Latest in technology and leadership, , 18 min read
The WebPKI's Unmanaged Software Supply Chain
PKI & CertificatesSecurity PracticeWhy software inherits more WebPKI trust than it needs, without browser protections.
Read the full essay
I’m Ryan Hurst. For more than three decades I have built systems and led organizations focused on helping people and organizations know what to trust online, from cryptography and identity to the infrastructure that connects them.
More essays
Writing on technology, leadership, security, and life.
- Trusted Everywhere, Impact Everywhere
WebPKI certificate concentration, reliance, sovereign trust, historical CA incidents, and the quantum transition.
- The Private Key Was Four
Eight eMudhra CA keys were small enough to guess. eMudhra had cryptographic proof in June 2025 that something was wrong, kept the weak keys in service, and no other layer of WebPKI oversight was positioned to catch it.
- The Amnesia Cycle and Why AI Is Turning Developers Back Into Testers
AI is shifting developers from producing code to judging generated output, reviving the testing skills and independent quality judgment the industry spent decades automating away.
- From Periodic Audit to Continuous Assurance
Periodic audits cannot keep pace with changing systems. Two companion essays examine why assurance evidence fails and how AI may finally make continuous reasoning practical.
- From Chains to Trees
The WebPKI's cryptographic graph and governance hierarchy are different structures. Classical and post-quantum trust both depend on understanding the gap between them.
- The Status Quo Outlived Its Status
Security failures accumulate in the seams between coherent systems. The same ownership gaps explain why institutions preserve a status quo after its assumptions expire.
- Why FIPS 140 Means Running Old Code
FIPS 140 validation can improve key isolation while forcing organizations to run opaque, outdated cryptographic software. Public validation data can turn labels into better security questions.
- The Certification Ends Where the Code Begins
Certification records explain what evaluators examined, not whether the surrounding firmware behaves as assumed. Assurance must connect the paper trail to evidence from the code that shipped.
Long-form
Longer essays and research on security, identity, cryptography, compliance, and AI.
- The Verifier Never Showed Up
Thirty years of digital identity programs, sorted by how they actually failed, and why the half of the system that decides adoption is the half nobody funds.
- Security Design Never Scaled
Two services, one bug, every instrument calling them identical. We scaled security’s answers but never the reasoning behind them, and machine reasoning may finally change that.
- How Audits Work, from Management Assertions to Control Matrices
How attestation audits actually function, using the WebPKI as a worked example, from management assertions and control matrices to evidence and auditor conclusions.
- Containing the Optimizer
A field guide to what containers, VMs, confidential VMs, and enclaves actually protect, and what it costs when each one fails.
- The Assurance Model Was Built for a World That No Longer Exists
How periodic audit came to be, why its epistemic reach is shrinking, and what AI does to the mismatch.
- Why Continuous Assurance Did Not Happen Until Now
The economics of cognition, the limits of GRC software, and what AI actually changes.
- The Post-Quantum WebPKI
How the Internet will decide which public keys to trust once signatures no longer fit on the wire.
- A Deep Dive on the Classical WebPKI
How the Internet decides which public keys to trust.
- FIPS 140-3 Validation, in Practice
What the US and Canadian standard for validating cryptographic modules actually covers, with data from the validation corpus.
- Power Wagon: The Whole Story
The story of the Dodge Power Wagon, from its wartime origins and working life to the modern truck that still carries its name.
Recent talks and interviews
I have been speaking at conferences since the 1990s, including RSA Conference.
Standards
- draft-ietf-acme-device-attestACME Device Attestation Extension
- RFC 5793PB-TNC: A Posture Broker Protocol Compatible with Trusted Network Connect
- RFC 5216The EAP-TLS Authentication Protocol
- RFC 5019The Lightweight OCSP Profile for High-Volume Environments
- PIVPersonal Identity Verification (NIST FIPS 201 and related specifications)
- ISO 32000Portable Document Format (PDF)
- GIDSGeneric Identity Device Specification
These are highlights from a longer record of work across the IETF, the Trusted Computing Group, ISO, and NIST.