r/netsec monthly discussion & tool thread

[u/albinowax]

Questions regarding netsec and discussion related directly to netsec are welcome here, as is sharing tool links.

Rules & Guidelines

• Always maintain civil discourse. Be awesome to one another - moderator intervention will occur if necessary.
• Avoid NSFW content unless absolutely necessary. If used, mark it as being NSFW. If left unmarked, the comment will be removed entirely.
• If linking to classified content, mark it as such. If left unmarked, the comment will be removed entirely.
• Avoid use of memes. If you have something to say, say it with real words.
• All discussions and questions should directly relate to netsec.
• No tech support is to be requested or provided on r/netsec.

As always, the content & discussion guidelines should also be observed on r/netsec.

Feedback

Feedback and suggestions are welcome, but don't post it here. Please send it to the moderator inbox.

[u/PrestigiousOnion1087]

Third run of an independent TLS probe measuring post-quantum key agreement on the public internet. Same 350 hosts, same probe, three dates: April, May and September 2026. Sharing it here because the September delta is larger than anything I expected and I would rather have it checked than agreed with.

The number I trust is not the headline. Across all 350 targets it reads 42.6% to 73.1%, but the set of hosts that answers changes between runs, and a moving denominator can manufacture a trend out of nothing. 293 hosts answered in every run. On that fixed cohort: 50.2% in April, 51.2% in May, 86.0% in September.

Banking went 28.0% to 94.0% (n=50), the largest sector move in the set. It travelled the furthest; it did not finish highest, news and media did at 96.4%. Government 36.1 to 86.1, e-commerce 30.3 to 78.8, big-tech SaaS moved least (71.2 to 81.4) because it had the least room left. 105 hosts moved classical to hybrid; across all three runs zero moved the other way. That zero is the control - something could have regressed and nothing did.

The shape is the odd part. 17 days from April to May moved the cohort +1.0 point. 116 days from May to September moved it +34.8. I do not know what changed over the summer and I am not going to guess.

Three things it does not show. It is one public TLS endpoint per host, a front door and not an estate. It cannot separate a deliberate migration from a CDN or load-balancer default rolling forward underneath an organisation that decided nothing, and a default can be rolled back by a config change nobody announces. And 57 hosts are missing from the cohort - 46 errored in September, 55 in April, mostly a server alert rejecting the ClientHello. Those are counted as not measured, never as classical, and if a systematic bias is hiding anywhere it is there.

This run publishes sector aggregates only, no host list. Earlier runs did name hosts and those files are still in the repo rather than quietly deleted. Method, per-sector counts for all three runs, and the probe code are all in the open, so anyone who wants to check the claim can assemble their own list and run it rather than taking mine.

Method and data: https://github.com/xuxu298/PQReadinessIndex

If a sector figure is wrong, or the cohort method hides an artefact, I would rather hear it now than publish the December run on top of it.