Learn

Network and security concepts, explained clearly.

Practical explanations of the concepts behind the tools. Each article is written to build genuine understanding, not just to define a term.

The article index ↓

The vendor-neutral library, grouped by subject. Vendor-specific writing lives on the hubs.

293 articles

Vendor hubs →

One door per vendor: the tools, the articles, and the certifications that belong to each platform.

8 vendors

The Practice →

How the work is actually done, rather than how the technology works. Triage, escalation, evidence, handover, and the parts no runbook covers.

64 published

The Roles →

The positions this industry is made of, grouped by the path a product takes. Who makes it, moves it, sells it, deploys it, runs it, supports it, defends it and teaches it.

39 positions

Certification study guides →

Exam blueprints mapped objective by objective to the articles that teach them.

105 exam guides

Glossary →

The field's terms, acronyms, expressions, jargon, and lore - defined, sourced, and linked to the tools that compute them.

1242 terms

Study guides →

Curated reading paths and blueprint-mapped certification guides - every objective tied to the articles that teach it and the tools that exercise it.

13 reading paths105 exam guides1632 objectives mapped

Jump to

View

Certificates & PKI (14)

Article	Topic	Summary
Anatomy of an X.509 Certificate	Certificates & PKI	What lives inside a TLS certificate, how the ASN.1/DER bytes are structured, what the v3 extensions actually control, and why decoding a certificate is not the same as trusting it.
PEM, DER, and the certificate file formats	Certificates & PKI	Why the same certificate comes in so many file shapes, what PEM and DER actually are, and what .crt, .pem, .pfx, and .p12 really hold.
Certificate signing requests and how certificates are issued	Certificates & PKI	What a CSR contains, why your private key never leaves your machine, how a CA validates and issues, and how ACME automates the whole exchange.
How certificate validation actually works	Certificates & PKI	The steps a client runs to decide a certificate is trustworthy: building the chain, checking signatures and dates, matching the name, and enforcing constraints.
Certificate revocation: CRL, OCSP, and short-lived certificates	Certificates & PKI	Why a certificate sometimes needs to be cancelled before it expires, why the classic revocation systems work poorly, and why the industry is shrinking certificate lifetimes instead.
Authority Information Access: The OCSP and CA Issuers URLs	Certificates & PKI	The AIA extension carries two kinds of pointer: where to ask whether a certificate is revoked (OCSP) and where to fetch the issuer's own certificate (CA Issuers). What each is for, why they are easy to confuse, and what the inspector shows.
OCSP Must-Staple: Closing the Soft-Fail Gap	Certificates & PKI	Real-time OCSP checking has a fatal weakness: when the responder is unreachable, clients usually proceed anyway. OCSP stapling and the Must-Staple flag are the fix. What the TLS Feature extension declares, and the operational risk it carries.
ACME: how certificates issue and renew themselves	Certificates & PKI	How the ACME protocol automates certificate issuance end to end: the account, the order, the three challenge types, the dns-01 record you publish, and the finalize-and-download step that produces the certificate.
The 47-day era: how TLS certificate lifetimes are shrinking	Certificates & PKI	The CA/Browser Forum's SC-081v3 schedule takes maximum public TLS validity from 398 days down to 47 by 2029, in three steps. What the phases are, why 47, and what it does to renewal volume.
Certificate validity windows: notBefore, notAfter, and renewal lead time	Certificates & PKI	How a certificate's lifetime is defined by two timestamps, how that length is measured against the cap, why validity is not the same as time remaining, and how to choose a renewal lead time.
Let's Encrypt: the free CA and its rate limits	Certificates & PKI	What Let's Encrypt is, why its certificates are short-lived, and how its rate limits actually work: the per-registered-domain and per-account limits, the exact-set and authorization-failure limits, and why ARI renewals are exempt from all of them.
DCV and SII reuse: the validation cadence behind the renewal cadence	Certificates & PKI	Issuing a certificate means proving domain control and, for OV/EV, organization identity. SC-081v3 shrinks how long those proofs can be reused — DCV to 10 days by 2029 — which reshapes renewal as much as validity does.
Renewing before expiry: lead time, ACME, and ARI	Certificates & PKI	Why late renewal causes outages, how ACME automates issuance and renewal, how the ARI extension lets a CA steer the renewal window, and how to pick a lead time that leaves room to retry.
Public vs private PKI: which certificates SC-081v3 governs	Certificates & PKI	The 47-day schedule binds publicly trusted TLS certificates only. What separates public from private PKI, why internal CAs are exempt, and how to read the planner's compliance verdict for an internal certificate.

Encoding & data (42)

Article	Topic	Summary
Bytes, code points, and UTF-8	Encoding & data	The difference between a character and a byte, why Unicode and UTF-8 exist, and what that has to do with Base64.
JSON vs YAML: What Converts Cleanly and What Does Not	Encoding & data	YAML was designed so that every JSON document is also valid YAML, which is why conversion between them usually just works. The interesting part is the edges: comments, anchors, multiple documents, and YAML-only types that have no JSON equivalent.
The Anatomy of a URL	Encoding & dataWeb & HTTP	Every URL is built from the same handful of parts defined by RFC 3986: scheme, authority (userinfo, host, port), path, query, and fragment. What each part means, how a parser tells them apart, and where the boundaries actually fall.
The JSON Grammar: Six Types and a Few Strict Rules	Encoding & data	JSON is smaller than it looks. The whole format is six value types and a handful of structural characters, governed by rules that are stricter than most people remember: no comments, no trailing commas, and keys that must be quoted strings.
What Unix Time Actually Is	Encoding & data	Unix time is a single integer: the number of seconds since 1970-01-01T00:00:00Z, the epoch. It is time-zone independent, compact, and sortable, which is why it underpins almost every system clock, log line, and API timestamp. Converting it to a calendar date is pure arithmetic.
Base64 and Base64URL, explained	Encoding & data	How binary data becomes safe-to-transmit text, why padding exists, and what changes in the URL-safe variant.
JSON Numbers and the Precision Trap	Encoding & data	JSON puts no limit on the size or precision of a number, but most parsers quietly convert every number to a 64-bit float. That mismatch silently corrupts large integers and exact decimals, which is why a formatter should preserve the original digits.
Query Strings: Parameters, Plus Signs, and Repeated Keys	Encoding & dataWeb & HTTP	The part of a URL after the question mark looks simple but hides real ambiguity: how parameters are separated, why a plus sign sometimes means a space, how repeated keys behave, and why there is no single governing standard.
Seconds, Milliseconds, Microseconds, Nanoseconds: Telling Epoch Units Apart	Encoding & data	The same instant can be written as 1700000000, 1700000000000, or larger, depending on whether the timestamp counts seconds, milliseconds, microseconds, or nanoseconds. Mixing them up is a classic bug. You can almost always tell which is which from the number's magnitude.
YAML Type Coercion and the Norway Problem	Encoding & data	YAML guesses the type of every unquoted scalar, and its guesses are surprising: the country code NO becomes false, a version like 1.0 becomes a number, and a zero-padded code loses its zeros. Knowing the rule is the key to safe conversion.
Base64URL and the URL-safe alphabet	Encoding & data	Why JWTs and PKCE use a different Base64 alphabet, the two characters that change, and what happens to the padding.
Duplicate Keys in JSON: Legal, Dangerous, and Worth Catching	Encoding & data	JSON syntax allows the same key to appear more than once in an object, but the specification does not say what that means. Different parsers resolve it differently, which makes duplicate keys a quiet source of bugs and even security issues.
JSON and YAML in Practice: APIs, Declarations, and Orchestration	Encoding & data	The split is not random: APIs and machine-to-machine declarations tend to be JSON, while human-authored orchestration and pipeline files tend to be YAML. Understanding why each domain chose what it did explains when converting between them is useful.
The Year 2038 Problem	Encoding & data	A signed 32-bit integer can count seconds only up to 2147483647, which falls on 2038-01-19T03:14:07Z. One second later it overflows and wraps to a negative number, throwing affected systems back to 1901. It is Y2K's quieter successor, and the fix is a wider integer.
URL Encoding and Internationalized Hosts	Encoding & dataWeb & HTTP	URLs are restricted to a small set of ASCII characters, so everything else is encoded. Percent-encoding handles paths and queries; punycode handles non-ASCII host names. How both work, and why internationalized hosts are a phishing concern.
ISO 8601, RFC 3339, and the HTTP Date	Encoding & data	Once a Unix timestamp is turned back into a human date, it gets written in one of a few standard text formats. ISO 8601 is the broad standard, RFC 3339 is its strict internet profile, and the HTTP date is the odd one out. Knowing the difference saves a lot of parsing grief.
JSON String Escapes and Unicode	Encoding & data	Inside a JSON string, a few characters must be written as escapes, and any character at all can be written as \uXXXX. The rules are small but strict, and the one that catches people is how characters beyond the basic plane, like emoji, need a surrogate pair.
Where Base64 shows up: data URIs, MIME, PEM, and Basic auth	Encoding & data	The real places binary gets wrapped in text, the size cost of doing it, and why Base64 in an auth header is not encryption.
YAML Anchors, Aliases, and Merge Keys	Encoding & data	YAML can define a value once and reuse it with an anchor and alias, and merge one mapping into another with a merge key. None of this exists in JSON, so converting expands and duplicates it. This covers the syntax, what happens on conversion, and the denial-of-service trap they enable.
Base32, explained	Encoding & dataIdentity & tokens	Why Base32 trades size for a case-insensitive, unambiguous alphabet, how its 5-bit grouping works, and where it shows up (TOTP secrets, onion addresses, DNS).
Trailing Commas, Comments, and the JSON5 Family	Encoding & data	Strict JSON has no comments and no trailing commas, which surprises people whose editor accepts both. The reason is that JSON is a minimal interchange format, and the tolerant variants (JSONC, JSON5) are separate things. Knowing which is which avoids config files that break in another tool.
Why Unix Time Ignores Leap Seconds	Encoding & data	UTC occasionally inserts a leap second to stay aligned with the Earth's rotation, but Unix time pretends every day is exactly 86,400 seconds long. That deliberate simplification means a Unix timestamp is not a true count of elapsed seconds since the epoch — and it is the right trade-off for civil time.
YAML Block Scalars and Multiline Strings	Encoding & data	YAML has two ways to write a multiline string, and they treat newlines differently: literal style keeps them, folded style turns them into spaces. Chomping indicators then decide what happens to the trailing newline. Getting these wrong is why an embedded script or certificate comes out subtly mangled.
Formatting, Minifying, and Canonical JSON	Encoding & data	Whitespace does not change what JSON means, so pretty-printed and minified JSON are the same data. But when JSON is signed or hashed, the exact bytes matter, and that is where canonical JSON comes in: a deterministic way to serialize the same data to exactly the same string every time.
Hexadecimal encoding (Base16), explained	Encoding & data	How hex represents each byte as two characters, why it is the default way to print raw bytes, and how it compares to Base64 and Base32.
Relative URLs and How They Resolve	Encoding & dataWeb & HTTP	A relative URL leaves out the scheme and host and is completed against a base URL. The rules for how a browser fills in the rest, and how ./ and ../ and a leading slash change the result, explain a lot of broken links and a few security surprises.
Roman Numerals: How the System Actually Works	Encoding & data	Seven symbols, no zero, and one subtraction rule that arrived a thousand years after Rome. Why IIII is on your watch and IV is in your textbook, what IL breaks, and why the classical system runs out of road at 3999.
Deceptive URLs: Reading Past the Tricks	Encoding & dataWeb & HTTP	URLs are a favorite tool for phishing because the real destination is easy to disguise. The userinfo trick, redirect parameters, and look-alike characters all make a hostile link look friendly. This shows the common disguises and the one reliable habit for finding the real host.
Percent-encoding (URL encoding), explained	Encoding & data	Why URLs escape certain characters as %XX, which characters are safe to leave alone, and how percent-encoding differs from Base64.
Time Arithmetic and Time Zones: Exact Durations, Honest Meetings	Encoding & data	Why 'plus one month' has no exact answer, what ISO 8601 durations actually promise, and how one UTC instant becomes four different wall clocks. The DST trap, the day-shift trap, and the case for planning meetings with a real date.
Base16, Base32, Base64, and percent-encoding compared	Encoding & data	A side-by-side look at the four text encodings: their alphabets, size overhead, readability, and when to reach for each.
How text diff works	Encoding & dataText & utilities	A diff finds the smallest set of insertions and deletions that turns one text into another. Underneath is the longest common subsequence: the lines both versions share, in order, form the unchanged backbone, and everything else is an add or a remove.
Reading a diff	Encoding & dataText & utilities	How to read a line-by-line diff: unchanged, added, and removed lines, the plus and minus markers, both sides' line numbers, inline word highlighting, and what ignore-whitespace and ignore-case actually change. Plus the things a diff cannot tell you.
Word and Character Level Diffs	Encoding & dataText & utilities	A line diff marks a whole line as changed even when a single character moved. Word-level and character-level diffs highlight the exact part of the line that changed, which is far easier to read for prose, long lines, and small edits. This covers the difference and when each is the right lens.
Three-Way Diffs and Merge Conflicts	Encoding & dataText & utilities	A normal diff compares two versions and cannot tell which one changed. A three-way diff adds a common ancestor, which is what makes automatic merging possible and what produces the <<<<<<< ======= >>>>>>> conflict markers. This explains the third input and how to read and resolve a conflict.
Minimal Edits: Why a Diff Can Look Wrong	Encoding & dataText & utilities	A diff shows the smallest set of insertions and deletions that turns one text into the other. Because the smallest set is not unique and the algorithm has to choose, a diff can align lines in ways that look counterintuitive, blaming the wrong block or splitting a moved section. Knowing this makes odd diffs readable.
Reading XML Structure	Encoding & dataSecurity & WAF	XML is a tree of elements built from a handful of parts: an optional declaration, elements with attributes, text, and a few special constructs. Once you can name each part and see how they nest, reading an unfamiliar document top to bottom becomes routine rather than a guessing game.
XML Namespaces Explained	Encoding & dataSecurity & WAF	When two XML vocabularies use the same element name for different things, namespaces keep them apart by binding a prefix to a unique URI. The prefix is just a local shorthand; the URI is the real identity. Understanding that split resolves most namespace confusion.
Well-Formed vs Valid XML	Encoding & dataSecurity & WAF	Well-formedness is XML's baseline: one root, properly nested and matched tags, quoted attributes, and escaped specials. Validity is a stronger, separate claim that a document also follows a schema. A parser rejects ill-formed XML outright, which is why these rules come first.
CDATA, Comments, and Processing Instructions	Encoding & dataSecurity & WAF	Not everything in XML is an element. CDATA sections hold raw text that would otherwise need escaping, comments annotate without affecting content, and processing instructions carry directions for an application. Recognizing these three keeps them from looking like mysterious noise.
HTML Forms and Request Encoding: How the Web Ships Your Input	Encoding & dataWeb & HTTP	A form is a contract between a page and a server: which fields, which verb, which wire format. GET puts the answers in the URL; POST puts them in the body; and enctype picks the body's dialect - urlencoded's key=value chains, multipart's boundary-delimited parts built for files. What each choice means for logs, caches, size limits, and debugging, plus the fetch-era footnote: FormData kept the formats alive after forms stopped being the only sender.
URI, URL, URN: What's Actually the Difference?	Encoding & dataWeb & HTTP	The three acronyms everyone uses interchangeably encode one clean idea: identify vs locate vs name. URI is the umbrella - any identifier in the standard grammar; URL is the identifier that also tells you where and how to fetch; URN was the scheme for pure, location-free names (urn:isbn:...). Why the W3C itself declared the classical trichotomy obsolete, what 'URI' means in specs vs 'URL' in conversation, and the naming lesson this site keeps collecting.

Hashing & crypto (15)

Article	Topic	Summary
Hashing, encryption, and encoding: three different things	Hashing & cryptoEncoding & data	Three operations that get constantly confused, separated cleanly by two questions: is it reversible, and does it need a key?
Cryptographic hashing: SHA-256 and the SHA-2 family	Hashing & crypto	What a hash function guarantees, the properties that make it cryptographic, and why a digest is not encryption.
Choosing a hash: MD5, SHA-1, SHA-2, SHA-3, and BLAKE	Hashing & crypto	Which hash functions are still safe, which are broken, what their output sizes are, and how to pick the right one.
Collisions, preimage resistance, and the birthday bound	Hashing & crypto	The three security properties a cryptographic hash must have, why collisions matter, and the birthday math that sets the real strength.
Storing passwords: bcrypt, scrypt, and Argon2	Hashing & crypto	Why a fast hash like SHA-256 is the wrong tool for passwords, and what salting and work factors actually do.
HMAC: keyed hashing for message authentication	Hashing & cryptoIdentity & tokens	Why a plain hash proves integrity but not authenticity, how a secret key fixes that, and why HMAC's structure matters.
Why HMAC, and not hash(key + message)	Hashing & crypto	The length-extension attack that breaks naive keyed hashing, and the nested construction HMAC uses to defeat it.
Authenticating API requests with HMAC	Hashing & crypto	How a shared secret and a hash let a server trust a request it did not see being made, and how replay protection fits in.
Verifying an HMAC safely: constant-time and replay	Hashing & crypto	Why comparing signatures with == leaks a timing side channel, and why a valid signature alone does not stop a replayed request.
Why Cryptographic Hashes Are One-Way	Hashing & crypto	A cryptographic hash maps any input to a fixed-size digest and is designed so that recovering the input from the digest is infeasible. That property, preimage resistance, is why you cannot decrypt a hash. The only ways to reverse one are to look it up or to guess-and-check, both of which are search, not inversion.
Brute Force vs Lookup Tables: Two Ways to Reverse a Hash	Hashing & crypto	Since a hash cannot be inverted, reversing one means searching, and there are two families. Precompute a giant table of input-to-hash pairs and look the hash up (what CrackStation does), or generate candidates on the fly and hash each until one matches (brute force). They trade storage for compute in opposite directions.
Why Salting Defeats Precomputed Tables	Hashing & crypto	A salt is a unique random value stored with each password hash and mixed in before hashing. It makes identical passwords hash differently, which destroys the economics of precomputed tables: an attacker would need a separate table for every salt. Salting is the specific defense that neutralizes lookup services and rainbow tables.
Slow KDFs: bcrypt, scrypt, and Argon2	Hashing & crypto	Salting defeats precomputation but not a targeted guess-and-check attack; a fast hash still lets an attacker try billions of candidates per second. Slow key derivation functions fix that by making each guess deliberately expensive and tunable, cutting an attacker's rate by many orders of magnitude. These are what you should store passwords with.
Keyspace, Entropy, and Crack Time	Hashing & crypto	Whether brute force can reverse a hash comes down to keyspace size versus the attacker's hashing rate. Keyspace grows exponentially with length and alphabet, so a few extra characters move a secret from cracked in seconds to infeasible for millennia. This is the arithmetic behind why length and randomness matter most.
Choosing a Password Hash	Hashing & crypto	Storing passwords safely is a solved problem: use a purpose-built, salted, slow password hash, not a raw digest. This is a short decision guide, from the algorithm to pick to the parameters to set and the mistakes to avoid, aligned with OWASP and NIST guidance.

Identifiers (5)

Article	Topic	Summary
UUIDs: random v4 and time-ordered v7	Identifiers	How a 128-bit identifier stays unique without a central authority, and why v7 is becoming the default for database keys.
UUID versions explained: v1 through v8	Identifiers	The whole UUID family in one place, from time-and-MAC v1 to random v4 to time-ordered v7, plus the name-based versions and how the version and variant bits are read.
Will UUIDs collide? Probability and the birthday bound	Identifiers	How many random bits a UUID actually has, the birthday math for a collision, and when you want deterministic UUIDs instead.
UUIDs as database keys: v4, v7, and index locality	Identifiers	The real trade-off between UUIDs and auto-increment integers, and why random v4 keys quietly hurt database performance.
ULID, KSUID, Snowflake, and other sortable IDs	Identifiers	The popular alternatives to UUIDs for time-ordered identifiers, how each is built, and why UUIDv7 now covers most of what they were invented for.

Identity & tokens (39)

Article	Topic	Summary
Anatomy of a JSON Web Token	Identity & tokens	The three segments of a JWT, how the signature makes it trustworthy, and why decoding a token is not the same as verifying it.
JWKS and Key Rotation: How Providers Publish Their Keys	Identity & tokens	A JWKS is the public phone book of signing keys that an identity provider publishes so anyone can verify its tokens. Understanding the keys array, the kid that names each key, and why a provider keeps more than one key at a time is the foundation of token verification.
OpenID Connect: An Identity Layer on OAuth 2.0	Identity & tokens	What OpenID Connect adds to OAuth 2.0, the ID token at the center of it, the relying party and provider roles, how the authorization code flow delivers an ID token, and why an ID token is just a JWT you can decode and read.
JWK Key Types: RSA, EC, OKP, and oct	Identity & tokens	Every JSON Web Key declares a kty, and that one field decides which parameters the key carries. Four types cover almost everything you will meet: RSA, elliptic curve, the Edwards and Montgomery curves, and the symmetric octet sequence. The crucial split in all of them is public versus private.
JWT signing algorithms: HMAC, RSA, and ECDSA	Identity & tokens	Why a JWT's alg header matters, the difference between symmetric and asymmetric signing, and how to choose.
The ID Token Claims, and What a Relying Party Checks	Identity & tokens	The claims inside an OIDC ID token: the required iss, sub, aud, exp, and iat; the nonce that stops replay; azp when there are multiple audiences; acr and amr for authentication strength; auth_time; and the at_hash and c_hash binding claims, with the validation a relying party performs on each.
JWT security pitfalls: alg:none, key confusion, and missing checks	Identity & tokens	The handful of mistakes that turn a JWT verifier into a forgery machine, and the validation a correct verifier must perform.
OIDC vs OAuth 2.0: Authentication vs Authorization	Identity & tokens	Why OAuth 2.0 is about authorization and OpenID Connect is about authentication, the difference between an access token and an ID token, why using plain OAuth as a login mechanism is a known antipattern, and how to tell which token is which.
Verifying a JWT with a JWKS: From kid to Signature	Identity & tokens	Verifying a signed token is a short, strict sequence: read the header, find the key whose kid matches in the provider's JWKS, confirm the algorithm, and check the signature. Each step has a classic pitfall, and skipping the strictness is how verification bypasses happen.
Access tokens, refresh tokens, and ID tokens	Identity & tokens	Three OAuth and OpenID Connect tokens that get constantly confused, what each is actually for, and why sending the wrong one to the wrong place is a real bug.
JWK Parameters and Thumbprints	Identity & tokens	A JWK is a JSON object describing one key, and its parameters say what the key is for and how to identify it. Beyond the key material, kid names it and an RFC 7638 thumbprint gives it a stable, computed identifier. This covers the common parameters and how a thumbprint is derived and used.
OIDC Discovery: The openid-configuration Document	Identity & tokens	How the .well-known/openid-configuration document lets a relying party learn a provider's endpoints and capabilities automatically, what the issuer, jwks_uri, and signing-algorithm fields mean, why advertising the none algorithm is dangerous, and why PKCE S256 support matters.
JWT Algorithm Confusion Attacks	Identity & tokens	Two classic JWT verification failures come from trusting the token's own algorithm header: accepting alg none, and being tricked into verifying an RS256 token as HS256 using the public key as the secret. Both are defeated by pinning the expected algorithm on the server instead of reading it from the token.
Public vs confidential clients, and where PKCE fits	Identity & tokens	Whether an OAuth client can keep a secret decides its whole security model. Why SPAs and mobile apps are public clients, and why PKCE is now recommended for all of them.
The OIDC Authorization Code Flow	Identity & tokens	The authorization code flow is the recommended way an app gets an ID token: the user is redirected to the identity provider to log in, the app receives a short-lived code, and it exchanges that code at a back-channel token endpoint for the tokens. Keeping the token out of the browser is the whole point.
The OAuth 2.0 authorization code flow	Identity & tokens	The four roles, the redirect-and-exchange dance, and why the code is swapped for a token on the back channel.
PKCE: securing the OAuth authorization code flow	Identity & tokens	The interception attack PKCE defeats, how the verifier and challenge fit together, and why S256 is mandatory.
OpenID Connect: identity on top of OAuth 2.0	Identity & tokens	How OIDC adds authentication to OAuth's authorization, what the ID token is, and why the code flow with PKCE is the recommended path.
How TOTP and HOTP one-time passwords work	Identity & tokens	Both turn a shared secret into a short code that proves possession without sending the secret. HOTP counts events; TOTP counts time. The engine underneath is the same HMAC plus a truncation step.
Validating one-time passwords: drift, windows, and replay	Identity & tokens	Generating a code is the easy half. Accepting one means tolerating clock drift, bounding the window, rejecting reuse, and throttling guesses, each a tradeoff between usability and security.
Provisioning Authenticators: otpauth URIs and QR Codes	Identity & tokens	Before an authenticator app can generate codes, it needs the shared secret and the parameters that go with it. That is carried in an otpauth URI, usually shown as a QR code to scan. Knowing the URI's fields explains what the QR code actually contains and why the secret is in base32.
Installing PingFederate: Requirements, First Run, and the Setup Wizard	Identity & tokens	What a PingFederate deployment needs before the ZIP is even extracted - a supported Java runtime, the 9999/9031 port plan, a dedicated service account - then the install itself on Windows or Linux, and exactly what the initial configuration wizard asks of you on first login: license, first administrator, and the base URL partners will trust.
Upgrading PingFederate: The Utility, the Merge, and the Cluster Order	Identity & tokens	How PingFederate upgrades actually work: the Upgrade Utility that copies configuration from the old install into the new one, the release notes you read for every version crossed, the custom-logging merge everyone forgets, and the console-first order that keeps a cluster consistent.
The PingFederate Startup Files: Who Controls What	Identity & tokens	A tour of the files that decide how a PingFederate server runs: the run.sh/run.bat launchers, run.properties for ports and the clustered role, jvm-memory.options for the heap, and log4j2.xml for what gets written where - plus the habit of knowing which file owns which behavior before you need it at 3 a.m.
Who Administers PingFederate: Native Accounts, Roles, and Console Login via LDAP	Identity & tokens	The administrative access model: native accounts and the role set that divides power - User Admin, Admin, Expression Admin, Auditor, and the cryptographic role - plus how console authentication moves from native accounts to an LDAP directory through run.properties and ldap.properties, with directory groups mapped onto the same roles.
PingFederate Operational Hygiene: License, Notifications, and the Configuration Archive	Identity & tokensCertificates & PKI	Three habits that keep a PingFederate deployment boring in the best way: managing the license file and its expiry, wiring notification publishers so certificate and licensing events announce themselves, and treating the data.zip configuration archive - manual exports and the automatic snapshots - as the backup, migration, and undo mechanism it is.
The PingFederate Endpoints Map: Admin Port, Runtime Port, and What Lives Where	Identity & tokens	Every PingFederate endpoint belongs to one of two families: administrative endpoints on the console port (the console app and the /pf-admin-api) or runtime endpoints on the engine port (/idp and /sp application endpoints, the /as OAuth authorization server, OIDC's userinfo and discovery, and the /pf/heartbeat.ping that load balancers watch). Knowing which port answers which path is half the troubleshooting.
PingFederate Data Stores: LDAP and JDBC, Defined Once, Used Everywhere	Identity & tokens	Data stores are PingFederate's reusable connection definitions: an LDAP store with directory type, failover hosts, bind credentials, and LDAPS; a JDBC store with its connection URL, validation query, and the driver JAR that must be deployed before anything connects. Credential validators, attribute lookups, and provisioning all consume the same definitions - which is the whole point.
How Users Prove Who They Are: PCVs and the Five Adapters	Identity & tokens	The PingFederate authentication toolkit the exam names: Password Credential Validators as the reusable password-checking layer, then the five adapters and the integration pattern each one embodies - HTML Form for interactive login, HTTP Basic for the 401 challenge, Kerberos for silent desktop SSO, OpenToken for integration-kit handoff, and Reference ID for the agentless back-channel.
The PingFederate Log Files: Which One Answers Which Question	Identity & tokens	The cast of <pf_install>/pingfederate/log and what each member is for: server.log for the application, admin.log and admin-api.log for who changed what, transaction.log for runtime protocol summaries, audit.log for authentication and security events - plus the log4j2.xml levels that control verbosity and the habit of matching the question to the file.
PingFederate Authentication Policies: Trees, Selectors, and the Contract at the End	Identity & tokens	How PingFederate decides who authenticates how: policy trees whose nodes are authentication sources and selectors, Fail and Success branches flowing top-down, reusable fragments for common sequences, and the Authentication Policy Contract at the end of every successful path - the normalization layer that makes everything downstream source-independent.
LDAP Fundamentals: The Directory Model Behind Identity Systems	Identity & tokens	The Lightweight Directory Access Protocol from first principles: the tree of entries and their distinguished names, the bind operation that authenticates, searches with base, scope, and filter, the group memberships access decisions ride on, and the LDAPS transport - the working vocabulary every identity product assumes before its own documentation makes sense.
Kerberos and SPNEGO: How Silent Desktop SSO Actually Works	Identity & tokens	The ticket machinery behind login-without-a-prompt: the KDC's two services, the TGT and the service ticket, why SPNs and keytabs exist, how SPNEGO carries a Kerberos ticket inside an HTTP Negotiate header, and the small list of things - clock skew, missing SPNs, browser trust - that break it in practice.
SCIM: The Standard That Provisions the Accounts SSO Signs In	Identity & tokens	The System for Cross-domain Identity Management in one sitting: why provisioning needed a standard, the RFC 7643 schemas for Users and Groups, the RFC 7644 REST protocol - create, filter, PATCH, deactivate - and where SCIM sits next to SAML and OIDC in an identity architecture: they authenticate the account, SCIM is how the account got there.
The PingAccess Policy Model: Gateway, Agent, and the Rule Stack	Identity & tokens	How PingAccess decides who reaches what: the two deployment shapes (gateway routing to sites, agents speaking PAAP to a policy server), the application-and-resource partition, rules composed into rule sets and rule set groups, the fixed evaluation order, and the token mediation that keeps legacy backends in the game.
The PingDirectory Platform: Store, Aggregate, Sync, Delegate	Identity & tokens	The four-piece identity data platform: the PingDirectory server as a high-performance LDAP and native SCIM 2.0 REST store, PingDirectoryProxy as the LDAPv3 gateway and virtual directory, PingDataSync as the real-time bidirectional synchronization engine across heterogeneous stores, and Delegated Admin as the controlled self-service surface - plus the operational grammar of cn=config, server groups, and zero-downtime moves.
PingOne: The Platform Behind the Product Names	Identity & tokens	What PingOne actually is - a multi-tenant identity-as-a-service platform organized around environments inside an organization - and how its named services (SSO, MFA, Protect, Verify, Authorize, DaVinci) divide the work, how it relates to the self-managed PingFederate/PingAccess/PingDirectory stack and to Advanced Identity Cloud, and why the same word appears in so many product names.
PingOne DaVinci: Identity Orchestration as a Canvas	Identity & tokens	What identity orchestration is and why it became its own product category: DaVinci's drag-and-drop flows, the connector catalog that turns vendors into nodes, server-driven orchestration that lets journeys change without app releases, the Singular Key origin story, and how DaVinci coexists with the ForgeRock-heritage journeys and trees under one SDK family.
From Sun to Ping: The ForgeRock Lineage Decoded	Identity & tokens	Why the Ping catalog has two of everything: the family tree from Sun's OpenSSO, OpenDS, and OpenIDM through ForgeRock's OpenAM, OpenDJ, OpenIDM, and OpenIG to today's PingAM, PingDS, PingIDM, PingGateway, and PingOne Advanced Identity Cloud - the 2023 merger that created the parallel stacks, which product answers to which name, and how to read any Ping architecture diagram without ambiguity.

Networking (105)

Article	Topic	Summary
How IPv4 addresses work	Networking	The 32 bits behind every dotted-quad address, and what private, loopback, and special ranges mean.
The Syslog PRI: One Number, Two Meanings	Networking	Every syslog message starts with a PRI, a number in angle brackets that packs a facility and a severity into a single value. The formula is small and the arithmetic is easy once you have seen it: PRI equals facility times eight plus severity.
Subnetting basics	Networking	How to divide one network into smaller subnets, and why borrowing host bits is the whole trick.
Syslog Facilities and Severities, Explained	Networking	Syslog defines 24 facilities and 8 severities. The severities are a clean urgency scale from emergency down to debug; the facilities are a mix of genuinely useful categories and historical Unix leftovers, plus eight local slots that network devices lean on heavily.
CIDR notation explained	Networking	What the slash in 192.168.1.0/24 actually means, and how a prefix length defines a block of IP addresses.
Syslog on Network Devices: Which Facility Does What	Networking	Firewalls, load balancers, and switches almost all log to the local facilities, but each vendor picks a different default. Knowing that FortiGate defaults to local7, Cisco ASA to local4, and F5 BIG-IP to local0 turns a wall of PRI numbers into a map of which box said what.
Syslog Message Formats: RFC 3164 vs RFC 5424	Networking	The PRI is the same everywhere, but what follows it is not. Legacy BSD syslog (RFC 3164) has a loose, year-less format, while the modern format (RFC 5424) is precise and structured. Knowing which one you are looking at explains missing timestamps, ambiguous fields, and why parsers disagree.
VLSM: splitting a block into unequal subnets	Networking	How to carve one address block into subnets of different sizes without wasting space, and the largest-first rule that keeps it tidy.
A VLSM allocation, worked end to end	Networking	A full variable-length subnet allocation for a realistic network: sizing each segment, sorting largest-first, assigning the actual addresses, and accounting for the space left over.
How Syslog Travels: UDP, TCP, and TLS	Networking	Syslog can ride over plain UDP, over TCP, or over TLS, and the choice decides whether messages can be silently lost, reordered, or read in transit. This covers the three transports, the ports involved, and why anything you rely on for audit should not be sent over UDP.
Supernetting and route aggregation	Networking	How contiguous prefixes combine into a shorter one, the alignment rule that decides whether two blocks can merge, and the difference between exact aggregation and a single covering supernet.
The First Hour: Hypothesis-Driven Fault Isolation	NetworkingOperations & Fieldcraft	The difference between a two-hour incident and a two-day one is usually decided in the first hour, and it is rarely decided by tools. It is decided by method: aligning onset with change, isolating by scope, reading layer signatures, and treating every explanation as a hypothesis that evidence must support or weaken before anyone acts on it.
Change Windows That Do Not Become Incidents	NetworkingOperations & Fieldcraft	Most self-inflicted outages are changes that went wrong with no clean way back. The difference between a change and an incident is rarely the change itself; it is the runbook around it - what you verified before, how you sequenced it, what would make you stop, and whether the way back was written down and tested before you needed it.
Route summarization	Networking	Why one summary route can replace many specific ones, the contiguous and aligned allocation it depends on, and the black-hole risk of summarizing a range you do not fully own.
Root Cause Is a Verb, Not a Noun	NetworkingOperations & Fieldcraft	The phrase root cause invites a single villain and a tidy ending. Real incidents rarely have one; they have contributing factors, and the honest work is structuring the candidates and the evidence that would confirm or rule out each - not naming a culprit before the evidence is in.
Subnet overlaps and gaps	Networking	What it means for two prefixes to overlap or contain one another, why longest-prefix match makes some overlaps intentional, and how to find the unallocated gaps in an address plan.
Blast-Radius Thinking Before You Change Anything	NetworkingOperations & Fieldcraft	Before a change, the question is not only will this work but if it goes wrong, how far does the damage reach. Blast radius is the shape of that reach - target, neighbours, dependents, people - and thinking about it in tiers is how you decide what to contain before you touch anything.
Private IPv4 address space and RFC 1918	Networking	The three private ranges, why they are not routable on the Internet, and the other special blocks the CIDR tool flags.
TAC Cases That Get Triaged Fast	NetworkingOperations & Fieldcraft	The slowest support cases are rarely the hardest problems; they are the ones that opened without the diagnostic the vendor needs. A case that arrives complete - clear problem, exact error, the diagnostic bundle, the impact - skips the round trips and starts with an engineer actually working it.
Understanding IPv6 Addressing	Networking	How a 128-bit IPv6 address is structured and written, the rules for compressing it canonically, what the address types and scopes mean, and how interface identifiers and reverse DNS work.
How IPv6 hosts get addresses: SLAAC and DHCPv6	Networking	How an IPv6 host configures itself from link-local up, what router advertisements decide, and the difference between SLAAC, privacy addresses, and DHCPv6.
Capture Points Before Packets	NetworkingOperations & Fieldcraft	The instinct under pressure is to start tcpdump somewhere convenient and stare at the flood. The senior habit is the opposite: decide where to observe, in what order, and what each observation would mean - before a single packet is collected. Evidence is designed, not fished for.
IPv6 subnetting and the /64 boundary	Networking	Why IPv6 subnetting is about structure rather than scarcity, why a single subnet is almost always a /64, and how prefix delegation hands out address space.
Public suffixes and the registered domain (eTLD+1)	NetworkingCertificates & PKI	What a public suffix (eTLD) and a registered domain (eTLD+1) are, why you cannot compute them by taking the last two labels, how the Public Suffix List algorithm resolves them, and where the boundary matters: certificate rate limits, cookies, and same-site.
Map the Path Before You Troubleshoot	NetworkingOperations & Fieldcraft	The most expensive troubleshooting sessions share one flaw: nobody actually knew the path. The senior habit is refusing to reason about a failure until the chain is modeled - resolution included, return leg separate, every rewrite and TLS boundary named, and every unknown left visibly unknown.
Neighbor Discovery: how IPv6 replaces ARP	Networking	How IPv6 finds neighbors on a link using ICMPv6 and multicast instead of broadcast ARP, the five Neighbor Discovery messages, and why broadcast is gone.
Baselines Before You Need Them	NetworkingOperations & Fieldcraft	Every comparison is only as honest as its weaker side. The discipline is captured baselines before changes, declared confidence instead of remembered health, observation windows that let convergence speak, churn literacy for the counters that always move - and never calling a change successful on green components alone.
Running IPv6 and IPv4 together: dual-stack and translation	Networking	How the internet bridges two incompatible address families: dual-stack, Happy Eyeballs, NAT64, and the IPv4-embedded addresses that make it work.
What Is an OUI, and How MAC Addresses Are Assigned	Networking	How a MAC address is structured, what the OUI (the manufacturer prefix) is and who hands it out, the difference between universally and locally administered addresses, and why a randomized Wi-Fi MAC has no vendor at all.
Fabric Connect and SPBM: Why VOSS Retires Spanning Tree	Networking	What Extreme's Fabric Connect actually is - Shortest Path Bridging MAC (SPBM, IEEE 802.1aq) with an IS-IS control plane and a MAC-in-MAC data plane - and why collapsing the core to a single link-state protocol replaces spanning tree and the usual overlay stack.
Reading dig Output From Top to Bottom	Networking	A dig answer has a fixed shape: a version line, the header, the flags line, the OPT pseudo-section, the four sections, and the query stats. Once you know what each block is, you can read any response at a glance and spot the one line that explains a resolution problem.
The DNS Header: Opcode, Status, and Flags	Networking	The header line and the flags line hold the message-level facts: what kind of query this is, whether it succeeded, and seven single-bit flags (qr, aa, tc, rd, ra, ad, cd) that tell you who answered and how. Reading them correctly is the difference between a two-minute diagnosis and an hour of guessing.
The I-SID: How VOSS Replaces VLAN Stretching	Networking	Why Extreme's Fabric Connect provisions services at the edge instead of trunking VLANs hop by hop, what the 24-bit I-SID is, and how Layer 2 VSN, Layer 3 VSN, and IP Shortcuts all ride the same mechanism over an SPBM MAC-in-MAC core.
IS-IS, Nicknames, and B-MACs: The VOSS Control Plane	Networking	How SPBM uses IS-IS as its single link-state control plane on fabric links only, what a 20-bit node nickname is and why it must be unique, and how the system-id / backbone MAC drives MAC-in-MAC forwarding.
Reading the Records in a dig Answer	Networking	Every record in a dig section is five columns: name, TTL, class, type, and rdata. This walks the columns and then the rdata of the record types you actually meet, from A and CNAME to MX, SOA, SRV, and CAA, so a wall of records reads as plain facts.
EDNS and the OPT Pseudo-Section	Networking	The OPT pseudo-section is not a record and not something you queried: it is EDNS(0) metadata that dig surfaces near the top of an answer. It carries the UDP payload size, the DO flag that requests DNSSEC, and options like COOKIE, and it quietly explains a whole class of resolution failures.
Fabric Attach: Auto-Provisioning the Edge (Where VOSS Meets EXOS)	Networking	How Fabric Attach lets an edge device signal the service it needs so the fabric provisions the I-SID automatically, the FA Server / Proxy / Client roles, how it rides LLDP (Link Layer Discovery Protocol), and how an EXOS switch attaches to a VOSS fabric without running SPBM itself.
DNSSEC Records in dig Output	Networking	Add +dnssec and a dig answer grows a new family of records: RRSIG, DNSKEY, DS, and the NSEC or NSEC3 denial records. This explains what each one is, how they chain from the root down to a zone, and what the ad flag really certifies.
VOSS vs EXOS: Two Extreme Operating Systems	Networking	Extreme ships universal hardware that boots either EXOS or VOSS (Fabric Engine). This is what actually differs - a traditional-Ethernet OS with an intuitive CLI versus a fabric-native OS built on SPBM - and the three boundaries at which they interconnect.
Reading nslookup Output	Networking	nslookup prints a Server / Address header for the resolver it used, an optional Non-authoritative answer marker, and then the answer in a per-type prose format. Knowing that shape lets you read any result quickly and see at a glance whether it succeeded, where it came from, and what it means.
SMLT and vIST: Dual-Homing a Fabric Edge	Networking	How Split MultiLink Trunking dual-homes an edge device to a pair of switches with active-active links and no spanning tree, how virtual IST runs the inter-switch trunk through the SPBM fabric itself, and the smlt-peer-system-id and smlt-virtual-bmac that make the cluster one logical node.
nslookup vs dig: Which to Use	Networking	nslookup and dig both query DNS, but nslookup is terser and hides the header flags and TTLs that dig shows in full. This maps one output onto the other and gives a simple rule for which to reach for.
How nslookup Prints Each Record Type	Networking	Instead of dig's fixed columns, nslookup labels each record in prose: mail exchanger =, canonical name =, nameserver =, and a multi-line block for SOA. A short guide to reading each type's line.
Authoritative vs Non-Authoritative Answers	Networking	The Non-authoritative answer marker in nslookup means the result came from a resolver's cache, not from a server that actually holds the zone. This explains the difference, why it is usually fine, and how to get an authoritative answer when you need one.
nslookup Errors and What They Mean	Networking	When a lookup fails, nslookup prints a line like ** server can't find NAME: CODE. The code is the whole diagnosis. This covers NXDOMAIN, SERVFAIL, REFUSED, and timeouts, what each one tells you, and the first thing to check for each.
Reverse DNS Lookups with nslookup	Networking	Reverse DNS maps an IP address back to a name through PTR records that live under in-addr.arpa for IPv4 and ip6.arpa for IPv6. nslookup does this automatically when you hand it an address. This covers how the special reverse name is built, why mail servers care, and why the forward and reverse can legitimately disagree.
nslookup Interactive Mode	Networking	Run nslookup with no arguments and it drops into an interactive prompt where you can switch resolvers, change the record type, turn on debug output, and look up many names in one session. This covers the handful of commands worth knowing and when interactive beats a one-shot query.
dig Query Options and Output Control	Networking	dig's real power is its options: choosing the server to ask, the record type, and exactly how much of the answer to print. This covers the handful you will actually use every day, from @server and -t to +short and the +noall +answer combination that trims dig down to just the records.
Following Delegation with dig +trace	Networking	dig +trace resolves a name the way the internet actually does it: starting at the root, following the delegation to the TLD, and then to the domain's own authoritative servers, printing each hop. It is the single best way to see where resolution breaks and to understand how DNS is stitched together.
Reading a curl Command	NetworkingWeb & HTTP	A curl command is a shell command: the word curl, a set of options, and a URL. Reading it means seeing how the shell splits the line first (quotes, backslashes, line continuations) and then how curl reads short, long, and clustered flags.
curl Data Flags and the Content-Type Trap	NetworkingWeb & HTTP	curl has several ways to attach a body, and they differ in encoding and default Content-Type. The big surprise is that -d defaults to form encoding, not JSON, so a JSON body can be mislabeled and rejected.
Translating curl to fetch()	NetworkingWeb & HTTP	The browser fetch API and curl describe the same request differently. Method, headers, and body map across cleanly, but a couple of differences (implicit form Content-Type, cookies, and TLS verification) need care.
Headers, Authentication, and Cookies in curl	NetworkingWeb & HTTP	Headers, auth, and cookies are how a request identifies and authorizes itself. -H adds headers, -u is HTTP Basic, a bearer token is just a header, and -b/-c handle cookies. All of them are sensitive.
How curl Infers the HTTP Method	NetworkingWeb & HTTP	curl does not always need -X to choose a method. Body data implies POST, -I implies HEAD, -G forces GET, and an explicit -X always wins. Knowing the rules tells you at a glance what a request will do.
curl Flags That Change Security Posture	NetworkingWeb & HTTP	A few curl flags change how safe a request is: -k disables TLS verification, http sends everything in clear text, and credentials in the URL can leak. None make a request malicious, but each is worth reading before you run or share a command.
The TCP Proxy: What a Layer 4 Middlebox Does and Does Not See	NetworkingWeb & HTTP	A TCP proxy terminates the client's TCP connection and opens a separate one to the server, splicing two independent flows together at Layer 4. It rewrites addresses and ports, can pool and reuse connections, and sees nothing of the application payload above the transport header. This explains full-proxy versus packet-forwarding, why the source IP disappears, and how the Proxy Protocol puts it back.
HTTP Proxies: Forward vs Reverse, Explicit vs Transparent	NetworkingWeb & HTTP	An HTTP proxy parses requests at Layer 7, so it can route by URL, rewrite headers, and enforce policy on content a TCP proxy cannot see. Two axes describe every deployment: forward vs reverse (which side it works for) and explicit vs transparent (whether the client knows it is there). This covers the CONNECT method, X-Forwarded-For and Via, and where each combination is used.
The 27 Protocols curl Speaks	NetworkingWeb & HTTP	curl is known as an HTTP tool, but the current tool speaks 27 URL schemes: file transfer over FTP, SFTP and SMB, mail over SMTP, POP3 and IMAP, MQTT publish-subscribe, LDAP lookups, and relics like Gopher, DICT and Telnet. Knowing the map, and which schemes start in cleartext, changes how you use it.
HTTP/0.9 vs 1.0 vs 1.1 vs 2 vs 3: Five Versions of the Web's Protocol	NetworkingWeb & HTTP	From a one-line GET that could only fetch HTML to a multiplexed protocol riding QUIC: what each HTTP version added, why it was needed, and which RFC defines it today - including the 2022 reorganization that split HTTP semantics (RFC 9110) from the per-version wire syntax.
AltaVista: built to break a processor, and lost by becoming a portal	Networking	AltaVista started as a benchmark. A researcher wanted a workload chaotic enough to stress DEC's new Alpha chips, so he pointed a crawler at the entire web. The result led search for years and then was dismantled by its own owners, which makes it the clearest case study in the industry of losing a market you already have.
GPON: How One Fiber Serves a Whole Neighborhood	Networking	A Gigabit Passive Optical Network runs one strand of glass from the exchange, splits it with unpowered prisms, and shares it among dozens of homes. How the light is divided, why upstream needs a schedule, and where the decibel budget goes.
Jumbo frames: when 1500 bytes stops being enough	Networking	Why Ethernet settled on 1500 bytes, what 9000-byte jumbo frames actually buy, where they shine, and how an MTU mismatch turns into a silent black hole.
HTTP QUERY: the read that finally carries a body	NetworkingWeb & HTTP	RFC 10008 (June 2026) gave HTTP its first new method since 2010: QUERY is safe, idempotent, and cacheable like GET, but carries a request body like POST. What it fixes, how its caching and discovery work, why 'safe' is not 'harmless', and what every layer of infrastructure must check before QUERY traffic arrives.
The OSI Model in Practice: Mapping Real Traffic to Seven Layers	Networking	The Open Systems Interconnection model earns its place not as trivia but as a shared address system for problems: a MAC address is Layer 2, an IP address Layer 3, a TCP or UDP port Layer 4, and the application on top. How to map real artifacts to layers, where the model bends against TCP/IP reality, and why troubleshooting conversations go faster when everyone points at the same floor.
Switch, Router, Firewall: Who Does What on the Path	Networking	Three device roles carry most of every network diagram: switches forward frames inside a Layer 2 domain, routers move packets between networks, and firewalls decide what is allowed to pass. The function and purpose of each, how an application delivery controller relates to all three, and how to read a network diagram without getting lost.
ARP and MAC Addresses: How IP Finds Ethernet	Networking	Every packet on a local network is delivered by MAC address, and ARP is the directory service that maps an IP to one. The one-to-one mapping, reading ARP output to prove resolution worked, gratuitous ARP, and MAC masquerading - the failover trick that makes an address move without the switches noticing.
Routing Tables and the Default Gateway: How a Packet Picks Its Next Hop	Networking	Why a route is needed at all, what a hop is, and the longest-prefix-match rule that decides which table entry wins - worked through the way the retired fundamentals exam asked: given a destination and a routing table, identify the route to be used. Plus the default route, the entry that answers when nothing else does.
NAT Explained: Source, Destination, and Why the Internet Still Works	Networking	Network Address Translation rewrites addresses in flight - source NAT lets a thousand private hosts share one public address, destination NAT publishes an inside service on an outside address, and the translation table is what makes the return traffic find its way home. The function and purpose, the flavors, and the troubleshooting consequences of each.
DHCP: the Lease Lifecycle Behind Automatic Addressing	Networking	The Dynamic Host Configuration Protocol hands out addresses, gateways, and resolvers so hosts arrive configured instead of blank. The discover-offer-request-acknowledge exchange, what a lease means and how renewal works, relays that carry requests across subnets, and the failure signatures - including the self-assigned address that says no server ever answered.
The TCP Connection Lifecycle: Handshake, Teardown, and Why Connections Fail	Networking	Every TCP conversation has three acts: the SYN handshake that creates it, the data flow that justifies it, and the FIN or RST that ends it. The difference between polite close and abort, the possible reasons a connection terminates, and the short list of causes when one fails to establish at all - the literacy behind every capture you will ever read.
VPN Fundamentals: What Tunnels Protect, and What They Don't	Networking	A virtual private network wraps traffic in an encrypted tunnel so it crosses untrusted networks as if it never left home. The rationale - privacy, encryption, and the limits of anonymity - the valid uses from site-to-site links to remote access, and the honest boundaries: what a tunnel genuinely protects, and the claims it cannot keep.
The Last Mile: From POTS to Always-On	Networking	The story of residential connectivity is the story of one stubborn stretch of infrastructure - the last mile - being reinvented four times: the plain old telephone service that carried voices, the ADSL trick that made the same copper pair carry data full-time, the cable plant's DOCSIS second life, and fiber to the home. Why 1999's 256 kbps mattered more than its speed, what always-on actually changed, and how one house can end up served by copper's ghost, coax, glass, and the sky at once.
Pagers and Paging Networks: Reachable Before Real-Time	Networking	Before the phone in your pocket, there was the bip on your belt: a one-way radio receiver on a simulcast broadcast network, fed - in its classic form - by a human operator who took your caller's words and typed them into the air. How paging networks actually worked, from two-tone beeps to POCSAG and FLEX, why the operator-relay model meant strangers read your life aloud, and why hospitals kept pagers long after everyone else moved on.
LEO Constellations: Why the New Satellite Internet Is a Different Animal	Networking	Geostationary satellites solved coverage and lost latency: parked at 35,786 km, physics alone charges half a second round trip. Low Earth Orbit constellations invert the deal - satellites a few hundred kilometers up, latency in the tens of milliseconds, at the price of needing thousands of moving satellites, phased-array terminals that track them, and constant handoffs. The geometry, the engineering it forces, inter-satellite laser links, and the honest trade-offs.
LoRa and LPWAN: Kilometers of Range on a Coin Cell	Networking	There is a corner of networking where the requirements invert everything broadband optimizes for: send a few bytes, a few times an hour, kilometers through a city, from a battery that must last years. LPWAN is that corner; LoRa is its best-known citizen - Semtech's chirp spread spectrum radio trading bitrate for astonishing link budgets, and LoRaWAN, the LoRa Alliance's network layer, organizing gateways, device classes, and the duty-cycle etiquette of shared spectrum.
HTTP Methods: The Verbs of the Web	NetworkingWeb & HTTP	GET, HEAD, POST, PUT, DELETE, PATCH, OPTIONS, TRACE, CONNECT - and now QUERY. What each method promises, why 'safe' and 'idempotent' are the two properties that actually matter (to caches, retries, proxies, and crawlers), why HTML forms only ever learned two verbs, and how to read an API's soul from the methods it accepts.
HTTP Status Codes: The Five Families	NetworkingWeb & HTTP	Three digits, and the first one does most of the work: 1xx continues, 2xx succeeds, 3xx redirects, 4xx blames the client, 5xx confesses for the server. The family logic, the codes an operator actually meets (200, 204, 301 vs 302 vs 307, 304's cache dance, 401 vs 403, 404 vs 410, 429, 500 vs 502 vs 503 vs 504), the famous curiosities, and why an unknown code's first digit is always enough to act on.
HTTP Headers: The Anatomy of the Metadata	NetworkingWeb & HTTPSecurity & WAF	Everything HTTP knows about a message that isn't the message travels in headers: name-colon-value lines with case-insensitive names, folded into four working roles - request context, response context, representation metadata, and payload plumbing. The end-to-end vs hop-by-hop split that proxies live by, the Host header that made virtual hosting possible, content negotiation, conditionals, and why header order became a fingerprint.
HTTP Cookies: State Over a Stateless Protocol	NetworkingWeb & HTTPSecurity & WAF	HTTP forgets you after every request - by design. Cookies are the retrofit that lets it remember anyway: the server writes a note with Set-Cookie, the browser returns it with Cookie, and everything else - scope, lifetime, security - is rules about when that note travels. Domain and Path scoping, session vs persistent lifetimes, why the server never sees what the browser knows, and where the security flags article picks up.
AJAX, XHR, and fetch: When Pages Learned to Talk Back	NetworkingWeb & HTTP	For its first decade the web had one move: click, blank screen, new page. XMLHttpRequest gave pages a second one - request data in the background, update in place - and 'AJAX' named the revolution (which promptly dropped the X for JSON). How XHR worked, what fetch fixed (promises, streams, a sane API), what stayed the same underneath (it is all still HTTP), and the boundary every background request answers to: same-origin, with CORS as the negotiated exception.
HTML, CSS, and the DOM: The Page as a Living Tree	NetworkingSecurity & WAF	Three technologies, one division of labor: HTML declares structure, CSS declares presentation, and the DOM is what actually exists at runtime - the tree the browser built from your HTML, the only thing scripts can touch, and the reason 'view source' and 'inspect element' show different worlds. How markup becomes a tree, how selectors address it (the same selectors CSS styles with and scripts query with), and why the DOM is where XSS happens and where CSP stands guard.
What Is an Algorithm? A Working Primer	NetworkingWeb & HTTPHashing & crypto	An algorithm is a finite, unambiguous recipe that turns input into output - and the engineering questions are always the same three: is it correct, how does its cost grow, and what does it trade away. Big-O as the grammar of growth, why constants and asymptotes both matter, the core families you already operate (search, sort, hash, graph, state machines), and where each one is already running inside this site's own tools.
The IEEE 802 family, group by group	Networking	802 is not one standard but a committee of working groups, each owning a slice of the lower two layers. Here is the map: who owns Ethernet, who owns Wi-Fi, what the numbers after the dot mean, and which groups are alive, hibernating, or long dead.
Structured cabling: the system behind the wall jack	Networking	TIA-568 turns a building's wiring from improvisation into a system: horizontal runs, telecom rooms, the 100-meter channel, categories, pinouts, and the fire ratings inspectors actually check. The map from wall plate to backbone.
BGP: how the internet decides where traffic goes	Networking	The Border Gateway Protocol is the internet's routing brain - and it works nothing like the routing inside your network. A practical primer: autonomous systems, the path-vector idea, the attributes that encode business policy, why convergence is slow on purpose, and what RPKI fixes.
OSPF: the map, the math, and area 0	Networking	Open Shortest Path First is the standard interior routing protocol: every router gets the whole map and runs Dijkstra on it. A practical primer: link-state flooding, areas and the backbone rule, cost and the reference-bandwidth trap, DR elections, and the design habits that keep OSPF boring.
IS-IS: the routing protocol hiding under the internet	Networking	OSPF's link-state twin from the OSI world runs the carrier backbones your packets cross daily - and most engineers have never typed its name. A practical primer: the layer-2 trick, NET addresses, levels instead of areas, TLV extensibility, and why the big networks never left.
MPLS: labels, stacks, and the BGP-free core	Networking	Push a label at the edge, swap it hop by hop, pop it before the exit - and suddenly the core needs no routing table, VPNs isolate thousands of customers, and traffic goes where engineering says. A practical primer on label switching, L3VPNs, and the Segment Routing present.
Peer-to-peer, from Napster to the swarm: the architectures that outlived the piracy	Networking	Napster, Gnutella, Kazaa, eMule, BitTorrent - four years of file-sharing produced five distinct network architectures, each solving the weakness the last one died from. The centralized index, unstructured flooding, the supernode, the distributed hash table, and the swarm - what each actually was, how the courtroom shaped the topology, and why these ideas quietly power Skype, streaming CDNs, and blockchains today.
The Brazilian market reserve, in theory and in practice	Networking	For eight years Brazil legally reserved its computer market for domestically-owned companies. The theory was an infant industry that would grow up and compete. The practice was clones, smuggling, a trade war with Washington, and a generation of engineers who learned on machines the policy created. Both halves are true.
Digital transformation: what actually changed, and how to read what comes next	NetworkingOperations & Fieldcraft	Transformation is not the technology arriving. It is the moment a capability stops being remarkable and becomes assumed. A look at what genuinely changed across money, work, health, and the state, and then an honest method for reading predictions, including a deadline that is real and moving at the same time.
How the internet gets shut down, and who can actually do it	Networking	There is no off switch, but there are chokepoints: cables, routing, exchanges, and the small number of companies most traffic passes through. A tour of the mechanisms, what each state can genuinely do with them, and the uncomfortable conclusion that watching everything is easier than switching anything off.
Who actually governs the internet in Brazil	Networking	Brazil built one of the world's most distinctive internet governance models: multistakeholder before that was a word, with a research foundation running the country's first connection and a committee that is not a ministry. The organs, the laws, the state computing backbone underneath it all, and the 2025 ruling that rewrote platform liability.
Amateur radio: callsigns, modes, and why it still matters	Networking	A callsign is an identity issued by treaty, readable anywhere on earth. What the letters and the digit mean, how PY2 says São Paulo, the difference between voice and CW and digital, what a repeater actually does, and why a hobby older than broadcasting is still the fallback when everything else fails.
The data communications window, 1968 to 1972	Networking	A regulator opened a market. The Carterfone decision let equipment AT&T had not built attach to the telephone network, and within four years an industry of modem and multiplexer companies existed that could not have existed before. The trigger, the window, the products that defined it, and why it closed.
The networking window, 1979 to 1982	Networking	Corporations had bought computers for a decade and now needed them to talk to each other inside a building. The window that opened around 1979 produced local area networks and the data PBX, settled a contest between two answers to the same problem, and closed once the answer was obvious.
The radio spectrum: which frequencies go how far, and why	Networking	Why a shortwave signal crosses an ocean on 100 watts while your Wi-Fi struggles through a wall. The bands from VLF to EHF, the three propagation modes that explain nearly everything, and the trade that governs all radio: reach or capacity, never both.
The internetworking window, 1984 to 1988	Networking	The previous window's success created this one's problem: buildings full of local area networks that could not reach each other. Bridges and routers answered it, a standards war ran alongside, and two trade shows in 1988 made the outcome visible before the argument was formally over.
The two shows of 1988	Networking	One trade show put competing vendors' equipment on a single live network in public, where failure would be seen. The other showed an ecosystem that was largely described rather than shipped. The standards argument was formally undecided and a buyer walking both floors did not need it settled.
The founders who kept founding	Networking	Reading this industry as a sequence of companies misses that it is substantially the same population of people, recombining. Ungermann left Intel for Zilog and Zilog for Ungermann-Bass; Metcalfe left Xerox for 3Com. What that pattern explains, and what it does not.
BFD: when a link is up and dead at the same time	Networking	Routing protocols detect failure with their own timers, measured in tens of seconds. BFD detects it in milliseconds, and exists because the most dangerous link failure is the one where the interface stays up. What it does, what it does not do, and where it goes wrong.
First-hop redundancy: VRRP, HSRP, and the gateway that is a fiction	Networking	A host knows one default gateway and cannot fail over. VRRP and HSRP solve that by making the gateway address belong to a role rather than to a router. How they work, why the protocol choice matters less than people think, and the failure modes that make a redundant pair worse than a single router.
Multicast: what it costs to not flood	Networking	Multicast sends one copy where unicast would send thousands, and the saving is real. What it buys in bandwidth it pays for in state, and the failure modes are not the ones people expect: a network that floods multicast everywhere is usually working exactly as configured.
Public DNS resolvers: what you are actually choosing	Networking	Cloudflare, Google, Quad9, OpenDNS and the rest differ far less in speed than in policy. What each one does with your queries, which ones block by default, why anycast makes 'nearest' complicated, and the trade nobody states: the resolver that protects you also sees everything you ask for.
FortiGate as a DNS server: four modes, and where the filter applies	Networking	A FortiGate can relay DNS, answer from its own database, or resolve from the root itself. The four modes behave differently under failure, and the DNS filter profile does not apply to all of them - which is the configuration that looks protected and is not.

Operations & Fieldcraft (4)

Article	Topic	Summary
Terminal, shell, TTY, console	Operations & Fieldcraft	Four words used interchangeably by almost everyone, including the documentation. They name four different things, and the distinction explains why Ctrl+C kills your command but not your shell.
What a Channel Systems Engineer Actually Does	Operations & Fieldcraft	Inside a distributor there is a role almost nobody outside the channel can describe: the systems engineer who supports resellers rather than customers. Bill of materials work on every project that passes through, proofs of concept, presentations, enablement, bootcamps, trade shows. Some of the resellers being supported have no technical staff at all, which is the fact that explains the rest of the job.
What a network operating system actually is	Operations & Fieldcraft	IOS, Junos, EOS, TMOS, FortiOS, PAN-OS and the rest, compared on the axes that matter: what they run on, how components share state, where the planes divide, and what happens when one part fails.
The path a product takes, and the jobs along it	Operations & Fieldcraft	Between the company that builds a thing and the person who depends on it, a product passes through many hands. Each pair belongs to a job with its own clients, suppliers, accountability and measurement — and the measurement is rarely the same as the accountability.

Security & WAF (56)

Article	Topic	Summary
HTTP Security Headers: The Defense-in-Depth Layer	Security & WAF	What HTTP security headers are, why they form a layer of defense on top of secure code rather than a replacement for it, the headers that carry the most weight, and how to read a response's posture at a glance.
Regex Quantifiers and Character Classes	Security & WAFWeb & HTTP	A regular expression is built from two questions: what character do I want, and how many of them? Character classes answer the first, quantifiers answer the second. Get these two right and most of regex falls into place.
SAML 2.0: How Browser SSO Works	Security & WAFIdentity & tokens	What a SAML assertion is, the roles of the identity provider and service provider, the SP-initiated Web Browser SSO flow end to end, and the difference between the HTTP-POST and HTTP-Redirect bindings that carry the messages.
Content Security Policy, Directive by Directive	Security & WAF	How CSP works as a control against cross-site scripting and injection: the shape of a policy, why default-src matters, what 'unsafe-inline' and 'unsafe-eval' give away, how nonces and hashes allow specific inline code safely, and what report-only mode is for.
Inside a SAML Assertion: Subject, Conditions, and Audience	Security & WAFIdentity & tokens	The anatomy of a SAML assertion: the Subject and NameID formats, bearer SubjectConfirmation and the NotOnOrAfter / Recipient / InResponseTo checks, the Conditions validity window, the AudienceRestriction, and the AuthnStatement, with the validation a service provider must perform on each.
Regex Groups, Backreferences, and Lookarounds	Security & WAFWeb & HTTP	Parentheses do far more than set precedence in a regex. They capture text for you to reuse, name the pieces you care about, and — with a question mark prefix — let you assert what comes before or after without consuming it.
Catastrophic Backtracking and ReDoS	Security & WAFWeb & HTTP	Some innocent-looking patterns can take seconds, minutes, or effectively forever on a short string. The cause is catastrophic backtracking, and when an attacker controls the input it becomes a denial-of-service bug. Here is why it happens and how to write patterns that cannot.
HSTS and HTTPS Enforcement	Security & WAF	How Strict-Transport-Security closes the HTTP downgrade window, what max-age, includeSubDomains, and preload each do, the trust-on-first-use gap that preloading removes, and the configuration mistakes that quietly disable it.
SAML Signatures and XML-DSig	Security & WAFIdentity & tokens	How a SAML message is signed with XML Signature: the enveloped ds:Signature, the SignatureMethod and DigestMethod algorithms, why SHA-1 is weak, the difference between signing the Response and signing the Assertion, and how XML signature wrapping attacks work.
Cookie Security Flags	Security & WAF	How Secure, HttpOnly, and SameSite protect session cookies, what each SameSite value means, why SameSite=None requires Secure, and how the __Host- and __Secure- prefixes enforce those guarantees at the browser level.
Regex Anchors and Boundaries	Security & WAFWeb & HTTP	Anchors match a position, not a character: the start or end of the string, or the edge of a word. They are the difference between a pattern that matches anywhere and one that matches only where you mean. This covers ^, $, \b, and their multiline behavior, plus the mistakes they cause.
XXE and Why a SAML Parser Rejects DOCTYPE	Security & WAFIdentity & tokens	How XML External Entity (XXE) attacks work, the billion-laughs denial-of-service, why both depend on a DTD, and why a hardened SAML decoder rejects any DOCTYPE or entity declaration outright rather than trying to parse it safely.
Clickjacking and Frame Control	Security & WAF	What clickjacking is, how framing makes it possible, the difference between the legacy X-Frame-Options header and the modern CSP frame-ancestors directive, why ALLOW-FROM is obsolete, and how the two controls interact.
Regex Flags and Modes	Security & WAFWeb & HTTP	A flag changes how the whole pattern matches: case sensitivity, whether ^ and $ see lines, whether the dot crosses newlines, and whether whitespace in the pattern is ignored. The same regex can match completely different things depending on its flags, so knowing them prevents a lot of confusion.
SAML Bindings and SP vs IdP Initiation	Security & WAFIdentity & tokens	A SAML flow can start at the service or at the identity provider, and the messages can travel by two different bindings: an HTTP redirect with the message packed into the URL, or an auto-submitting HTML form that POSTs it. Which binding carries which message, and where the flow begins, explains a lot of SSO behavior.
The SAML Proxy: Inserting an Identity Layer into a Session	Security & WAFIdentity & tokens	A SAML proxy sits in the SSO flow rather than the packet path: it terminates the user's request, forces authentication against an identity provider, and only then lets the session through, using SAML's browser-redirect model. It can act as a service provider to the IdP and an identity provider to the app at once (a proxy or broker), which is how one login federates many downstream systems. This explains the roles, the flow, and why it is a proxy at all.
Reading OGNL in a WAF Log: What the Payload Was Trying to Do	Security & WAFWeb & HTTPEncoding & data	An OGNL payload in a log has two halves worth telling apart: something that tries to switch off the expression sandbox, and something that tries to run a command. A payload with both is an exploitation attempt. A payload with only the second is usually a scanner working through a list. A payload with neither is a probe checking whether input gets evaluated at all - and that answer decides whether anything else in the list could ever work.
XXE and External Entities	Security & WAF	XML lets a document declare entities, and an external entity can point at a file or URL. A parser that resolves one can be tricked into reading local files or making server-side requests, the XXE vulnerability. The fix is blunt and effective: do not process a DOCTYPE at all.
Billion Laughs and Entity Expansion	Security & WAF	Entities can reference other entities, and if each one multiplies the last, a tiny document can expand to gigabytes and exhaust memory. The billion laughs attack weaponizes this into a denial of service. The defense is to cap expansion or refuse the DOCTYPE outright.
How CVSS Scoring Works	Security & WAF	CVSS turns a short vector string into a 0 to 10 severity number using a fixed formula. The Base score is built from two sub-scores: Exploitability (how reachable and easy the flaw is) and Impact (how bad the outcome is). Everything else refines that base. This is arithmetic, not opinion, which is why a calculator can reproduce any published score exactly.
The CVSS Base Metrics, Explained	Security & WAF	The Base score comes from eight metrics in two families. Four exploitability metrics (Attack Vector, Attack Complexity, Privileges Required, User Interaction) describe how hard the attack is, and four impact metrics (Scope, plus Confidentiality, Integrity, Availability) describe the damage. Scope is the subtle one: it is what lets a score exceed the vulnerable component's own boundary.
CVSS Temporal and Environmental Scores	Security & WAF	The Base score is only the starting point. Temporal metrics lower it as facts emerge, such as a patch being released, and can only reduce the score. Environmental metrics let an organization re-score the flaw for its own systems by raising or lowering the importance of confidentiality, integrity, and availability and by overriding base metrics. Both are optional but produce a more honest number.
Reading a CVSS Vector String	Security & WAF	A CVSS vector is a compact, self-describing string: a version prefix followed by slash-separated metric:value pairs. Learning to read it directly, rather than trusting a rendered score, lets you spot transcription errors and understand exactly what a vendor claimed. The Base metrics are mandatory and the rest are optional.
CVSS Severity Bands, and What the Score Does Not Tell You	Security & WAF	The 0 to 10 number maps to five qualitative bands from None to Critical. That mapping is useful for triage, but a CVSS Base score measures severity, not risk. It says nothing about whether a flaw is being exploited, how valuable the asset is, or what controls you have. Treating the base number as a priority queue is the most common way teams misuse CVSS.
CVSS v3.0, v3.1, and v4.0: What Changed	Security & WAF	This decoder computes CVSS v3.0 and v3.1. The two v3 releases share a formula but differ in rounding and one environmental term, so scores can differ by a tenth. CVSS v4.0, released in 2023, is a larger redesign with new metric groups and no Scope metric, and its vectors are not compatible with v3 tooling. CVSS v2 is retired.
Passive TLS Fingerprinting: JA3, GREASE, and the Churn That Led to JA4	Security & WAF	A ClientHello announces the client in the clear, and the combination of versions, ciphers, and extensions is characteristic of the software that sent it. This covers how JA3 turns that into a hash, why GREASE has to be stripped, how extension-order randomization broke JA3 (the churn), how JA3N and JA4 restore stability, and where a TLS fingerprint fits as a signal for secure web gateways and adaptive authentication.
What Is Server-Side Request Forgery (SSRF)	Security & WAF	SSRF is a vulnerability where an attacker makes a server issue an HTTP request to a destination of the attacker's choosing. Because the request originates inside the server's network, it can reach internal services, cloud metadata, and loopback addresses that the attacker could never reach directly. The fix is to validate the destination, not the URL string.
Private, Reserved, and Public IP Ranges	Security & WAF	An SSRF filter has to know which addresses are internal. This is the map: RFC 1918 private space, loopback, link-local, carrier-grade NAT, the documentation ranges, and everything else that is public and routable. Knowing the ranges is what turns a raw address into a safe-or-not decision.
IP Address Obfuscation Tricks	Security & WAF	One IP address can be written in many forms: plain decimal, octal, hexadecimal, short-hand, and IPv4-mapped IPv6. Each form parses back to the same address, which is how attackers slip an internal target past a filter that only blocks the dotted-decimal spelling. This is why SSRF checks must decode, not string-match.
Cloud Metadata Endpoints and SSRF	Security & WAF	Every major cloud gives an instance a metadata service at a fixed link-local address, and it can return temporary credentials for the instance's role. That makes it the single highest-value SSRF target. Knowing the endpoints, and the IMDSv2-style defenses, is essential for both attack understanding and defense.
Defending Against SSRF with Allow-Lists	Security & WAF	The durable SSRF defense is an allow-list of intended destinations, combined with resolving the address before you trust it and re-checking after redirects. Block-lists of internal ranges help, but they lose to obfuscation and DNS rebinding. This is the layered approach that holds up.
Dangerous URL Schemes in SSRF	Security & WAF	SSRF is not limited to http. Schemes like file, gopher, dict, and ftp let an attacker read local files or craft raw bytes to internal services such as Redis and SMTP. A URL fetcher that does not restrict the scheme hands an attacker a far more powerful primitive than a plain web request.
SSL Forward Proxy: How Outbound TLS Interception Works and What Breaks It	Security & WAFCertificates & PKITLS & transport	To inspect encrypted outbound traffic, a forward proxy performs a controlled man-in-the-middle: it terminates the user's TLS session, opens its own to the real server, and forges a certificate for that server signed by a private CA the organization's own devices trust. This explains the mechanics, the trust model that makes it safe (and dangerous), and why pinning, HSTS, and mutual TLS defeat it.
The LGPD for Engineers: The Vocabulary That Matters	Security & WAF	Brazil's data protection law assigns you a role, gives you ten legal bases instead of one, and puts a three-working-day clock on breach notification. What controlador, operador, and encarregado mean when you are the one running the systems.
Passive Fingerprinting: What You Emit Without Being Asked	Security & WAFNetworking	Every connection announces its stack before a byte of application data flows. How a TCP SYN, a User-Agent string, and the mere order of HTTP headers each identify a client - and why a mismatch between them is the classic proxy and bot tell.
Check Point's Three-Tier Architecture: Management, Gateway, and SmartConsole	Security & WAF	Check Point separates the place policy is written from the place it is enforced, and that split explains almost everything else about the platform: why you install policy rather than just save it, why SIC exists, and why a gateway keeps working when the management server is down.
Check Point Administrators, Sessions, and Objects: Publish Is Not Install	Security & WAF	Check Point gives every administrator a private working session, so your changes are invisible to colleagues until you publish and inert on the gateway until you install. Those are two separate actions and confusing them is the most common early mistake on the platform.
Check Point Logging and Monitoring: Where Logs Go and How to Ask Them Questions	Security & WAF	A log only exists if a rule was set to create it, and it only survives if a log server was there to receive it. Once both are true, the Logs and Monitor view is a query interface rather than a list, and learning to ask it questions is the difference between finding an answer in seconds and scrolling.
Check Point Identity Awareness: Writing Rules About People Instead of Addresses	Security & WAF	Identity Awareness lets a rule say who rather than where. The gateway has to learn the user-to-address mapping from somewhere, and which source you choose decides how quickly identities appear, how accurate they stay, and what happens when someone changes desk.
Check Point HTTPS Inspection, Application Control, and URL Filtering	Security & WAF	Most traffic is encrypted, so the controls that decide which applications and sites are permitted can only see what the handshake reveals unless the gateway decrypts. HTTPS Inspection is what makes the rest work fully, and it is also the feature most likely to break something on the day you enable it.
Check Point Threat Prevention: The Blades, Profiles, and Prevent Versus Detect	Security & WAF	Threat Prevention is several engines under one policy, each catching a different stage of an attack. The setting that matters most is not which engines are on but whether each is preventing or only detecting, because that single choice decides whether you have protection or a report.
Check Point Management High Availability: Active, Standby, and Why Failover Is Manual	Security & WAF	A second management server protects the database, not the traffic. Gateways keep enforcing whatever happens to management, so what you are buying is the ability to keep changing policy — and the synchronisation status is the thing that tells you whether you actually have it.
Check Point Site-to-Site VPN: Communities, Encryption Domains, and Why the Tunnel Is Empty	Security & WAF	A Check Point VPN is built from communities rather than individual tunnel definitions, which is what makes many sites manageable. The recurring fault is not that the tunnel fails to establish but that it establishes and carries nothing, and that almost always traces to the encryption domain or to NAT.
Check Point SmartEvent and the Compliance Blade: Turning Logs into Events Worth Reading	Security & WAF	SmartEvent correlates logs into events so that a hundred related entries become one thing a person acts on. The Compliance Blade audits the configuration itself against best practice. Both are only as useful as the tuning, and an untuned SmartEvent is a second place to ignore alerts.
Check Point Upgrades and Migrations: Order, Compatibility, and Getting the Database Out	Security & WAF	Upgrade order is not a preference: management goes first, because a management server can manage older gateways and an older management server cannot manage newer ones. Migration is a different operation from upgrading, and the thing being moved is the database rather than the machine.
Check Point ElasticXL: One Cluster Object, Many Members	Security & WAF	ElasticXL is Check Point's newer clustering approach, built so that a cluster is configured and managed as a single entity rather than as members that each need attention. The operational argument is that adding capacity should not mean repeating configuration.
How a Proxy Knows Who You Are: User Authentication Methods Inline	Security & WAF	Policy per user is the whole promise of an inline proxy - which means the proxy must attach an identity to every flow, including the ones that cannot log in. The four working patterns: explicit 407 challenges, cookie-based web authentication, agent-asserted identity, and the surrogate-IP compromise - plus where each one breaks, because every one of them breaks somewhere.
Data Loss Prevention: How Machines Recognize Secrets	Security & WAF	Every DLP product answers the same question - is this outbound content sensitive? - with the same four instruments: patterns, dictionaries, exact data matching against fingerprinted records, and indexed document matching against fingerprinted files. What each instrument can and cannot recognize, why confidence scores and proximity exist, and why the hard part of DLP was never the matching.
Sandbox Detonation: Judging a File by What It Does	Security & WAF	Signatures recognize malware that has been seen; a sandbox convicts malware that has not - by running the file in an instrumented cage and watching its behavior. What detonation actually observes, why verdicts take minutes, the patient-zero window that timing creates, how hash sharing turns one verdict into everyone's protection, and the evasion arms race that keeps cage-builders employed.
Browser Isolation: When You Cannot Trust the Page, Move the Browser	Security & WAF	Remote Browser Isolation stops asking whether a page is safe and removes the question: the real browser runs in a disposable cloud container, and the endpoint receives only a rendered projection - pixels or a reconstructed DOM. What each rendering mode trades, why isolation is the answer for the uncategorizable middle, what it costs, and where its honest limits sit.
CORS Explained: The Border Control of the Browser	Security & WAFWeb & HTTP	CORS is the most misunderstood error message in web development, because it punishes the wrong mental model. It is not a wall - the same-origin policy is the wall; CORS is the door: a header protocol by which a server volunteers 'that other origin may read my responses.' Simple requests vs preflights, what OPTIONS is doing in your network tab, why credentials tighten every rule, why '*' is not the fix, and why CORS never protected the server in the first place.
LDAP search filters: reading the parentheses	Security & WAFIdentity & tokens	Every directory query - PingDirectory, Active Directory, any LDAP server - comes down to one filter string in prefix notation. How to read it: the operators, the six match types, the escapes, the famous AD bit-filter OIDs, and why an unindexed filter can take down a directory.
OAuth flows: choosing the grant in 2026	Security & WAFIdentity & tokens	One decision starts every integration: which flow. The modern answer is short - authorization code + PKCE for humans, client credentials for machines, the device grant for TVs - and the reasons implicit and ROPC died are worth knowing by heart. RFC 9700 finally wrote it all down.
Memory safety: the bug classes and the defenses that answer them	Security & WAF	Buffer overflow, use-after-free, null dereference, integer overflow - four names for two failures, staying inside an object and only touching it while it is alive. How each one works, why roughly seventy percent of serious vulnerabilities in large C and C++ codebases belong to this family, and what each defensive layer actually buys.
Tor: how onion routing actually works, and what it does not protect	Security & WAF	Onion routing was invented at a US Navy lab, and that paradox is the key to understanding it: anonymity only works if the crowd is diverse. How a three-hop circuit is built, what onion services really are, the threat model Tor openly admits it loses to, and why most Tor traffic never touches the dark web at all.
DNS blocklists: RPZ, ratings, and what a refused answer costs	Security & WAF	Blocking a domain at the resolver is the cheapest security control there is, which is why every vendor sells one. How RPZ feeds work, what a vendor DNS rating actually rates, the two failure modes nobody plans for, and why the block you cannot see is worse than the one you can.

Text & utilities (1)

The Greek Alphabet: Engineering's Second Alphabet
Why Ω means ohms, μ means micro, and λ runs both wavelengths and serverless functions. The 24 letters, the final-sigma rule, and the transliteration gotchas between modern and classical Greek that quietly rename beta and eta.
Text & utilitiesRead

Article	Topic	Summary
The Greek Alphabet: Engineering's Second Alphabet	Text & utilities	Why Ω means ohms, μ means micro, and λ runs both wavelengths and serverless functions. The 24 letters, the final-sigma rule, and the transliteration gotchas between modern and classical Greek that quietly rename beta and eta.

TLS & transport (12)

Article	Topic	Summary
Anatomy of a TLS Cipher Suite	TLS & transport	What a TLS cipher suite actually names, how to read a suite like TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 piece by piece, and how the same two-byte code point shows up under three different naming conventions.
Reading Cipher Suite Names: IANA, OpenSSL, and GnuTLS	TLS & transport	Why the same cipher suite has three different names and a two-byte code point, how to translate between the IANA, OpenSSL, and GnuTLS conventions, and what the IANA Recommended column of Y, N, and D actually means.
AEAD vs CBC: Why the Mode Matters	TLS & transport	The practical difference between an AEAD cipher like AES-GCM and an older CBC cipher with a separate HMAC, the padding-oracle attacks that killed MAC-then-encrypt, and the one tradeoff AEAD still asks you to make.
Forward Secrecy and the Key Exchange	TLS & transport	What forward secrecy buys you, why static RSA key transport does not provide it, how ECDHE and DHE do, and why authentication and key exchange are two separate jobs that a suite name keeps distinct.
TLS 1.3 Cipher Suites: What Changed	TLS & transport	Why a TLS 1.3 suite names only a cipher and a hash, where the key exchange and authentication went, and why the list of suites shrank from hundreds to a handful.
What a Quantum Computer Would Break, and What It Would Not	TLS & transport	A large quantum computer would not weaken all cryptography equally. Shor's algorithm breaks the public-key math behind RSA, Diffie-Hellman, and elliptic curves outright; Grover's algorithm only halves the strength of symmetric ciphers and hashes, which AES-256 and SHA-384 already survive. This explains the split, why 'harvest now, decrypt later' makes it a today problem, and why a broken candidate like SIKE is a reminder to stay humble.
The NIST Post-Quantum Standards: ML-KEM, ML-DSA, and SLH-DSA	TLS & transport	In August 2024 NIST finalized the first three post-quantum standards: FIPS 203 (ML-KEM, from Kyber) for key establishment, and FIPS 204 (ML-DSA, from Dilithium) and FIPS 205 (SLH-DSA, from SPHINCS+) for signatures. This explains what each one is for, why there are two signature standards on different math, and where HQC and FN-DSA fit as the backups still coming down the pipeline.
Hybrid Key Exchange in TLS 1.3: What X25519MLKEM768 Does on the Wire	TLS & transport	The web did not swap classical key exchange for post-quantum; it runs both at once. X25519MLKEM768 combines a 1990s elliptic curve with lattice-based ML-KEM-768 in a single TLS 1.3 group, so a break of either still leaves the session secure. This covers why hybrid rather than replacement, the wire format and its size problem, and where deployment stands across browsers, servers, and the middleboxes it breaks.
Inbound TLS: Offload, Bridging, and Passthrough at the Reverse Proxy	TLS & transportCertificates & PKI	A reverse proxy handling inbound HTTPS has three choices for the TLS session: terminate it and send plaintext to the backend (offload), terminate and re-encrypt to the backend (bridging), or forward the encrypted bytes untouched (passthrough). Each trades visibility against confidentiality and cost differently. This explains all three, why the proxy holds the server's certificate, and what SNI and mutual TLS change.
TLS 1.2 vs TLS 1.3 vs DTLS vs QUIC: One Handshake Family, Four Shapes	TLS & transport	TLS 1.2 and TLS 1.3 secure a TCP stream, DTLS carries the same guarantees over datagrams, and QUIC absorbs the TLS 1.3 handshake into the transport itself. What each one is, which RFC defines it today, what actually changed between them, and where each one runs.
What Is a JA4 TLS Fingerprint?	TLS & transportSecurity & WAF	How a TLS ClientHello becomes a stable fingerprint of the client software, why JA3 faded once browsers began randomizing extension order, how JA4 fixes that by sorting before hashing, and what JA4 can and cannot tell you.
Why Do We Say SSL When We Mean TLS?	TLS & transport	SSL has been prohibited, deprecated, and dead for years - and the industry still sells 'SSL certificates,' configures 'SSL inspection,' and links openssl. The history explains the habit: Netscape's SSL, the political rename to TLS in 1999 (the wire version field still said 3.1), and a quarter century of marketing inertia. Plus the musing the question deserves: what would a protocol-independent name even look like, and do any exist?

Network and security concepts, explained clearly.

Certificates & PKI (14)

Anatomy of an X.509 Certificate

PEM, DER, and the certificate file formats

Certificate signing requests and how certificates are issued

How certificate validation actually works

Certificate revocation: CRL, OCSP, and short-lived certificates

Authority Information Access: The OCSP and CA Issuers URLs

OCSP Must-Staple: Closing the Soft-Fail Gap

ACME: how certificates issue and renew themselves

The 47-day era: how TLS certificate lifetimes are shrinking

Certificate validity windows: notBefore, notAfter, and renewal lead time

Let's Encrypt: the free CA and its rate limits

DCV and SII reuse: the validation cadence behind the renewal cadence

Renewing before expiry: lead time, ACME, and ARI

Public vs private PKI: which certificates SC-081v3 governs

Encoding & data (42)

Bytes, code points, and UTF-8

JSON vs YAML: What Converts Cleanly and What Does Not

The Anatomy of a URL

The JSON Grammar: Six Types and a Few Strict Rules

What Unix Time Actually Is

Base64 and Base64URL, explained

JSON Numbers and the Precision Trap

Query Strings: Parameters, Plus Signs, and Repeated Keys

Seconds, Milliseconds, Microseconds, Nanoseconds: Telling Epoch Units Apart

YAML Type Coercion and the Norway Problem

Base64URL and the URL-safe alphabet

Duplicate Keys in JSON: Legal, Dangerous, and Worth Catching

JSON and YAML in Practice: APIs, Declarations, and Orchestration

The Year 2038 Problem

URL Encoding and Internationalized Hosts

ISO 8601, RFC 3339, and the HTTP Date

JSON String Escapes and Unicode

Where Base64 shows up: data URIs, MIME, PEM, and Basic auth

YAML Anchors, Aliases, and Merge Keys

Base32, explained

Trailing Commas, Comments, and the JSON5 Family

Why Unix Time Ignores Leap Seconds

YAML Block Scalars and Multiline Strings

Formatting, Minifying, and Canonical JSON

Hexadecimal encoding (Base16), explained

Relative URLs and How They Resolve

Roman Numerals: How the System Actually Works

Deceptive URLs: Reading Past the Tricks

Percent-encoding (URL encoding), explained

Time Arithmetic and Time Zones: Exact Durations, Honest Meetings

Base16, Base32, Base64, and percent-encoding compared

How text diff works

Reading a diff

Word and Character Level Diffs

Three-Way Diffs and Merge Conflicts

Minimal Edits: Why a Diff Can Look Wrong

Reading XML Structure

XML Namespaces Explained

Well-Formed vs Valid XML

CDATA, Comments, and Processing Instructions

HTML Forms and Request Encoding: How the Web Ships Your Input

URI, URL, URN: What's Actually the Difference?

Hashing & crypto (15)

Hashing, encryption, and encoding: three different things

Cryptographic hashing: SHA-256 and the SHA-2 family

Choosing a hash: MD5, SHA-1, SHA-2, SHA-3, and BLAKE

Collisions, preimage resistance, and the birthday bound

Storing passwords: bcrypt, scrypt, and Argon2

HMAC: keyed hashing for message authentication

Why HMAC, and not hash(key + message)

Authenticating API requests with HMAC

Verifying an HMAC safely: constant-time and replay

Why Cryptographic Hashes Are One-Way

Brute Force vs Lookup Tables: Two Ways to Reverse a Hash

Why Salting Defeats Precomputed Tables

Slow KDFs: bcrypt, scrypt, and Argon2

Keyspace, Entropy, and Crack Time

Choosing a Password Hash

Identifiers (5)

UUIDs: random v4 and time-ordered v7

UUID versions explained: v1 through v8

Will UUIDs collide? Probability and the birthday bound

UUIDs as database keys: v4, v7, and index locality