History of the Internet

CVE Named 321 Security Problems. The Fixes Were Somewhere Else.

When CVE launched in September 1999, its first public list held 321 entries. It did not ship 321 patches. It gave scanners, advisories and software vendors a way to stop arguing over whether their different labels referred to the same flaw. That narrow ambition was the infrastructure: a common name before a common response.

Toys“R”Us Stocked Amazon’s Toy Aisle. Amazon Held the Door.

In 2000, Toys“R”Us brought the toys and Amazon built the online store. Four years later, the retailer said the exclusive aisle it had paid for was filling with other sellers’ products. The dispute exposed a hard question for anyone renting a platform: what is exclusivity worth when somebody else operates the entrance?

Four Browsers Ran WebAssembly Before W3C Published Its First Draft

By November 2017, Chrome, Edge, Firefox and Safari could run WebAssembly. W3C's first public Working Draft of the Core specification came three months later; its Recommendation took until December 2019. The browsers did not wait for the stamp. Their implementers had already agreed on a binary format and JavaScript interface they could ship.

SQLite Gave Away the Code and Took Away the Backend Menu

On 20 September 2001, SQLite made its code public domain and removed the abstraction that let its database engine use different storage drivers. The same release opened one door to everyone and shut several doors inside the machine. The record is a useful antidote to the idea that software freedom and software architecture move in lockstep.

UserLand Handed Harvard the RSS 2.0 Rulebook. The Feeds Kept Running.

In July 2003, a software company gave a university center the document that described RSS 2.0. The handover opened the rulebook for reuse and put an independent board beside it. It did not hand anyone the streams already moving between publishers and readers. That small difference between owning a specification and operating a format was the whole fight.

OpenStreetMap Cut the Map in July. The New Licence Arrived in September.

In July 2012, a bot removed incompatible contributions from the map people were already using. The Open Database Licence was still weeks away. OpenStreetMap had to turn a legal decision into a working dataset before its foundation could stamp the new terms on the file.

OpenID Let You Change the Login Company. Your URL Had to Stay Put.

In 2007, OpenID promised a person could keep an online identifier while changing the company that checked the password. The trick was to make the identifier a URL the person controlled, then put directions to the current authentication provider at that URL. The bargain shifted work to the sites accepting the login: they had to read those directions, verify the provider, and remember the right name.

OpenTable Made Booking Free. Restaurants Paid for the Desk and the Diner.

The reservation button looked weightless to the person planning dinner. Behind it stood a computer at the restaurant host stand, an installation visit, a monthly subscription and a charge when the guest actually sat down. In a 2009 SEC response, OpenTable gave one restaurant's bill a second twist: the per-diner price was four times higher when the customer came through OpenTable's website than through the restaurant's own site.

eBay Owned the Auction and Billpoint. Sellers Kept Listing PayPal.

In 2001, eBay owned the marketplace and its own payment service. PayPal owned neither. Yet PayPal's sampling found its name on far more auction listings than Billpoint's. The marketplace eventually bought the outside payment network and prepared to retire the one it had built. The route from listing to payment had become a contest the site owner could not settle by owning the page alone.

Server Set the Cookie. Then It Refused the Request Carrying It.

The Server Set the Cookie. Then It Refused the Request Carrying It.

A website can fill a browser with small pieces of state and receive them back as one oversized request. HTTP acquired a name for the collision in 2012: 431 Request Header Fields Too Large. The code can identify the jam. It cannot decide which memory to throw away, and the machine that issued the memories may be waiting behind the blocked door.

Amazon Licensed a Shortcut. The Patent Later Redrew the Shopping Cart Line.

One-Click looked like a small button on a web page. Amazon's 1999 patent described a larger machine: a remembered customer identifier, stored payment and shipping details, and a server that could turn one action into an order. Apple licensed that route in 2000. A decade later, the U.S. patent office rewrote how the claim placed the shortcut beside a shopping cart.

DoubleClick Put Your Refusal in a Cookie. Blocking Cookies Could Erase It.

DoubleClick offered an opt-out cookie to remember that a browser did not want its tracking. A browser setting meant to reject cookies could remove that very marker. In January 2001, the Federal Trade Commission made the company promise to explain the trap: if a user later accepted cookies again, the opt-out had to be repeated. The privacy choice depended on the machinery people were trying to shut off.

Yahoo Counted 4,150 Internet Events. It Left the Cost Column Blank.

Yahoo bought broadcast.com in 1999 to put streaming audio and video across its portal and sell live events to corporate customers. By 2000 it counted about 4,150 broadcasts and $105.7 million in a wider business-services revenue line. It did not allocate that segment’s costs. The tally showed a growing operation; the filing left the profit question at the door.

Netflix Sold Unlimited DVDs. The Return Envelope Set the Speed Limit.

The web page could remember every film you wanted. The post office could carry only the disc you sent back and the next one Netflix mailed out. In the company's early DVD subscription, that gap between an unlimited promise and a finite postal loop shaped both the customer's wait and the company's costs.

MP3.com Asked for Your CD. The Court Asked Who Copied It.

For a moment in 2000, the path to an online music locker began with a remarkably physical act: put the CD in your computer. MP3.com checked that the disc was yours, then let you listen from its own service. The check took seconds. The question of who had permission to make and serve the copy took the company into court and back to the record labels and publishers.

One DNS Address, Many Machines. A Bad Answer Could Name Its Server.

A DNS reply can arrive from an address shared by dozens of servers. When one reply is wrong, asking again may reach another machine and produce a clean answer. RFC 5001 gave the troublesome reply a way to carry an identifier for the server that sent it. The marker travels with the evidence; its contents and disclosure remain the operator’s choice.

Mail Client Guessed at “Sent.” RFC 6154 Made the Server Answer.

The Mail Client Guessed at “Sent.” RFC 6154 Made the Server Answer.

A mail client opening a new account needs to know where to save drafts, sent copies and discarded messages. For years it often had to guess from folder names or ask the user. A folder named “Sent” might be called something else; a server could file sent copies itself or wait for the client. RFC 6154 made the mailbox's intended role visible in an IMAP LIST response. The name on the drawer stopped being the only clue. The mark on it still did not tell the client who would put the letters inside.

Excite@Home Went Bankrupt. The Cable Stayed; Operators Rebuilt the Service.

The neighborhood cable line could still reach the house. The company supplying much of the Internet service behind it was failing. In 2001–02, AT&T, Cox and Comcast faced different deadlines to take back the work Excite@Home had done for them, and the transition appeared on their balance sheets.

Priceline Let You Name the Fare Before Showing the Flight. Then It Showed the Flight.

In Priceline's first airline product, the traveller committed to a price before learning the carrier or departure time. Five years later the company offered the itinerary and published fare up front. Its filings show why the famous trick lost some of its pull.

File Had a Fingerprint. The Internet Still Needed an Address.

The File Had a Fingerprint. The Internet Still Needed an Address.

A web address names a place to ask. A hash names the bytes you expect back. RFC 6920 tried to make that distinction usable across protocols in 2013: put the digest and algorithm into a standard name, then let a server address help deliver the object without deciding its identity. The bargain was sharp. A client could reject the wrong bytes even when they came from the advertised host. It still needed someone to keep the right bytes available.