Routing Security Hits 70%, Leap Seconds Expire, and the Self-Hosting Revival

Seventy percent of internet routes are now protected by Resource Public Key Infrastructure — a cryptographic framework that lets routers verify whether a network operator actually owns the IP address space it is announcing over the Border Gateway Protocol. BGP was designed in the late 1980s for a smaller, more trusting internet and has almost no built-in verification; its exploitation has enabled spam campaigns, cryptocurrency theft, and reportedly nation-state surveillance. The 70 percent figure represents a coordination milestone as much as a technical one: every ISP and network operator must opt in independently, and the math of adoption only starts to favor holdouts once enough peers have committed. The remaining 30 percent is a mix of legacy operators, regions with less regulatory pressure to modernize, and a small number with legitimate technical reasons such as research networks with unusual routing policies. Getting from 70 to 90 percent, observers note, will likely be harder than the climb from zero.

The International Bureau of Weights and Measures (BIPM) voted this year to stop adding leap seconds to UTC, a decision building since at least 2022 and formalized at the 2026 CGPM meeting. Leap seconds — added periodically since 1972 to keep atomic clock time aligned with Earth's irregular rotation — create a moment where 23:59:60 must exist, an edge case that has caused database corruption, financial transaction mismatches, and distributed system clock divergence. Allowing UTC to drift from solar time means that in several centuries, atomic noon and solar noon will differ noticeably; distributed systems engineers will no longer lose time to a problem they have managed for fifty years.

A personal essay cataloging one user's self-hosted infrastructure — email, media, notes, file sync, password management, monitoring — drew more than 500 points, with comment threads pointing to a broader cultural pattern. Every time a major SaaS provider introduces a paywall, discontinues a product, or revises its terms, it pushes more technical users toward running their own systems. Tools like Immich, Nextcloud, and Jellyfin have matured well past the compile-it-yourself era. A separate forensics story reinforced the point: a Sonarr user discovered that bad actors on certain torrent sites were systematically publishing corrupt or mislabeled releases targeting Sonarr's autodownload logic, and traced the pattern across multiple indexers to identify specific shows being targeted — suggesting either a rights enforcement operation or a competitive actor. The analysis, commenters noted, demonstrates the adversarial-thinking skills that running your own infrastructure develops in ways centralized services never require.