features">Fluxzy.io</a>).</p> 1143 1144 1145 1146<h2 class="wp-block-heading">Fiddler -> CLeARINET?</h2> 1147 1148 1149 1150<p class="wp-block-paragraph">One thing that’s particularly baffling about Progress’ decision is the timing. Crippling Fiddler might’ve made <em>some </em>(evil) sense back in 2020 or so, but if you haven’t noticed, times have changed. </p> 1151 1152 1153 1154<ul class="wp-block-list"> 1155<li>AI agents have enabled <a href="https://textslashplain.com/2025/04/15/vibe-coding-for-security/">vibe-coding</a>
1155 of production-quality code rapidly and cheaply. When a pre-Telerik acquirer asked me how long it would take them to implement their own, I guessed about 2000 hours, or about 700 if I guided them. Using an AI coding agent, I suspect you could get 90% of the way there in about 160 hours.</li> 1156 1157 1158 1159<li>Much of the work in building Fiddler was in “figuring stuff out”, and the resources for doing that are dramatically better than ever before: we have better blogs, better tooling, better RFCs, and more open-source code than ever before. </li> 1160 1161 1162 1163<li>The .NET platform is dramatically more capable (particularly related to async) than the v2.0 framework that Fiddler mostly targeted. I’ve already laid out a set of <a href="https://textslashplain.com/2024/11/24/fiddler-my-mistakes/">mistakes</a> and pitfalls to avoid. </li> 1164 1165 1166 1167<li>There’s a large community of .NET developers who might be interested in lending a hand, including many hundreds that recently voluntarily retired from Microsoft. And there are some <em>amazingly </em>bright developers (Kevin, Jérôme, Chrisx3, etc) who have built extensions and other code for legacy Fiddler who might jump at the chance to get their PRs into an open-source replacement.</li> 1168 1169 1170 1171<li>Fiddler has no “moat” — the SAZ file format is simple and easily read and written. The product is designed to interact with protocols and formats based on open-standards. The true <em>value </em>of Fiddler was almost entirely “goodwill.”</li> 1172</ul> 1173 1174 1175 1176<p class="coblocks-animate wp-block-paragraph" data-coblocks-animation="slideInLeft"><strong><em>Times seem ripe for a change.</em></strong></p> 1177 1178 1179 1180<p class="wp-block-paragraph">When I named Fiddler, I did so because I was on the Microsoft Office clipart team and I knew we had plenty of free pictures of violins handy. Time has passed, and we have AI that can generate any images we want. An important kid in my life plays clarinet. If you squint at it, Clarinet sounds kinda like “Clear INET”, and seeing internet traffic in the clear is the whole point here. </p> 1181 1182 1183 1184<p class="wp-block-paragraph">In about 5 minutes, we’ve got a name, a <a href="https://clearinet.app">domain</a>, and a splash screen.</p> 1185 1186 1187<div class="wp-block-image"> 1188<figure class="aligncenter size-full is-resized has-lightbox"><a href="https://clearinet.app"><img data-recalc-dims="1" loading="lazy" decoding="async" width="750" height="419" data-attachment-id="15195" data-permalink="https://textslashplain.com/2026/08/05/fiddler-in-2026/image-690/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-47.png?fit=1024%2C572&ssl=1" data-orig-size="1024,572" data-comments-opened="1" data-image-meta="{"aperture":"0","credit":"","camera":"","caption":"","created_timestamp":"0","copyright":"","focal_length":"0","iso":"0","shutter_speed":"0","title":"","orientation":"0","alt":""}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-47.png?fit=750%2C419&ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-47.png?resize=750%2C419&ssl=1" alt="" class="wp-image-15195" style="aspect-ratio:1.7902739922536222;width:614px;height:auto" srcset="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-47.png?w=1024&ssl=1 1024w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-47.png?resize=300%2C168&ssl=1 300w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-47.png?resize=768%2C429&ssl=1 768w" sizes="auto, (max-width: 750px) 100vw, 750px" /></a></figure> 1189</div> 1190 1191 1192<p class="wp-block-paragraph">Now we just need some code. :)<br><br>I’m currently in an especially busy period at work and in life (I’m moving houses this month) but I hope to have some progress and updates in this space sometime soon. <em>Unless Progress Software wants to save me the trouble and win tons of kudos for open-sourcing FiddlerClassic themselves! ;-) </em><br><br><br>-Eric</p> 1193 1194 1195 1196<h2 class="wp-block-heading">Appendix: Fiddler Origins</h2> 1197 1198 1199 1200<p class="wp-block-paragraph"><em>This section is from the <a href="https://fiddlerbook.com">Fiddler Book</a>.</em></p> 1201 1202 1203 1204<p class="wp-block-paragraph">First, a confessionâthe Fiddler Web Debugger is not the result of a grand vision or the ambition to develop the worldâs most popular debugging proxy. A tool born of necessity, I never set out to build a platform so flexible, powerful, and complicated that Iâd be forced to spend a year writing a book to explain how to fully take advantage of it. But here we are.</p> 1205 1206 1207 1208<p class="wp-block-paragraph">Before diving into the technical chapters, I will begin by sharing the story behind how Fiddler came to be.</p> 1209 1210 1211 1212<p class="wp-block-paragraph">As a student at the University of Maryland in the spring of 1999, I had the chance to interview for a Program Management internship on a new team at Microsoft. One of my final interviewerâs first questions was â<em>How does HTTP work?</em>â Knowing only the basics, I gave an incomplete and somewhat inaccurate answer, but didnât embarrass myself too badly. That summer and the following, I worked on features for the first version of SharePoint. On rare occasions, I found myself looking at web traffic in Microsoft Network Monitor (NetMon), a powerful but then primitive and difficult-to-use packet sniffer. In the early summer of 2001, I joined Microsoft full-time as the Program Manager for the Office Clip Art client and website.</p> 1213 1214 1215 1216<p class="wp-block-paragraph">At that time, most of the developers and testers working on my team were new to web development, having previously been responsible for writing native code applications in C and C++. It was quickly apparent that the debugging process was overly cumbersomeâmany of my colleagues were loath to use NetMon. I even watched some developers debugging HTTP requests by hovering over variables in Visual Studio, examining the raw traffic in hex:</p> 1217 1218 1219<div class="wp-block-image"> 1220<figure class="aligncenter size-full"><a href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-22.png?ssl=1"><img data-recalc-dims="1" loading="lazy" decoding="async" width="388" height="442" data-attachment-id="15005" data-permalink="https://textslashplain.com/2026/08/05/fiddler-in-2026/image-665/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-22.png?fit=388%2C442&ssl=1" data-orig-size="388,442" data-comments-opened="1" data-image-meta="{"aperture":"0","credit":"","camera":"","caption":"","created_timestamp":"0","copyright":"","focal_length":"0","iso":"0","shutter_speed":"0","title":"","orientation":"0","alt":""}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-22.png?fit=388%2C442&ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-22.png?resize=388%2C442&ssl=1" alt="" class="wp-image-15005" srcset="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-22.png?w=388&ssl=1 388w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-22.png?resize=263%2C300&ssl=1 263w" sizes="auto, (max-width: 388px) 100vw, 388px" /></a></figure> 1221</div> 1222 1223 1224<p class="wp-block-paragraph">Having developed several small Windows utilities, I was confident that I could code something to make web debugging simpler. My first simplistic effort was based on taking an existing C++ proxy server and making minor modifications to it so that it would spew HTTP traffic to the system console:</p> 1225 1226 1227<div class="wp-block-image"> 1228<figure class="aligncenter size-full"><a href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-23.png?ssl=1"><img data-recalc-dims="1" loading="lazy" decoding="async" width="750" height="284" data-attachment-id="15008" data-permalink="https://textslashplain.com/2026/08/05/fiddler-in-2026/image-666/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-23.png?fit=879%2C333&ssl=1" data-orig-size="879,333" data-comments-opened="1" data-image-meta="{"aperture":"0","credit":"","camera":"","caption":"","created_timestamp":"0","copyright":"","focal_length":"0","iso":"0","shutter_speed":"0","title":"","orientation":"0","alt":""}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-23.png?fit=750%2C284&ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-23.png?resize=750%2C284&ssl=1" alt="" class="wp-image-15008" srcset="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-23.png?w=879&ssl=1 879w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-23.png?resize=300%2C114&ssl=1 300w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-23.png?resize=768%2C291&
1228ssl=1 768w" sizes="auto, (max-width: 750px) 100vw, 750px" /></a></figure> 1229</div> 1230 1231 1232<p class="wp-block-paragraph">Itâs generous to call this effort primitiveâthe proxy couldnât handle secure traffic or authentication protocols. Non-text content was another problemâcomically, the utility would try to render binary content as ASCII. Old-school console users may recall that the octet 0x07 represents the âbellâ character, and when itâs displayed in the console, a system beep is played. Soon after its release, the hallways of the Office Online team sounded like a Las Vegas casino, as binary content flowed through the debug proxies running in each testerâs office.</p> 1233 1234 1235 1236<p class="wp-block-paragraph">Despite the very annoying limitations, this tool was still popular, and I was inspired to get started on the next version. I mocked up a quick little demo in Borland Delphi, a native code language used for most of my development work at the time. The colorful UI foreshadowed Fiddlerâs eventual appearance:</p> 1237 1238 1239<div class="wp-block-image"> 1240<figure class="aligncenter size-full"><a href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-24.png?ssl=1"><img data-recalc-dims="1" loading="lazy" decoding="async" width="635" height="451" data-attachment-id="15010" data-permalink="https://textslashplain.com/2026/08/05/fiddler-in-2026/image-667/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-24.png?fit=635%2C451&ssl=1" data-orig-size="635,451" data-comments-opened="1" data-image-meta="{"aperture":"0","credit":"","camera":"","caption":"","created_timestamp":"0","copyright":"","focal_length":"0","iso":"0","shutter_speed":"0","title":"","orientation":"0","alt":""}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-24.png?fit=635%2C451&ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-24.png?resize=635%2C451&ssl=1" alt="" class="wp-image-15010" srcset="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-24.png?w=635&ssl=1 635w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-24.png?resize=300%2C213&ssl=1 300w" sizes="auto, (max-width: 635px) 100vw, 635px" /></a></figure> 1241</div> 1242 1243 1244<p class="wp-block-paragraph">However, as I pondered the security and memory-management implications of writing a proxy server in native code, I soon decided that my next effort would be developed in C#, a new language being developed by the Visual Studio team that my best friend had just joined. The notion of writing a HTTP proxy server from scratch in .NET posed just two significant challenges: I didnât really know how HTTP worked, and I didnât know how to code in C#.</p> 1245 1246 1247 1248<p class="wp-block-paragraph">Fortunately, given a few trips to the bookstore and a lot of spare weekends, both shortcomings would be remedied. Two books were my constant companions: <a href="https://www.amazon.com/HTTP-Definitive-Guide-Guides/dp/1565925092/ref=sr_1_1?crid=5KEMUR9HYE13&dib=eyJ2IjoiMSJ9.LBObjKK5kMhgdv-6igreM_krQJmJfnXABb3lPgR3VzDQbV7-XXVB3eyClfqhdsXAjyZkbaZXF9d3aKl4RHBVHVrGgZEO5aswwXyzYI1DT6jiiJ73gM51C5VCob6Ve182a69p9lAyBZb7LvGjJ3FyyneBQ7kQVWDrqHqCBcevV27jCu3GgybxP2rYtSDdGPuU.9_9MWngG0abF
1248hOr0vmSRPzCj0_shROV21vtcJgwUqos&dib_tag=se&keywords=http+the+definitive+guide&qid=1785953616&sprefix=http+the+definitive+guid%2Caps%2C136&sr=8-1">HTTP: The Definitive Guide</a> and the <a href="https://www.amazon.com/C-Cookbook-2nd-Cookbooks-OReilly/dp/0596100639/ref=sr_1_8?crid=3UPTPBGBODFR8&dib=eyJ2IjoiMSJ9.jeviSN0Ah9DRbG9uGiIm-TUfwkG7JoZY30Zv2_-kihM8DjeYZvKNyj-A7kjjj6e8yRoWfvBNmEk4jGJK4kyF4Tf0Z5nteO2jb0OLD74iRcBlgHnvMPMoUD8Q1_tLEAdO0fcBK0xDHs9GIHYeiTjwx-2QkCD8iK15i9qPmsapTPGTvlpfOp0z4zYb6vvCdhzIaU3PMMzCXFHuxyHKIumdiwqmlSr88kKmf8t0IFqj780.CjxPsrrE5jznxopNWB3lcdao3FRHNtldS-u1V9nKOsg&dib_tag=se&keywords=C%23+cookbook&qid=1785953631&sprefix=c+cookbook%2Caps%2C168&sr=8-8">C# Cookbook</a>. Chapter by chapter, I learned about HTTP and C#, and week-by-week Fiddler came to life. About six months after I started, I had a basic version of Fiddler ready:</p> 1249 1250 1251 1252<figure class="wp-block-image size-large"><a href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-25.png?ssl=1"><img data-recalc-dims="1" loading="lazy" decoding="async" width="750" height="327" data-attachment-id="15012" data-permalink="https://textslashplain.com/2026/08/05/fiddler-in-2026/image-668/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-25.png?fit=1317%2C573&ssl=1" data-orig-size="1317,573" data-comments-opened="1" data-image-meta="{"aperture":"0","credit":"","camera":"","caption":"","created_timestamp":"0","copyright":"","focal_length":"0","iso":"0","shutter_speed":"0","title":"","orientation":"0","alt":""}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-25.png?fit=750%2C327&ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-25.png?resize=750%2C327&ssl=1" alt="" class="wp-image-15012" srcset="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-25.png?resize=1024%2C446&ssl=1 1024w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-25.png?resize=300%2C131&ssl=1 300w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-25.png?resize=768%2C334&ssl=1 768w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-25.png?resize=1200%2C522&ssl=1 1200w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-25.png?w=1317&ssl=1 1317w" sizes="auto, (max-width: 750px) 100vw, 750px" /></a></figure> 1253 1254 1255 1256<p class="wp-block-paragraph">Like its predecessors, it too had a large number of limitations (and thousands of bugs) but it was eagerly adopted by colleagues whose PC speakers were in danger of burning out from the incessant beeps of my first proxy utility.</p> 1257 1258 1259 1260<p class="wp-block-paragraph">Over the subsequent years, Fiddler was progressively enhanced with two extensibility models, a mechanism to automatically generate and modify responses, and support for secure (HTTPS) traffic, FTP, and HTML5 WebSockets. In 2012, Fiddler was ported to the Mono Framework, enabling it to run directly on Mac and Linux PCs and virtual machines.</p> 1261 1262 1263<div class="wp-block-image"> 1264<figure class="aligncenter size-full is-resized"><a href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-26.png?ssl=1"><img data-recalc-dims="1" loading="lazy" decoding="async" width="663" height="503" data-attachment-id="15014" data-permalink="https://textslashplain.com/2026/08/05/fiddler-in-2026/image-669/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-26.png?fit=663%2C503&ssl=1" data-orig-size="663,503" data-comments-opened="1" data-image-meta="{"aperture":"0","credit":"","camera":"","caption":"","created_timestamp":"0","copyright":"","focal_length":"0","iso":"0","shutter_speed":"0","title":"","orientation":"0","alt":""}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-26.png?fit=663%2C503&ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-26.png?resize=663%2C503&ssl=1" alt="" class="wp-image-15014" style="width:387px;height:auto" srcset="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-26.png?w=663&ssl=1 663w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-26.png?resize=300%2C228&ssl=1 300w" sizes="auto, (max-width: 663px) 100vw, 663px" /></a><figcaption class="wp-element-caption">Fiddler’s “About” box shortly after Telerik’s acquisition</figcaption></figure> 1265</div> 1266 1267<div class="wp-block-image"> 1268<figure class="aligncenter size-full is-resized"><a href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-29.png?ssl=1"><img data-recalc-dims="1" loading="lazy" decoding="async" width="332" height="318" data-attachment-id="15022" data-permalink="https://textslashplain.com/2026/08/05/fiddler-in-2026/image-672/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-29.png?fit=332%2C318&ssl=1" data-orig-size="332,318" data-comments-opened="1" data-image-meta="{"aperture":"0","credit":"","camera":"","caption":"","created_timestamp":"0","copyright":"","focal_length":"0","iso":"0","shutter_speed":"0","title":"","orientation":"0","alt":""}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-29.png?fit=332%2C318&ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-29.png?resize=332%2C318&ssl=1" alt="" class="wp-image-15022" style="width:386px;height:auto" srcset="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-29.png?w=332&ssl=1 332w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-29.png?resize=300%2C287&ssl=1 300w" sizes="auto, (max-width: 332px) 100vw, 332px" /></a><figcaption class="wp-element-caption">The <a href="https://en.wikipedia.org/wiki/Easter_egg_(media)">Easter Egg</a> in Fiddler’s “About” box just before leaving Telerik</figcaption></figure> 1269</div> 1270 1271 1272<p class="wp-block-paragraph"></p> 1273 1274 1275 1276<h3 class="wp-block-heading">Appendix: Progress Announcement</h3> 1277 1278 1279 1280<p class="wp-block-paragraph">Progress sent all registered Fiddler users the following email:</p> 1281 1282 1283<div class="wp-block-image"> 1284<figure class="aligncenter size-full"><a href="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-46.png?ssl=1"><img data-recalc-dims="1" loading="lazy" decoding="async" width="455" height="801" data-attachment-id="15190" data-permalink="https://textslashplain.com/2026/08/05/fiddler-in-2026/image-689/" data-orig-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-46.png?fit=455%2C801&ssl=1" data-orig-size="455,801" data-comments-opened="1" data-image-meta="{"aperture":"0","credit":"","camera":"","caption":"","created_timestamp":"0","copyright":"","focal_length":"0","iso":"0","shutter_speed":"0","title":"","orientation":"0","alt":""}" data-image-title="image" data-image-description="" data-image-caption="" data-large-file="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-46.png?fit=455%2C801&ssl=1" src="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-46.png?resize=455%2C801&ssl=1" alt="" class="wp-image-15190" srcset="https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-46.png?w=455&ssl=1 455w, https://i0.wp.com/textslashplain.com/wp-content/uploads/2026/08/image-46.png?resize=170%2C300&
1284ssl=1 170w" sizes="auto, (max-width: 455px) 100vw, 455px" /></a></figure> 1285</div> </div><!-- .entry-content --> 1286 1287 <footer class="entry-footer responsive-max-width"> 1288 <span class="byline"><svg class="svg-icon" width="16" height="16" aria-hidden="true" role="img" focusable="false" viewBox="0 0 24 24" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><path d="M12 12c2.21 0 4-1.79 4-4s-1.79-4-4-4-4 1.79-4 4 1.79 4 4 4zm0 2c-2.67 0-8 1.34-8 4v2h16v-2c0-2.66-5.33-4-8-4z"></path><path d="M0 0h24v24H0z" fill="none"></path></svg><span class="screen-reader-text">Posted by</span><span class="author vcard"><a class="url fn n" href="https://textslashplain.com/author/ericlaw1979/">ericlaw</a></span></span><span class="posted-on"><svg class="svg-icon" width="16" height="16" aria-hidden="true" role="img" focusable="false" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><defs><path id="a" d="M0 0h24v24H0V0z"></path></defs><clipPath id="b"><use xlink:href="#a" overflow="visible"></use></clipPath><path clip-path="url(#b)" d="M12 2C6.5 2 2 6.5 2 12s4.5 10 10 10 10-4.5 10-10S17.5 2 12 2zm4.2 14.2L11 13V7h1.5v5.2l4.5 2.7-.8 1.3z"></path></svg><a href="https://textslashplain.com/2026/08/05/fiddler-in-2026/" rel="bookmark"><time class="entry-date published" datetime="2026-08-05T12:29:11-05:00">2026-08-05</time><time class="updated" datetime="2026-09-16T15:25:53-05:00">2026-09-16</time></a></span><span class="cat-links"><svg class="svg-icon" width="16" height="16" aria-hidden="true" role="img" focusable="false" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M10 4H4c-1.1 0-1.99.9-1.99 2L2 18c0 1.1.9 2 2 2h16c1.1 0 2-.9 2-2V8c0-1.1-.9-2-2-2h-8l-2-2z"></path><path d="M0 0h24v24H0z" fill="none"></path></svg><span class="screen-reader-text">Posted in</span><a href="https://textslashplain.com/category/fiddler-2/" rel="category tag">fiddler</a>, <a href="https://textslashplain.com/category/life/" rel="category tag">life</a>, <a href="https://textslashplain.com/category/storytelling/" rel="category tag">storytelling</a></span><span class="comments-link"><svg class="svg-icon" width="16" height="16" aria-hidden="true" role="img" focusable="false" viewBox="0 0 24 24" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><path d="M21.99 4c0-1.1-.89-2-1.99-2H4c-1.1 0-2 .9-2 2v12c0 1.1.9 2 2 2h14l4 4-.01-18z"></path><path d="M0 0h24v24H0z" fill="none"></path></svg><a href="https://textslashplain.com/2026/08/05/fiddler-in-2026/#comments">8 Comments<span class="screen-reader-text"> on Fiddler in 2026</span></a></span> </footer><!-- .entry-footer --> 1289</article><!-- #post-${ID} --> 1290 1291 <nav class="navigation pagination" aria-label="Posts pagination"> 1292 <h2 class="screen-reader-text">Posts pagination</h2> 1293 <div class="nav-links"><span aria-current="page" class="page-numbers current">1</span> 1294<a class="page-numbers" href="https://textslashplain.com/page/2/">2</a> 1295<a class="page-numbers" href="https://textslashplain.com/page/3/">3</a> 1296<span class="page-numbers dots">…</span> 1297<a class="page-numbers" href="https://textslashplain.com/page/87/">87</a> 1298<a class="next page-numbers" href="https://textslashplain.com/page/2/"><span class="nav-next-text">Older posts</span> <svg class="svg-icon" width="22" height="22" aria-hidden="true" role="img" focusable="false" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M10 6L8.59 7.41 13.17 12l-4.58 4.59L10 18l6-6z"></path><path d="M0 0h24v24H0z" fill="none"></path></svg></a></div> 1299 </nav> 1300 </main><!-- .site-main --> 1301 </section><!-- .content-area --> 1302 1303 1304 </div><!-- #content --> 1305 1306 1307 <footer id="colophon" class="site-footer responsive-max-width"> 1308 1309 <aside class="widget-area responsive-max-width" role="complementary" aria-label="Footer"> 1310 <section id="search-5" class="widget widget_search"><h2 class="widget-title">Search Text/Plain</h2><form role="search" method="get" class="search-form" action="https://textslashplain.com/"> 1311 <label> 1312 <span class="screen-reader-text">Search for:</span> 1313 <input type="search" class="search-field" placeholder="Search …" value="" name="s" /> 1314 </label> 1315 <input type="submit" class="search-submit" value="Search" /> 1316 </form></section><section id="pages-3" class="widget widget_pages"><h2 class="widget-title">Pages</h2> 1317 <ul> 1318 <li class="page_item page-item-1"><a href="https://textslashplain.com/about/">About</a></li> 1319<li class="page_item page-item-5799"><a href="https://textslashplain.com/browse-all-posts/">Browse All Posts</a></li> 1320<li class="page_item page-item-7207"><a href="https://textslashplain.com/categories/">Categories</a></li> 1321<li class="page_item page-item-12129"><a href="https://textslashplain.com/cruises/">Cruises</a></li> 1322<li class="page_item page-item-3855"><a href="https://textslashplain.com/ieinternals-archive/">IEInternals Archive</a></li> 1323<li class="page_item page-item-12762"><a href="https://textslashplain.com/races/">Real-World Races</a></li> 1324 </ul> 1325 1326 </section><section id="rss_links-3" class="widget widget_rss_links"><h2 class="widget-title">RSS</h2><p><a target="_self" href="https://textslashplain.com/feed/" title="Subscribe to posts"><img src="https://textslashplain.com/wp-content/plugins/jetpack/images/rss/orange-small.png" alt="RSS feed" /> RSS - Posts</a></p> 1327</section><section id="blog-stats-3" class="widget blog-stats"><h2 class="widget-title">Blog Stats</h2><ul><li>2,516,148 hits</li></ul></section><section id="categories-5" class="widget widget_categories"><h2 class="widget-title">Categories</h2><form action="https://textslashplain.com" method="get"><label class="screen-reader-text" for="cat">Categories</label><select name='cat' id='cat' class='postform'> 1328 <option value='-1'>
1328Select Category</option> 1329 <option class="level-0" value="49635188">bluebadge (16)</option> 1330 <option class="level-0" value="178">books (3)</option> 1331 <option class="level-0" value="138">browsers (186)</option> 1332 <option class="level-0" value="148">design (27)</option> 1333 <option class="level-0" value="6504">dev (88)</option> 1334 <option class="level-0" value="10138408">fiddler (26)</option> 1335 <option class="level-0" value="124">life (55)</option> 1336 <option class="level-0" value="1054996">perf (20)</option> 1337 <option class="level-0" value="398">politics (2)</option> 1338 <option class="level-0" value="3279">privacy (27)</option> 1339 <option class="level-0" value="309">reviews (2)</option> 1340 <option class="level-0" value="1675">running (20)</option> 1341 <option class="level-0" value="801">security (177)</option> 1342 <option class="level-0" value="1400">storytelling (50)</option> 1343 <option class="level-0" value="318">tech (41)</option> 1344 <option class="level-0" value="200">travel (9)</option> 1345 <option class="level-0" value="1">Uncategorized (16)</option> 1346 <option class="level-0" value="151">web (155)</option> 1347 <option class="level-0" value="374741">windmills (12)</option> 1348</select> 1349</form>
1349<script> 1350( ( dropdownId ) => { 1351 const dropdown = document.getElementById( dropdownId ); 1352 function onSelectChange() { 1353 setTimeout( () => { 1354 if ( 'escape' === dropdown.dataset.lastkey ) { 1355 return; 1356 } 1357 if ( dropdown.value && parseInt( dropdown.value ) > 0 && dropdown instanceof HTMLSelectElement ) { 1358 dropdown.parentElement.submit(); 1359 } 1360 }, 250 ); 1361 } 1362 function onKeyUp( event ) { 1363 if ( 'Escape' === event.key ) { 1364 dropdown.dataset.lastkey = 'escape'; 1365 } else { 1366 delete dropdown.dataset.lastkey; 1367 } 1368 } 1369 function onClick() { 1370 delete dropdown.dataset.lastkey; 1371 } 1372 dropdown.addEventListener( 'keyup', onKeyUp ); 1373 dropdown.addEventListener( 'click', onClick ); 1374 dropdown.addEventListener( 'change', onSelectChange ); 1375})( "cat" ); 1376 1377//# sourceURL=WP_Widget_Categories%3A%3Awidget 1378</script>
1378 1379</section><section id="grofile-3" class="widget widget-grofile grofile"> <img 1380 src="https://2.gravatar.com/avatar/89c27d27b73dd3690b3dad59f3a539d1?s=320" 1381 srcset="https://2.gravatar.com/avatar/89c27d27b73dd3690b3dad59f3a539d1?s=320 1x, https://2.gravatar.com/avatar/89c27d27b73dd3690b3dad59f3a539d1?s=480 1.5x, https://2.gravatar.com/avatar/89c27d27b73dd3690b3dad59f3a539d1?s=640 2x, https://2.gravatar.com/avatar/89c27d27b73dd3690b3dad59f3a539d1?s=960 3x, https://2.gravatar.com/avatar/89c27d27b73dd3690b3dad59f3a539d1?s=1280 4x" 1382 class="grofile-thumbnail no-grav" 1383 alt="ericlaw" 1384 loading="lazy" /> 1385 <div class="grofile-meta"> 1386 <h4><a href="https://gravatar.com/ericlaw1979">ericlaw</a></h4> 1387 <p>Impatient optimist. Dad. Author/speaker. Created Fiddler & SlickRun. PM @ Microsoft 2001-2012, and 2018-, working on Office, IE, and Edge. Now working on Microsoft Defender. My words are my own, I do not speak for any other entity.</p> 1388 </div> 1389 1390 1391 <p><a href="https://gravatar.com/ericlaw1979" class="grofile-full-link"> 1392 View Full Profile → </a></p> 1393 1394 </section> </aside><!-- .widget-area --> 1395 1396 1397 1398 <div class="site-info"> 1399 <a class="site-name" href="https://textslashplain.com/" rel="home">text/plain</a><span class="comma">,</span> 1400<a href="https://wordpress.com/?ref=footer_custom_powered">Powered by WordPress.com</a>. </div><!-- .site-info --> 1401 </footer><!-- #colophon --> 1402 1403</div><!-- #page --> 1404 1405<!-- -->
1406<script type="speculationrules"> 1407{"prefetch":[{"source":"document","where":{"and":[{"href_matches":"/*"},{"not":{"href_matches":["/wp-*.php","/wp-admin/*","/wp-content/uploads/*","/wp-content/*","/wp-content/plugins/*","/wp-content/themes/morden/*","/wp-content/themes/varia/*","/*\\?(.+)"]}},{"not":{"selector_matches":"a[rel~=\"nofollow\"]"}},{"not":{"selector_matches":".no-prefetch, .no-prefetch a"}}]},"eagerness":"conservative"}]} 1408</script>
1408 1409<meta id="bilmur" property="bilmur:data" content="" data-customproperties="{"woo_active":"0","logged_in":"0","wptheme":"morden","wptheme_is_block":"0"}" data-provider="wordpress.com" data-service="atomic" data-site-tz="America/Chicago" >
1410<script defer src="https://s0.wp.com/wp-content/js/bilmur.min.js?m=202639"></script>
1410 1411 <div id="jp-carousel-loading-overlay" style="display: none;"> 1412 <div id="jp-carousel-loading-wrapper"> 1413 <span id="jp-carousel-library-loading"><svg class="jetpack-spinner" width="40" height="40" viewBox="0 0 100 100" xmlns="http://www.w3.org/2000/svg" aria-hidden="true" focusable="false"><circle cx="50" cy="50" r="46" fill="none" stroke="#ddd" stroke-width="8"/><path d="M 50 4 A 46 46 0 0 1 96 50" fill="none" stroke="currentColor" stroke-width="8" stroke-linecap="round"><animateTransform attributeName="transform" type="rotate" dur="1.4s" from="0 50 50" to="360 50 50" repeatCount="indefinite"/></path></svg></span> 1414 </div> 1415 </div> 1416 <div class="jp-carousel-overlay" style="display: none;"> 1417 1418 <div class="jp-carousel-container"> 1419 <!-- The Carousel Swiper --> 1420 <div 1421 class="jp-carousel-wrap swiper jp-carousel-swiper-container jp-carousel-transitions" 1422 itemscope 1423 itemtype="https://schema.org/ImageGallery"> 1424 <div class="jp-carousel swiper-wrapper"></div> 1425 <div class="jp-swiper-button-prev swiper-button-prev"> 1426 <svg width="25" height="24" viewBox="0 0 25 24" fill="none" xmlns="http://www.w3.org/2000/svg"> 1427 <mask id="maskPrev" mask-type="alpha" maskUnits="userSpaceOnUse" x="8" y="6" width="9" height="12"> 1428 <path d="M16.2072 16.59L11.6496 12L16.2072 7.41L14.8041 6L8.8335 12L14.8041 18L16.2072 16.59Z" fill="white"/> 1429 </mask> 1430 <g mask="url(#maskPrev)"> 1431 <rect x="0.579102" width="23.8823" height="24" fill="#FFFFFF"/> 1432 </g> 1433 </svg> 1434 </div> 1435 <div class="jp-swiper-button-next swiper-button-next"> 1436 <svg width="25" height="24" viewBox="0 0 25 24" fill="none" xmlns="http://www.w3.org/2000/svg"> 1437 <mask id="maskNext" mask-type="alpha" maskUnits="userSpaceOnUse" x="8" y="6" width="8" height="12"> 1438 <path d="M8.59814 16.59L13.1557 12L8.59814 7.41L10.0012 6L15.9718 12L10.0012 18L8.59814 16.59Z" fill="white"/> 1439 </mask> 1440 <g mask="url(#maskNext)"> 1441 <rect x="0.34375" width="23.8822" height="24" fill="#FFFFFF"/> 1442 </g> 1443 </svg> 1444 </div> 1445 </div> 1446 <!-- The main close buton --> 1447 <div class="jp-carousel-close-hint"> 1448 <svg width="25" height="24" viewBox="0 0 25 24" fill="none" xmlns="http://www.w3.org/2000/svg"> 1449 <mask id="maskClose" mask-type="alpha" maskUnits="userSpaceOnUse" x="5" y="5" width="15" height="14"> 1450 <path d="M19.3166 6.41L17.9135 5L12.3509 10.59L6.78834 5L5.38525 6.41L10.9478 12L5.38525 17.59L6.78834 19L12.3509 13.41L17.9135 19L19.3166 17.59L13.754 12L19.3166 6.41Z" fill="white"/> 1451 </mask> 1452 <g mask="url(#maskClose)"> 1453 <rect x="0.409668" width="23.8823" height="24" fill="#FFFFFF"/> 1454 </g> 1455 </svg> 1456 </div> 1457 <!-- Image info, comments and meta --> 1458 <div class="jp-carousel-info"> 1459 <div class="jp-carousel-info-footer"> 1460 <div class="jp-carousel-pagination-container"> 1461 <div class="jp-swiper-pagination swiper-pagination"></div> 1462 <div class="jp-carousel-pagination"></div> 1463 </div> 1464 <div class="jp-carousel-photo-title-container"> 1465 <div class="jp-carousel-photo-caption"></div> 1466 </div> 1467 <div class="jp-carousel-photo-icons-container"> 1468 <a href="#" class="jp-carousel-icon-btn jp-carousel-icon-info" aria-label="Toggle photo metadata visibility"> 1469 <span class="jp-carousel-icon"> 1470 <svg width="25" height="24" viewBox="0 0 25 24" fill="none" xmlns="http://www.w3.org/2000/svg"> 1471 <mask id="maskInfo" mask-type="alpha" maskUnits="userSpaceOnUse" x="2" y="2" width="21" height="20"> 1472 <path fill-rule="evenodd" clip-rule="evenodd" d="M12.7537 2C7.26076 2 2.80273 6.48 2.80273 12C2.80273 17.52 7.26076 22 12.7537 22C18.2466 22 22.7046 17.52 22.7046 12C22.7046 6.48 18.2466 2 12.7537 2ZM11.7586 7V9H13.7488V7H11.7586ZM11.7586 11V17H13.7488V11H11.7586ZM4.79292 12C4.79292 16.41 8.36531 20 12.7537 20C17.142 20 20.7144 16.41 20.7144 12C20.7144 7.59 17.142 4 12.7537 4C8.36531 4 4.79292 7.59 4.79292 12Z" fill="white"/> 1473 </mask> 1474 <g mask="url(#maskInfo)"> 1475 <rect x="0.8125" width="23.8823" height="24" fill="#FFFFFF"/> 1476 </g> 1477 </svg> 1478 </span> 1479 </a> 1480 <a href="#" class="jp-carousel-icon-btn jp-carousel-icon-comments" aria-label="Toggle photo comments visibility"> 1481 <span class="jp-carousel-icon"> 1482 <svg width="25" height="24" viewBox="0 0 25 24" fill="none" xmlns="http://www.w3.org/2000/svg"> 1483 <mask id="maskComments" mask-type="alpha" maskUnits="userSpaceOnUse" x="2" y="2" width="21" height="20"> 1484 <path fill-rule="evenodd" clip-rule="evenodd" d="M4.3271 2H20.2486C21.3432 2 22.2388 2.9 22.2388 4V16C22.2388 17.1 21.3432 18 20.2486 18H6.31729L2.33691 22V4C2.33691 2.9 3.2325 2 4.3271 2ZM6.31729 16H20.2486V4H4.3271V18L6.31729 16Z" fill="white"/> 1485 </mask> 1486 <g mask="url(#maskComments)"> 1487 <rect x="0.34668" width="23.8823" height="24" fill="#FFFFFF"/> 1488 </g> 1489 </svg> 1490 1491 <span class="jp-carousel-has-comments-indicator" aria-label="This image has comments."></span> 1492 </span> 1493 </a> 1494 </div>
1495 </div> 1496 <div class="jp-carousel-info-extra"> 1497 <div class="jp-carousel-info-content-wrapper"> 1498 <div class="jp-carousel-photo-title-container"> 1499 <div class="jp-carousel-photo-title"></div> 1500 </div> 1501 <div class="jp-carousel-comments-wrapper"> 1502 <div id="jp-carousel-comments-loading"> 1503 <span>Loading Comments...</span> 1504 </div> 1505 <div class="jp-carousel-comments"></div> 1506 <div id="jp-carousel-comment-form-container"> 1507 <span id="jp-carousel-comment-form-spinner"><svg class="jetpack-spinner" width="20" height="20" viewBox="0 0 100 100" xmlns="http://www.w3.org/2000/svg" aria-hidden="true" focusable="false"><circle cx="50" cy="50" r="46" fill="none" stroke="#ddd" stroke-width="8"/><path d="M 50 4 A 46 46 0 0 1 96 50" fill="none" stroke="currentColor" stroke-width="8" stroke-linecap="round"><animateTransform attributeName="transform" type="rotate" dur="1.4s" from="0 50 50" to="360 50 50" repeatCount="indefinite"/></path></svg></span> 1508 <div id="jp-carousel-comment-post-results"></div> 1509 <form id="jp-carousel-comment-form"> 1510 <label for="jp-carousel-comment-form-comment-field" class="screen-reader-text">Write a Comment...</label> 1511 <textarea 1512 name="comment" 1513 class="jp-carousel-comment-form-field jp-carousel-comment-form-textarea" 1514 id="jp-carousel-comment-form-comment-field" 1515 placeholder="Write a Comment..." 1516 ></textarea> 1517 <div id="jp-carousel-comment-form-submit-and-info-wrapper"> 1518 <div id="jp-carousel-comment-form-commenting-as"> 1519 <fieldset> 1520 <label for="jp-carousel-comment-form-email-field">Email (Required)</label> 1521 <input type="text" name="email" class="jp-carousel-comment-form-field jp-carousel-comment-form-text-field" id="jp-carousel-comment-form-email-field" /> 1522 </fieldset> 1523 <fieldset> 1524 <label for="jp-carousel-comment-form-author-field">Name (Required)</label> 1525 <input type="text" name="author" class="jp-carousel-comment-form-field jp-carousel-comment-form-text-field" id="jp-carousel-comment-form-author-field" /> 1526 </fieldset> 1527 <fieldset> 1528 <label for="jp-carousel-comment-form-url-field">Website</label> 1529 <input type="text" name="url" class="jp-carousel-comment-form-field jp-carousel-comment-form-text-field" id="jp-carousel-comment-form-url-field" /> 1530 </fieldset> 1531 </div> 1532 <input 1533 type="submit" 1534 name="submit" 1535 class="jp-carousel-comment-form-button" 1536 id="jp-carousel-comment-form-button-submit" 1537 value="Post Comment" /> 1538 </div> 1539 </form> 1540 </div> 1541 </div> 1542 <div class="jp-carousel-image-meta"> 1543 <div class="jp-carousel-title-and-caption"> 1544 <div class="jp-carousel-photo-info"> 1545 <div class="jp-carousel-caption" itemprop="caption description"></div> 1546 </div> 1547 1548 <div class="jp-carousel-photo-description"></div> 1549 </div> 1550 <a class="jp-carousel-image-download" href="#" aria-label="Download image" target="_blank" style="display: none;"> 1551 <svg width="25" height="24" viewBox="0 0 25 24" fill="none" xmlns="http://www.w3.org/2000/svg"> 1552 <mask id="mask0" mask-type="alpha" maskUnits="userSpaceOnUse" x="3" y="3" width="19" height="18"> 1553 <path fill-rule="evenodd" clip-rule="evenodd" d="M5.84615 5V19H19.7775V12H21.7677V19C21.7677 20.1 20.8721 21 19.7775 21H5.84615C4.74159 21 3.85596 20.1 3.85596 19V5C3.85596 3.9 4.74159 3 5.84615 3H12.8118V5H5.84615ZM14.802 5V3H21.7677V10H19.7775V6.41L9.99569 16.24L8.59261 14.83L18.3744 5H14.802Z" fill="white"/> 1554 </mask> 1555 <g mask="url(#mask0)"> 1556 <rect x="0.870605" width="23.8823" height="24" fill="#FFFFFF"/> 1557 </g> 1558 </svg> 1559 <span class="jp-carousel-download-text"></span> 1560 </a> 1561 <div class="jp-carousel-image-map" style="display: none;"></div> 1562 </div> 1563 </div>
1564 </div> 1565 </div> 1566 </div> 1567 1568 </div> 1569
1569<script> 1570 /(trident|msie)/i.test(navigator.userAgent)&&document.getElementById&&window.addEventListener&&window.addEventListener("hashchange",function(){var t,e=location.hash.substring(1);/^[A-z0-9_-]+$/.test(e)&&(t=document.getElementById(e))&&(/^(?:a|select|input|button|textarea)$/i.test(t.tagName)||(t.tabIndex=-1),t.focus())},!1); 1571 </script>
1571 1572
1572<script id="jetpack-carousel-js-extra"> 1573var jetpackSwiperLibraryPath = {"url":"https://textslashplain.com/wp-content/plugins/jetpack/_inc/blocks/swiper.js"}; 1574var jetpackCarouselStrings = {"widths":[370,700,1000,1200,1400,2000],"is_logged_in":"","lang":"en","ajaxurl":"https://textslashplain.com/wp-admin/admin-ajax.php","nonce":"311c7875d2","display_exif":"1","display_comments":"1","single_image_gallery":"1","single_image_gallery_media_file":"","background_color":"black","comment":"Comment","post_comment":"Post Comment","write_comment":"Write a Comment...","loading_comments":"Loading Comments...","image_label":"Open image in full-screen.","download_original":"View full size \u003Cspan class=\"photo-size\"\u003E{0}\u003Cspan class=\"photo-size-times\"\u003E\u00d7\u003C/span\u003E{1}\u003C/span\u003E","no_comment_text":"Please be sure to submit some text with your comment.","no_comment_email":"Please provide an email address to comment.","no_comment_author":"Please provide your name to comment.","comment_post_error":"Sorry, but there was an error posting your comment. Please try again later.","comment_approved":"Your comment was approved.","comment_unapproved":"Your comment is in moderation.","camera":"Camera","aperture":"Aperture","shutter_speed":"Shutter Speed","focal_length":"Focal Length","copyright":"Copyright","comment_registration":"0","require_name_email":"1","login_url":"https://textslashplain.com/wp-login.php?redirect_to=https%3A%2F%2Ftextslashplain.com%2F2026%2F09%2F11%2Fexperimentation-just-try-it%2F","blog_id":"1","meta_data":["camera","aperture","shutter_speed","focal_length","copyright"]}; 1575//# sourceURL=jetpack-carousel-js-extra 1576</script>
vendor: 1 bytes, line 1576
1576
1577<script type='text/javascript' src='https://textslashplain.com/_static/??wp-content/plugins/coblocks/dist/js/coblocks-animation.js,wp-content/plugins/jetpack/_inc/build/carousel/jetpack-carousel.min.js?m=1785801844'></script>
vendor: 1 bytes, line 1577
1577
1578<script data-wp-strategy="defer" defer id="tiled-gallery-js" src="https://textslashplain.com/wp-content/plugins/jetpack/_inc/build/tiled-gallery/tiled-gallery/tiled-gallery.min.js?ver=16.3-a.3"></script>
vendor: 1 bytes, line 1578
1578
1579<script id="jetpack-stats-js-before"> 1580_stq = window._stq || []; 1581_stq.push([ "view", {"v":"ext","blog":"88727790","post":"0","tz":"-5","srv":"textslashplain.com","arch_home":"1","hp":"atomic","ac":"2","amp":"0","j":"1:16.3-a.3"} ]); 1582_stq.push([ "clickTrackerInit", "88727790", "0" ]); 1583//# sourceURL=jetpack-stats-js-before 1584</script>
vendor: 1 bytes, line 1584
1584
1585<script data-wp-strategy="defer" defer fetchpriority="low" id="jetpack-stats-js" src="https://stats.wp.com/e-202639.js"></script>
vendor: 1 bytes, line 1585
1585
1586<script id="wp-emoji-settings" type="application/json"> 1587{"baseUrl":"https://s.w.org/images/core/emoji/17.0.2/72x72/","ext":".png","svgUrl":"https://s.w.org/images/core/emoji/17.0.2/svg/","svgExt":".svg","source":{"concatemoji":"https://textslashplain.com/wp-includes/js/wp-emoji-release.min.js?ver=7.1.2"}} 1588</script>
vendor: 1 bytes, line 1588
1588
1589<script type="module"> 1590/*! This file is auto-generated */ 1591var e="script#wp-emoji-settings",t=document.querySelector(e);if(!(t instanceof HTMLScriptElement))throw new Error("Element missing: "+e);const r=JSON.parse(t.text),s=(window._wpemojiSettings=r,"wpEmojiSettingsSupports"),o=["flag","emoji"];function i(e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessionStorage.setItem(s,JSON.stringify(t))}catch(e){}}function c(e,t,n){e.clearRect(0,0,e.canvas.width,e.canvas.height),e.fillText(t,0,0);t=new Uint32Array(e.getImageData(0,0,e.canvas.width,e.canvas.height).data);e.clearRect(0,0,e.canvas.width,e.canvas.height),e.fillText(n,0,0);const r=new Uint32Array(e.getImageData(0,0,e.canvas.width,e.canvas.height).data);return t.every((e,t)=>e===r[t])}function p(e,t){e.clearRect(0,0,e.canvas.width,e.canvas.height),e.fillText(t,0,0);var n=e.getImageData(16,16,1,1);for(let e=0;e<n.data.length;e++)if(0!==n.data[e])return!1;return!0}function u(e,t,n,r){switch(t){case"flag":return n(e,"\ud83c\udff3\ufe0f\u200d\u26a7\ufe0f","\ud83c\udff3\ufe0f\u200b\u26a7\ufe0f")?!1:!n(e,"\ud83c\udde8\ud83c\uddf6","\ud83c\udde8\u200b\ud83c\uddf6")&&!n(e,"\ud83c\udff4\udb40\udc67\udb40\udc62\udb40\udc65\udb40\udc6e\udb40\udc67\udb40\udc7f","\ud83c\udff4\u200b\udb40\udc67\u200b\udb40\udc62\u200b\udb40\udc65\u200b\udb40\udc6e\u200b\udb40\udc67\u200b\udb40\udc7f");case"emoji":return!r(e,"\ud83e\u1fac8")}return!1}function f(e,t,n,r){let a;const s=(a="undefined"!=typeof WorkerGlobalScope&&self instanceof WorkerGlobalScope?new OffscreenCanvas(300,150):document.createElement("canvas")).getContext("2d",{willReadFrequently:!0}),o=(s.textBaseline="top",s.font="600 32px Arial",{});return e.forEach(e=>{o[e]=t(s,e,n,r)}),o}function a(e){var t=document.createElement("script");t.src=e,t.defer=!0,document.head.appendChild(t)}r.supports={everything:!0,everythingExceptFlag:!0},new Promise(t=>{let n=function(){try{var e=JSON.parse(sessionStorage.getItem(s));if("object"==typeof e&&"number"==typeof e.timestamp&&(new Date).valueOf()<e.timestamp+604800&&"object"==typeof e.supportTests)return e.supportTests}catch(e){}return null}();if(!n){if("undefined"!=typeof Worker&&"undefined"!=typeof OffscreenCanvas&&"undefined"!=typeof URL&&URL.createObjectURL&&"undefined"!=typeof Blob)try{var e="postMessage("+f.toString()+"("+[JSON.stringify(o),u.toString(),c.toString(),p.toString()].join(",")+"));",r=new Blob([e],{type:"text/javascript"});const a=new Worker(URL.createObjectURL(r),{name:"wpTestEmojiSupports"});return void(a.onmessage=e=>{i(n=e.data),a.terminate(),t(n)})}catch(e){}i(n=f(o,u,c,p))}t(n)}).then(e=>{for(const n in e)r.supports[n]=e[n],r.supports.everything=r.supports.everything&&r.supports[n],"flag"!==n&&(r.supports.everythingExceptFlag=r.supports.everythingExceptFlag&&r.supports[n]);var t;r.supports.everythingExceptFlag=r.supports.everythingExceptFlag&&!r.supports.flag,r.supports.everything||((t=r.source||{}).concatemoji?a(t.concatemoji):t.wpemoji&&t.twemoji&&(a(t.twemoji),a(t.wpemoji)))}); 1592//# sourceURL=https://textslashplain.com/wp-includes/js/wp-emoji-loader.min.js 1593</script>
1593 1594 1595</body> 1596</html> 1597<!-- 1598 generated 82 seconds ago 1599 generated in 0.550 seconds 1600 served from batcache in 0.002 seconds 1601 expires in 218 seconds 1602-->
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.