Share

Infrastructure Inflections

The Authentication System That Doesn't Call Home

By Rina Takahashi— February 11, 2026

Feature image for article: The Authentication System That Doesn't Call Home

India processes 2.5 billion authentication transactions monthly through a system that verifies identity locally. When a bank confirms who you are using Aadhaar, verification happens on their own systems—a digitally signed XML file, validated against a public key, entirely within the service provider's infrastructure.

Infrastructure Inflections

The Authentication System That Doesn't Call Home

By Rina Takahashi— February 11, 2026

India processes 2.5 billion authentication transactions monthly through a system that verifies identity locally. When a bank confirms who you are using Aadhaar, verification happens on their own systems—a digitally signed XML file, validated against a public key, entirely within the service provider's infrastructure.

One Echo This Week

When HTTP/2 Server Push Vanished Without Replacement

HTTP/2 Server Push arrived in 2015 with a straightforward promise: servers could send resources before browsers asked for them. The specification included the feature. Browsers implemented it. Then servers hit a wall. They couldn't determine what clients already had cached, which meant pushing resources that browsers didn't need. Bandwidth waste followed. Performance regressions appeared.

Chrome and Firefox removed Server Push in October 2024. Sites that had made it work measured real losses. One documented a 10% increase in time to first contentful paint. The intended replacement, 103 Early Hints, sits at 2.9% adoption. Organizations now inline critical resources again, sacrificing cache benefits to maintain performance. The old HTTP/1.x workarounds are back.

One Echo This Week

When HTTP/2 Server Push Vanished Without Replacement

HTTP/2 Server Push arrived in 2015 with a straightforward promise: servers could send resources before browsers asked for them. The specification included the feature. Browsers implemented it. Then servers hit a wall. They couldn't determine what clients already had cached, which meant pushing resources that browsers didn't need. Bandwidth waste followed. Performance regressions appeared.

Chrome and Firefox removed Server Push in October 2024. Sites that had made it work measured real losses. One documented a 10% increase in time to first contentful paint. The intended replacement, 103 Early Hints, sits at 2.9% adoption. Organizations now inline critical resources again, sacrificing cache benefits to maintain performance. The old HTTP/1.x workarounds are back.

TAKE NOTE

Adoption reality: Only 1.25% of HTTP/2 sites used Server Push before removal, with Chrome measuring just 0.05% of sessions actually leveraging it.

Infrastructure gap: Cache-Digest for HTTP/2 never materialized, leaving servers blind to what browsers already had cached before pushing resources.

Server response: NGINX removed Server Push in version 1.25.1 (2023), citing negligible adoption, then added Early Hints support in 1.29.0 mainline.

CDN timeline: Cloudflare offered Early Hints free since 2022, Akamai made it generally available July 2024, but implementation complexity limits broader uptake.

Transition cost: Aggressive removal created a period where the old optimization disappeared before its replacement achieved meaningful ecosystem support.

Patterns Repeating Right Now

Watch infrastructure long enough and you start seeing the same movie play out with different actors. The cloud migration that looked inevitable five years ago is reversing in thousands of production environments. SaaS tools that proliferated during the growth years are consolidating under economic pressure. Automation that promised to eliminate work is creating new categories of complexity.

These aren't isolated events. They're patterns—the same rhythms infrastructure follows whenever it goes through phase changes. What looks like chaos in the moment becomes recognizable once you've seen it happen before. The technology changes. The underlying dynamics don't.

Here's where those patterns are visible in production systems right now.

Patterns Repeating Right Now

Watch infrastructure long enough and you start seeing the same movie play out with different actors. The cloud migration that looked inevitable five years ago is reversing in thousands of production environments. SaaS tools that proliferated during the growth years are consolidating under economic pressure. Automation that promised to eliminate work is creating new categories of complexity.

These aren't isolated events. They're patterns—the same rhythms infrastructure follows whenever it goes through phase changes. What looks like chaos in the moment becomes recognizable once you've seen it happen before. The technology changes. The underlying dynamics don't.

Here's where those patterns are visible in production systems right now.

Cost Reversal

Cloud Bills Force Strategic Repatriation

Eighty-six percent of organizations are pulling workloads back from public cloud. The economics that worked at prototype scale break at production volume. Hybrid infrastructure isn't compromise—it's companies learning what actually costs less to run.

Sprawl Collapse

SaaS Proliferation Hits Economic Limit

Companies average 106 SaaS applications with $21M in annual waste. Over 2,600 M&A deals in 2025 signal the turn. Point solutions that multiplied during growth now consolidate under platform pressure. The pattern always ends here.

Complexity Shift

Automation Creates Different Work, Not Less

AI handles routine tasks, then workers become system stewards managing edge cases. Manufacturing firms adopting AI see productivity decline. The work doesn't disappear. It transforms into something harder—oversight of systems that fail in unexpected ways.

Abstraction Layers

Kubernetes Spawns Services to Hide Itself

Developers spend seventy percent of time on infrastructure. Eighty-eight percent of teams report higher costs. AWS EKS and managed services emerge to abstract the complexity Kubernetes created. Every infrastructure layer eventually generates its own abstraction market.

Demand Shock

AI Inference Shatters Power Planning

After twenty years of flat electricity demand, data centers will consume twelve percent of US power by 2030. AI workloads break assumptions built over decades. Infrastructure designed for predictable growth hits a wall when workload patterns fundamentally change.

Portfolio Strategy

Binary Decisions Give Way to Workload Selection

Only eight percent of organizations fully exit cloud. The rest manage hybrid portfolios, moving some workloads while expanding others. Infrastructure choices become optimization problems, not religious commitments. The all-or-nothing phase always gives way to selective strategy.

Papers That Built Infrastructure

REST Dissertation Defined Modern API Architecture

Roy Fielding's 2000 doctoral dissertation introduced REST for distributed hypermedia systems. Built for web-scale document linking, not APIs, it became the foundation for modern web service communication. Most implementations claiming REST principles actually diverge from Fielding's original architectural constraints.

Where's the disconnect?

Fielding designed REST for hypermedia, yet "RESTful" became shorthand for any HTTP-based API design.

Why does misinterpretation persist?

Builders navigate inconsistent patterns daily because most modern APIs ignore Fielding's actual constraints.

SOAP Standardization Created Enterprise Web Services Complexity

W3C standardized SOAP between 2000-2003 as XML-based protocol for web services. Rigid standards, verbose messages, and WS-* extensibility dominated early 2000s API design. Developer frustration with SOAP's complexity triggered mass migration to REST, fundamentally reshaping web architecture patterns.

How did complexity burn developers?

SOAP made "simple" the defining criterion for every next-generation API design approach.

Where does it survive?

Enterprise systems still choose SOAP for formal contracts, creating integration friction with modern architectures.

HTTP/2 Solved Application-Level Performance While Creating New Problems

Published as RFC 7540 in May 2015, HTTP/2 introduced binary framing, multiplexing, and header compression to address HTTP/1.1's performance limitations. Eliminated application-level head-of-line blocking but created packet-level blocking at TCP layer, now driving HTTP/3 development.

What's the TCP tradeoff?

Single connection eliminates overhead, but one lost packet blocks all multiplexed streams simultaneously.

How did encryption become mandatory?

Major browsers only support HTTP/2 over TLS despite the standard allowing unencrypted connections.

Certificate Transparency Made TLS Certificate Issuance Public

Published as RFC 6962 in June 2013 after DigiNotar's 2011 compromise, Certificate Transparency created append-only public logs for all TLS certificates. Google engineers designed cryptographic proof systems to detect mis-issued certificates, fundamentally changing how certificate authority trust operates.

How did it become mandatory?

Chrome requires Certificate Transparency since April 2018, making it essential for public web infrastructure.

What's driving evolution?

Original design faces scaling challenges at 7-10 terabytes per log, pushing migration to tile-based architecture.

Papers That Built Infrastructure

REST Dissertation Defined Modern API Architecture

Roy Fielding's 2000 doctoral dissertation introduced REST for distributed hypermedia systems. Built for web-scale document linking, not APIs, it became the foundation for modern web service communication. Most implementations claiming REST principles actually diverge from Fielding's original architectural constraints.

Where's the disconnect?

Fielding designed REST for hypermedia, yet "RESTful" became shorthand for any HTTP-based API design.

Why does misinterpretation persist?

Builders navigate inconsistent patterns daily because most modern APIs ignore Fielding's actual constraints.

Papers That Built Infrastructure

SOAP Standardization Created Enterprise Web Services Complexity

W3C standardized SOAP between 2000-2003 as XML-based protocol for web services. Rigid standards, verbose messages, and WS-* extensibility dominated early 2000s API design. Developer frustration with SOAP's complexity triggered mass migration to REST, fundamentally reshaping web architecture patterns.

How did complexity burn developers?

SOAP made "simple" the defining criterion for every next-generation API design approach.

Where does it survive?

Enterprise systems still choose SOAP for formal contracts, creating integration friction with modern architectures.

Papers That Built Infrastructure

HTTP/2 Solved Application-Level Performance While Creating New Problems

Published as RFC 7540 in May 2015, HTTP/2 introduced binary framing, multiplexing, and header compression to address HTTP/1.1's performance limitations. Eliminated application-level head-of-line blocking but created packet-level blocking at TCP layer, now driving HTTP/3 development.

What's the TCP tradeoff?

Single connection eliminates overhead, but one lost packet blocks all multiplexed streams simultaneously.

How did encryption become mandatory?

Major browsers only support HTTP/2 over TLS despite the standard allowing unencrypted connections.

Papers That Built Infrastructure

Certificate Transparency Made TLS Certificate Issuance Public

Published as RFC 6962 in June 2013 after DigiNotar's 2011 compromise, Certificate Transparency created append-only public logs for all TLS certificates. Google engineers designed cryptographic proof systems to detect mis-issued certificates, fundamentally changing how certificate authority trust operates.

How did it become mandatory?

Chrome requires Certificate Transparency since April 2018, making it essential for public web infrastructure.

What's driving evolution?

Original design faces scaling challenges at 7-10 terabytes per log, pushing migration to tile-based architecture.

Today's Debates Yesterday's Decisions