Learn

Network and security concepts, explained clearly.

Practical explanations of the concepts behind the tools. Each article is written to build genuine understanding, not just to define a term.

The article index ↓

The vendor-neutral library, grouped by subject. Vendor-specific writing lives on the hubs.

293 articles

Vendor hubs →

One door per vendor: the tools, the articles, and the certifications that belong to each platform.

8 vendors

The Practice →

How the work is actually done, rather than how the technology works. Triage, escalation, evidence, handover, and the parts no runbook covers.

64 published

The Roles →

The positions this industry is made of, grouped by the path a product takes. Who makes it, moves it, sells it, deploys it, runs it, supports it, defends it and teaches it.

39 positions

Certification study guides →

Exam blueprints mapped objective by objective to the articles that teach them.

105 exam guides

Glossary →

The field's terms, acronyms, expressions, jargon, and lore - defined, sourced, and linked to the tools that compute them.

1242 terms

Study guides →

Curated reading paths and blueprint-mapped certification guides - every objective tied to the articles that teach it and the tools that exercise it.

13 reading paths105 exam guides1632 objectives mapped

Hoppa till

View

Certifikat och PKI (14)

Article	Topic	Summary
Anatomin hos ett X.509-certifikat	Certifikat och PKI	Vad som lever inuti ett TLS-certifikat, hur ASN.1/DER-byten är strukturerade, vad v3-tilläggen faktiskt styr, och varför att avkoda ett certifikat inte är samma sak som att lita på det.
PEM, DER och certifikatfilformaten	Certifikat och PKI	Varför samma certifikat kommer i så många filformer, vad PEM och DER faktiskt är, och vad .crt, .pem, .pfx och .p12 verkligen håller.
Certifikatsigneringsbegäranden och hur certifikat utfärdas	Certifikat och PKI	Vad en CSR innehåller, varför din privata nyckel aldrig lämnar din maskin, hur en CA validerar och utfärdar, och hur ACME automatiserar hela utbytet.
Hur certifikatvalidering faktiskt fungerar	Certifikat och PKI	Stegen en klient kör för att avgöra att ett certifikat är pålitligt: bygga kedjan, kontrollera signaturer och datum, matcha namnet och upprätthålla begränsningar.
Certifikatåterkallelse: CRL, OCSP och kortlivade certifikat	Certifikat och PKI	Varför ett certifikat ibland måste annulleras innan det går ut, varför de klassiska återkallelsesystemen fungerar dåligt, och varför industrin i stället krymper certifikatlivslängderna.
Authority Information Access: The OCSP and CA Issuers URLs	Certifikat och PKI	The AIA extension carries two kinds of pointer: where to ask whether a certificate is revoked (OCSP) and where to fetch the issuer's own certificate (CA Issuers). What each is for, why they are easy to confuse, and what the inspector shows.
OCSP Must-Staple: Closing the Soft-Fail Gap	Certifikat och PKI	Real-time OCSP checking has a fatal weakness: when the responder is unreachable, clients usually proceed anyway. OCSP stapling and the Must-Staple flag are the fix. What the TLS Feature extension declares, and the operational risk it carries.
ACME: how certificates issue and renew themselves	Certifikat och PKI	How the ACME protocol automates certificate issuance end to end: the account, the order, the three challenge types, the dns-01 record you publish, and the finalize-and-download step that produces the certificate.
The 47-day era: how TLS certificate lifetimes are shrinking	Certifikat och PKI	The CA/Browser Forum's SC-081v3 schedule takes maximum public TLS validity from 398 days down to 47 by 2029, in three steps. What the phases are, why 47, and what it does to renewal volume.
Certificate validity windows: notBefore, notAfter, and renewal lead time	Certifikat och PKI	How a certificate's lifetime is defined by two timestamps, how that length is measured against the cap, why validity is not the same as time remaining, and how to choose a renewal lead time.
Let's Encrypt: the free CA and its rate limits	Certifikat och PKI	What Let's Encrypt is, why its certificates are short-lived, and how its rate limits actually work: the per-registered-domain and per-account limits, the exact-set and authorization-failure limits, and why ARI renewals are exempt from all of them.
DCV and SII reuse: the validation cadence behind the renewal cadence	Certifikat och PKI	Issuing a certificate means proving domain control and, for OV/EV, organization identity. SC-081v3 shrinks how long those proofs can be reused — DCV to 10 days by 2029 — which reshapes renewal as much as validity does.
Renewing before expiry: lead time, ACME, and ARI	Certifikat och PKI	Why late renewal causes outages, how ACME automates issuance and renewal, how the ARI extension lets a CA steer the renewal window, and how to pick a lead time that leaves room to retry.
Public vs private PKI: which certificates SC-081v3 governs	Certifikat och PKI	The 47-day schedule binds publicly trusted TLS certificates only. What separates public from private PKI, why internal CAs are exempt, and how to read the planner's compliance verdict for an internal certificate.

Hashning och krypto (15)

Article	Topic	Summary
Hashning, kryptering och kodning: tre olika saker	Hashning och kryptoKodning och data	Tre operationer som ständigt förväxlas, rent åtskilda av två frågor: är den reversibel, och behöver den en nyckel?
Kryptografisk hashning: SHA-256 och SHA-2-familjen	Hashning och krypto	Vad en hashfunktion garanterar, egenskaperna som gör den kryptografisk, och varför en digest inte är kryptering.
Välja en hash: MD5, SHA-1, SHA-2, SHA-3 och BLAKE	Hashning och krypto	Vilka hashfunktioner som fortfarande är säkra, vilka som är knäckta, deras utdatastorlekar och hur man väljer rätt.
Kollisioner, förbildsmotstånd och födelsedagsgränsen	Hashning och krypto	De tre säkerhetsegenskaper en kryptografisk hash måste ha, varför kollisioner spelar roll och födelsedagsmatematiken som sätter den verkliga styrkan.
Lagra lösenord: bcrypt, scrypt och Argon2	Hashning och krypto	Varför en snabb hash som SHA-256 är fel verktyg för lösenord, och vad saltning och arbetsfaktorer faktiskt gör.
HMAC: nyckelförsedd hashning för meddelandeautentisering	Hashning och krypto	Varför en vanlig hash bevisar integritet men inte autenticitet, hur en hemlig nyckel åtgärdar det, och varför HMAC:s struktur spelar roll.
Varför HMAC, och inte hash(nyckel + meddelande)	Hashning och krypto	Längdförlängningsattacken som bryter naiv nyckelhashning, och den nästlade konstruktion HMAC använder för att besegra den.
Autentisera API-begäranden med HMAC	Hashning och krypto	Hur en delad hemlighet och en hash låter en server lita på en begäran den inte såg göras, och hur skydd mot återuppspelning passar in.
Verifiera en HMAC säkert: konstant tid och replay	Hashning och krypto	Varför att jämföra signaturer med == läcker en tidssidokanal, och varför en giltig signatur ensam inte stoppar en upprepad begäran.
Why Cryptographic Hashes Are One-Way	Hashning och krypto	A cryptographic hash maps any input to a fixed-size digest and is designed so that recovering the input from the digest is infeasible. That property, preimage resistance, is why you cannot decrypt a hash. The only ways to reverse one are to look it up or to guess-and-check, both of which are search, not inversion.
Brute Force vs Lookup Tables: Two Ways to Reverse a Hash	Hashning och krypto	Since a hash cannot be inverted, reversing one means searching, and there are two families. Precompute a giant table of input-to-hash pairs and look the hash up (what CrackStation does), or generate candidates on the fly and hash each until one matches (brute force). They trade storage for compute in opposite directions.
Why Salting Defeats Precomputed Tables	Hashning och krypto	A salt is a unique random value stored with each password hash and mixed in before hashing. It makes identical passwords hash differently, which destroys the economics of precomputed tables: an attacker would need a separate table for every salt. Salting is the specific defense that neutralizes lookup services and rainbow tables.
Slow KDFs: bcrypt, scrypt, and Argon2	Hashning och krypto	Salting defeats precomputation but not a targeted guess-and-check attack; a fast hash still lets an attacker try billions of candidates per second. Slow key derivation functions fix that by making each guess deliberately expensive and tunable, cutting an attacker's rate by many orders of magnitude. These are what you should store passwords with.
Keyspace, Entropy, and Crack Time	Hashning och krypto	Whether brute force can reverse a hash comes down to keyspace size versus the attacker's hashing rate. Keyspace grows exponentially with length and alphabet, so a few extra characters move a secret from cracked in seconds to infeasible for millennia. This is the arithmetic behind why length and randomness matter most.
Choosing a Password Hash	Hashning och krypto	Storing passwords safely is a solved problem: use a purpose-built, salted, slow password hash, not a raw digest. This is a short decision guide, from the algorithm to pick to the parameters to set and the mistakes to avoid, aligned with OWASP and NIST guidance.

Identifierare (5)

Article	Topic	Summary
UUID:er: slumpmässig v4 och tidsordnad v7	Identifierare	Hur en 128-bitars identifierare förblir unik utan en central myndighet, och varför v7 blir standard för databasnycklar.
UUID-versioner förklarade: v1 till v8	Identifierare	Hela UUID-familjen på ett ställe, från tid-och-MAC-v1 via slumpmässig v4 till tidsordnad v7, plus de namnbaserade versionerna och hur versions- och variantbitarna läses.
Kommer UUID:er att kollidera? Sannolikhet och födelsedagsgränsen	Identifierare	Hur många slumpbitar en UUID verkligen har, födelsedagsmatematiken för en kollision och när man vill ha deterministiska UUID:er.
UUID:er som databasnycklar: v4, v7 och indexlokalitet	Identifierare	Den verkliga avvägningen mellan UUID:er och autoinkrementerande heltal, och varför slumpmässiga v4-nycklar i tysthet skadar databasens prestanda.
ULID, KSUID, Snowflake och andra sorterbara ID:n	Identifierare	De populära alternativen till UUID:er för tidsordnade identifierare, hur var och en är byggd, och varför UUIDv7 nu täcker det mesta de uppfanns för.

Identitet och tokens (39)

Article	Topic	Summary
Anatomin hos en JSON Web Token	Identitet och tokens	De tre segmenten i en JWT, hur signaturen gör den pålitlig och varför att avkoda en token inte är samma sak som att verifiera den.
JWKS and Key Rotation: How Providers Publish Their Keys	Identitet och tokens	A JWKS is the public phone book of signing keys that an identity provider publishes so anyone can verify its tokens. Understanding the keys array, the kid that names each key, and why a provider keeps more than one key at a time is the foundation of token verification.
OpenID Connect: An Identity Layer on OAuth 2.0	Identitet och tokens	What OpenID Connect adds to OAuth 2.0, the ID token at the center of it, the relying party and provider roles, how the authorization code flow delivers an ID token, and why an ID token is just a JWT you can decode and read.
JWK Key Types: RSA, EC, OKP, and oct	Identitet och tokens	Every JSON Web Key declares a kty, and that one field decides which parameters the key carries. Four types cover almost everything you will meet: RSA, elliptic curve, the Edwards and Montgomery curves, and the symmetric octet sequence. The crucial split in all of them is public versus private.
JWT-signeringsalgoritmer: HMAC, RSA och ECDSA	Identitet och tokens	Varför en JWT:s alg-rubrik spelar roll, skillnaden mellan symmetrisk och asymmetrisk signering, och hur man väljer.
The ID Token Claims, and What a Relying Party Checks	Identitet och tokens	The claims inside an OIDC ID token: the required iss, sub, aud, exp, and iat; the nonce that stops replay; azp when there are multiple audiences; acr and amr for authentication strength; auth_time; and the at_hash and c_hash binding claims, with the validation a relying party performs on each.
JWT-säkerhetsfällor: alg:none, nyckelförväxling och saknade kontroller	Identitet och tokens	Den handfull misstag som förvandlar en JWT-verifierare till en förfalskningsmaskin, och den validering en korrekt verifierare måste utföra.
OIDC vs OAuth 2.0: Authentication vs Authorization	Identitet och tokens	Why OAuth 2.0 is about authorization and OpenID Connect is about authentication, the difference between an access token and an ID token, why using plain OAuth as a login mechanism is a known antipattern, and how to tell which token is which.
Verifying a JWT with a JWKS: From kid to Signature	Identitet och tokens	Verifying a signed token is a short, strict sequence: read the header, find the key whose kid matches in the provider's JWKS, confirm the algorithm, and check the signature. Each step has a classic pitfall, and skipping the strictness is how verification bypasses happen.
Åtkomsttoken, uppdateringstoken och ID-token	Identitet och tokens	Tre OAuth- och OpenID Connect-token som ständigt förväxlas, vad var och en faktiskt är till för, och varför att skicka fel token till fel plats är en verklig bugg.
JWK Parameters and Thumbprints	Identitet och tokens	A JWK is a JSON object describing one key, and its parameters say what the key is for and how to identify it. Beyond the key material, kid names it and an RFC 7638 thumbprint gives it a stable, computed identifier. This covers the common parameters and how a thumbprint is derived and used.
OIDC Discovery: The openid-configuration Document	Identitet och tokens	How the .well-known/openid-configuration document lets a relying party learn a provider's endpoints and capabilities automatically, what the issuer, jwks_uri, and signing-algorithm fields mean, why advertising the none algorithm is dangerous, and why PKCE S256 support matters.
JWT Algorithm Confusion Attacks	Identitet och tokens	Two classic JWT verification failures come from trusting the token's own algorithm header: accepting alg none, and being tricked into verifying an RS256 token as HS256 using the public key as the secret. Both are defeated by pinning the expected algorithm on the server instead of reading it from the token.
Publika vs konfidentiella klienter, och var PKCE passar in	Identitet och tokens	Huruvida en OAuth-klient kan hålla en hemlighet avgör hela dess säkerhetsmodell. Varför SPA:er och mobilappar är publika klienter, och varför PKCE nu rekommenderas för dem alla.
The OIDC Authorization Code Flow	Identitet och tokens	The authorization code flow is the recommended way an app gets an ID token: the user is redirected to the identity provider to log in, the app receives a short-lived code, and it exchanges that code at a back-channel token endpoint for the tokens. Keeping the token out of the browser is the whole point.
OAuth 2.0-auktoriseringskodflödet	Identitet och tokens	De fyra rollerna, omdirigerings-och-byte-dansen, och varför koden byts mot en token på bakkanalen.
PKCE: att säkra OAuth-auktoriseringskodflödet	Identitet och tokens	Avlyssningsattacken som PKCE besegrar, hur verifieraren och utmaningen passar ihop, och varför S256 är obligatoriskt.
OpenID Connect: identitet ovanpå OAuth 2.0	Identitet och tokens	Hur OIDC lägger till autentisering till OAuth:s auktorisering, vad ID-tokenet är och varför kodflödet med PKCE är den rekommenderade vägen.
How TOTP and HOTP one-time passwords work	Identitet och tokens	Both turn a shared secret into a short code that proves possession without sending the secret. HOTP counts events; TOTP counts time. The engine underneath is the same HMAC plus a truncation step.
Validating one-time passwords: drift, windows, and replay	Identitet och tokens	Generating a code is the easy half. Accepting one means tolerating clock drift, bounding the window, rejecting reuse, and throttling guesses, each a tradeoff between usability and security.
Provisioning Authenticators: otpauth URIs and QR Codes	Identitet och tokens	Before an authenticator app can generate codes, it needs the shared secret and the parameters that go with it. That is carried in an otpauth URI, usually shown as a QR code to scan. Knowing the URI's fields explains what the QR code actually contains and why the secret is in base32.
Installing PingFederate: Requirements, First Run, and the Setup Wizard	Identitet och tokens	What a PingFederate deployment needs before the ZIP is even extracted - a supported Java runtime, the 9999/9031 port plan, a dedicated service account - then the install itself on Windows or Linux, and exactly what the initial configuration wizard asks of you on first login: license, first administrator, and the base URL partners will trust.
Upgrading PingFederate: The Utility, the Merge, and the Cluster Order	Identitet och tokens	How PingFederate upgrades actually work: the Upgrade Utility that copies configuration from the old install into the new one, the release notes you read for every version crossed, the custom-logging merge everyone forgets, and the console-first order that keeps a cluster consistent.
The PingFederate Startup Files: Who Controls What	Identitet och tokens	A tour of the files that decide how a PingFederate server runs: the run.sh/run.bat launchers, run.properties for ports and the clustered role, jvm-memory.options for the heap, and log4j2.xml for what gets written where - plus the habit of knowing which file owns which behavior before you need it at 3 a.m.
Who Administers PingFederate: Native Accounts, Roles, and Console Login via LDAP	Identitet och tokens	The administrative access model: native accounts and the role set that divides power - User Admin, Admin, Expression Admin, Auditor, and the cryptographic role - plus how console authentication moves from native accounts to an LDAP directory through run.properties and ldap.properties, with directory groups mapped onto the same roles.
PingFederate Operational Hygiene: License, Notifications, and the Configuration Archive	Identitet och tokensCertifikat och PKI	Three habits that keep a PingFederate deployment boring in the best way: managing the license file and its expiry, wiring notification publishers so certificate and licensing events announce themselves, and treating the data.zip configuration archive - manual exports and the automatic snapshots - as the backup, migration, and undo mechanism it is.
The PingFederate Endpoints Map: Admin Port, Runtime Port, and What Lives Where	Identitet och tokens	Every PingFederate endpoint belongs to one of two families: administrative endpoints on the console port (the console app and the /pf-admin-api) or runtime endpoints on the engine port (/idp and /sp application endpoints, the /as OAuth authorization server, OIDC's userinfo and discovery, and the /pf/heartbeat.ping that load balancers watch). Knowing which port answers which path is half the troubleshooting.
PingFederate Data Stores: LDAP and JDBC, Defined Once, Used Everywhere	Identitet och tokens	Data stores are PingFederate's reusable connection definitions: an LDAP store with directory type, failover hosts, bind credentials, and LDAPS; a JDBC store with its connection URL, validation query, and the driver JAR that must be deployed before anything connects. Credential validators, attribute lookups, and provisioning all consume the same definitions - which is the whole point.
How Users Prove Who They Are: PCVs and the Five Adapters	Identitet och tokens	The PingFederate authentication toolkit the exam names: Password Credential Validators as the reusable password-checking layer, then the five adapters and the integration pattern each one embodies - HTML Form for interactive login, HTTP Basic for the 401 challenge, Kerberos for silent desktop SSO, OpenToken for integration-kit handoff, and Reference ID for the agentless back-channel.
The PingFederate Log Files: Which One Answers Which Question	Identitet och tokens	The cast of <pf_install>/pingfederate/log and what each member is for: server.log for the application, admin.log and admin-api.log for who changed what, transaction.log for runtime protocol summaries, audit.log for authentication and security events - plus the log4j2.xml levels that control verbosity and the habit of matching the question to the file.
PingFederate Authentication Policies: Trees, Selectors, and the Contract at the End	Identitet och tokens	How PingFederate decides who authenticates how: policy trees whose nodes are authentication sources and selectors, Fail and Success branches flowing top-down, reusable fragments for common sequences, and the Authentication Policy Contract at the end of every successful path - the normalization layer that makes everything downstream source-independent.
LDAP Fundamentals: The Directory Model Behind Identity Systems	Identitet och tokens	The Lightweight Directory Access Protocol from first principles: the tree of entries and their distinguished names, the bind operation that authenticates, searches with base, scope, and filter, the group memberships access decisions ride on, and the LDAPS transport - the working vocabulary every identity product assumes before its own documentation makes sense.
Kerberos and SPNEGO: How Silent Desktop SSO Actually Works	Identitet och tokens	The ticket machinery behind login-without-a-prompt: the KDC's two services, the TGT and the service ticket, why SPNs and keytabs exist, how SPNEGO carries a Kerberos ticket inside an HTTP Negotiate header, and the small list of things - clock skew, missing SPNs, browser trust - that break it in practice.
SCIM: The Standard That Provisions the Accounts SSO Signs In	Identitet och tokens	The System for Cross-domain Identity Management in one sitting: why provisioning needed a standard, the RFC 7643 schemas for Users and Groups, the RFC 7644 REST protocol - create, filter, PATCH, deactivate - and where SCIM sits next to SAML and OIDC in an identity architecture: they authenticate the account, SCIM is how the account got there.
The PingAccess Policy Model: Gateway, Agent, and the Rule Stack	Identitet och tokens	How PingAccess decides who reaches what: the two deployment shapes (gateway routing to sites, agents speaking PAAP to a policy server), the application-and-resource partition, rules composed into rule sets and rule set groups, the fixed evaluation order, and the token mediation that keeps legacy backends in the game.
The PingDirectory Platform: Store, Aggregate, Sync, Delegate	Identitet och tokens	The four-piece identity data platform: the PingDirectory server as a high-performance LDAP and native SCIM 2.0 REST store, PingDirectoryProxy as the LDAPv3 gateway and virtual directory, PingDataSync as the real-time bidirectional synchronization engine across heterogeneous stores, and Delegated Admin as the controlled self-service surface - plus the operational grammar of cn=config, server groups, and zero-downtime moves.
PingOne: The Platform Behind the Product Names	Identitet och tokens	What PingOne actually is - a multi-tenant identity-as-a-service platform organized around environments inside an organization - and how its named services (SSO, MFA, Protect, Verify, Authorize, DaVinci) divide the work, how it relates to the self-managed PingFederate/PingAccess/PingDirectory stack and to Advanced Identity Cloud, and why the same word appears in so many product names.
PingOne DaVinci: Identity Orchestration as a Canvas	Identitet och tokens	What identity orchestration is and why it became its own product category: DaVinci's drag-and-drop flows, the connector catalog that turns vendors into nodes, server-driven orchestration that lets journeys change without app releases, the Singular Key origin story, and how DaVinci coexists with the ForgeRock-heritage journeys and trees under one SDK family.
From Sun to Ping: The ForgeRock Lineage Decoded	Identitet och tokens	Why the Ping catalog has two of everything: the family tree from Sun's OpenSSO, OpenDS, and OpenIDM through ForgeRock's OpenAM, OpenDJ, OpenIDM, and OpenIG to today's PingAM, PingDS, PingIDM, PingGateway, and PingOne Advanced Identity Cloud - the 2023 merger that created the parallel stacks, which product answers to which name, and how to read any Ping architecture diagram without ambiguity.

Kodning och data (42)

Article	Topic	Summary
Byte, kodpunkter och UTF-8	Kodning och data	Skillnaden mellan ett tecken och en byte, varför Unicode och UTF-8 finns, och vad det har med Base64 att göra.
JSON vs YAML: What Converts Cleanly and What Does Not	Kodning och data	YAML was designed so that every JSON document is also valid YAML, which is why conversion between them usually just works. The interesting part is the edges: comments, anchors, multiple documents, and YAML-only types that have no JSON equivalent.
The Anatomy of a URL	Kodning och dataWeb & HTTP	Every URL is built from the same handful of parts defined by RFC 3986: scheme, authority (userinfo, host, port), path, query, and fragment. What each part means, how a parser tells them apart, and where the boundaries actually fall.
The JSON Grammar: Six Types and a Few Strict Rules	Kodning och data	JSON is smaller than it looks. The whole format is six value types and a handful of structural characters, governed by rules that are stricter than most people remember: no comments, no trailing commas, and keys that must be quoted strings.
What Unix Time Actually Is	Kodning och data	Unix time is a single integer: the number of seconds since 1970-01-01T00:00:00Z, the epoch. It is time-zone independent, compact, and sortable, which is why it underpins almost every system clock, log line, and API timestamp. Converting it to a calendar date is pure arithmetic.
Base64 och Base64URL, förklarat	Kodning och data	Hur binärdata blir överföringssäker text, varför utfyllnad finns och vad som ändras i den URL-säkra varianten.
JSON Numbers and the Precision Trap	Kodning och data	JSON puts no limit on the size or precision of a number, but most parsers quietly convert every number to a 64-bit float. That mismatch silently corrupts large integers and exact decimals, which is why a formatter should preserve the original digits.
Query Strings: Parameters, Plus Signs, and Repeated Keys	Kodning och dataWeb & HTTP	The part of a URL after the question mark looks simple but hides real ambiguity: how parameters are separated, why a plus sign sometimes means a space, how repeated keys behave, and why there is no single governing standard.
Seconds, Milliseconds, Microseconds, Nanoseconds: Telling Epoch Units Apart	Kodning och data	The same instant can be written as 1700000000, 1700000000000, or larger, depending on whether the timestamp counts seconds, milliseconds, microseconds, or nanoseconds. Mixing them up is a classic bug. You can almost always tell which is which from the number's magnitude.
YAML Type Coercion and the Norway Problem	Kodning och data	YAML guesses the type of every unquoted scalar, and its guesses are surprising: the country code NO becomes false, a version like 1.0 becomes a number, and a zero-padded code loses its zeros. Knowing the rule is the key to safe conversion.
Base64URL och det URL-säkra alfabetet	Kodning och data	Varför JWT:er och PKCE använder ett annat Base64-alfabet, de två tecken som ändras och vad som händer med utfyllnaden.
Duplicate Keys in JSON: Legal, Dangerous, and Worth Catching	Kodning och data	JSON syntax allows the same key to appear more than once in an object, but the specification does not say what that means. Different parsers resolve it differently, which makes duplicate keys a quiet source of bugs and even security issues.
JSON and YAML in Practice: APIs, Declarations, and Orchestration	Kodning och data	The split is not random: APIs and machine-to-machine declarations tend to be JSON, while human-authored orchestration and pipeline files tend to be YAML. Understanding why each domain chose what it did explains when converting between them is useful.
The Year 2038 Problem	Kodning och data	A signed 32-bit integer can count seconds only up to 2147483647, which falls on 2038-01-19T03:14:07Z. One second later it overflows and wraps to a negative number, throwing affected systems back to 1901. It is Y2K's quieter successor, and the fix is a wider integer.
URL Encoding and Internationalized Hosts	Kodning och dataWeb & HTTP	URLs are restricted to a small set of ASCII characters, so everything else is encoded. Percent-encoding handles paths and queries; punycode handles non-ASCII host names. How both work, and why internationalized hosts are a phishing concern.
ISO 8601, RFC 3339, and the HTTP Date	Kodning och data	Once a Unix timestamp is turned back into a human date, it gets written in one of a few standard text formats. ISO 8601 is the broad standard, RFC 3339 is its strict internet profile, and the HTTP date is the odd one out. Knowing the difference saves a lot of parsing grief.
JSON String Escapes and Unicode	Kodning och data	Inside a JSON string, a few characters must be written as escapes, and any character at all can be written as \uXXXX. The rules are small but strict, and the one that catches people is how characters beyond the basic plane, like emoji, need a surrogate pair.
Var Base64 dyker upp: data-URI:er, MIME, PEM och Basic auth	Kodning och data	De verkliga ställen där binärt slås in i text, storlekskostnaden för det och varför Base64 i en autentiseringsrubrik inte är kryptering.
YAML Anchors, Aliases, and Merge Keys	Kodning och data	YAML can define a value once and reuse it with an anchor and alias, and merge one mapping into another with a merge key. None of this exists in JSON, so converting expands and duplicates it. This covers the syntax, what happens on conversion, and the denial-of-service trap they enable.
Base32, förklarat	Kodning och data	Varför Base32 byter storlek mot ett entydigt, skiftlägesokänsligt alfabet, hur dess gruppering om 5 bitar fungerar, och var det dyker upp (TOTP-hemligheter, onion-adresser, DNS).
Trailing Commas, Comments, and the JSON5 Family	Kodning och data	Strict JSON has no comments and no trailing commas, which surprises people whose editor accepts both. The reason is that JSON is a minimal interchange format, and the tolerant variants (JSONC, JSON5) are separate things. Knowing which is which avoids config files that break in another tool.
Why Unix Time Ignores Leap Seconds	Kodning och data	UTC occasionally inserts a leap second to stay aligned with the Earth's rotation, but Unix time pretends every day is exactly 86,400 seconds long. That deliberate simplification means a Unix timestamp is not a true count of elapsed seconds since the epoch — and it is the right trade-off for civil time.
YAML Block Scalars and Multiline Strings	Kodning och data	YAML has two ways to write a multiline string, and they treat newlines differently: literal style keeps them, folded style turns them into spaces. Chomping indicators then decide what happens to the trailing newline. Getting these wrong is why an embedded script or certificate comes out subtly mangled.
Formatting, Minifying, and Canonical JSON	Kodning och data	Whitespace does not change what JSON means, so pretty-printed and minified JSON are the same data. But when JSON is signed or hashed, the exact bytes matter, and that is where canonical JSON comes in: a deterministic way to serialize the same data to exactly the same string every time.
Hexadecimal kodning (Base16), förklarad	Kodning och data	Hur hexadecimal representerar varje byte med två tecken, varför det är standardsättet att skriva ut rådata-byte, och hur det förhåller sig till Base64 och Base32.
Relative URLs and How They Resolve	Kodning och dataWeb & HTTP	A relative URL leaves out the scheme and host and is completed against a base URL. The rules for how a browser fills in the rest, and how ./ and ../ and a leading slash change the result, explain a lot of broken links and a few security surprises.
Roman Numerals: How the System Actually Works	Kodning och data	Seven symbols, no zero, and one subtraction rule that arrived a thousand years after Rome. Why IIII is on your watch and IV is in your textbook, what IL breaks, and why the classical system runs out of road at 3999.
Deceptive URLs: Reading Past the Tricks	Kodning och dataWeb & HTTP	URLs are a favorite tool for phishing because the real destination is easy to disguise. The userinfo trick, redirect parameters, and look-alike characters all make a hostile link look friendly. This shows the common disguises and the one reliable habit for finding the real host.
Procentkodning (URL-kodning), förklarad	Kodning och data	Varför URL:er escapar vissa tecken som %XX, vilka tecken som är säkra att lämna som de är, och hur procentkodning skiljer sig från Base64.
Time Arithmetic and Time Zones: Exact Durations, Honest Meetings	Kodning och data	Why 'plus one month' has no exact answer, what ISO 8601 durations actually promise, and how one UTC instant becomes four different wall clocks. The DST trap, the day-shift trap, and the case for planning meetings with a real date.
Base16, Base32, Base64 och procentkodning jämförda	Kodning och data	En jämförelse sida vid sida av de fyra textkodningarna: deras alfabet, deras storlekspåslag, deras läsbarhet, och när man tar till var och en.
How text diff works	Kodning och dataText & utilities	A diff finds the smallest set of insertions and deletions that turns one text into another. Underneath is the longest common subsequence: the lines both versions share, in order, form the unchanged backbone, and everything else is an add or a remove.
Reading a diff	Kodning och dataText & utilities	How to read a line-by-line diff: unchanged, added, and removed lines, the plus and minus markers, both sides' line numbers, inline word highlighting, and what ignore-whitespace and ignore-case actually change. Plus the things a diff cannot tell you.
Word and Character Level Diffs	Kodning och dataText & utilities	A line diff marks a whole line as changed even when a single character moved. Word-level and character-level diffs highlight the exact part of the line that changed, which is far easier to read for prose, long lines, and small edits. This covers the difference and when each is the right lens.
Three-Way Diffs and Merge Conflicts	Kodning och dataText & utilities	A normal diff compares two versions and cannot tell which one changed. A three-way diff adds a common ancestor, which is what makes automatic merging possible and what produces the <<<<<<< ======= >>>>>>> conflict markers. This explains the third input and how to read and resolve a conflict.
Minimal Edits: Why a Diff Can Look Wrong	Kodning och dataText & utilities	A diff shows the smallest set of insertions and deletions that turns one text into the other. Because the smallest set is not unique and the algorithm has to choose, a diff can align lines in ways that look counterintuitive, blaming the wrong block or splitting a moved section. Knowing this makes odd diffs readable.
Reading XML Structure	Kodning och dataSecurity & WAF	XML is a tree of elements built from a handful of parts: an optional declaration, elements with attributes, text, and a few special constructs. Once you can name each part and see how they nest, reading an unfamiliar document top to bottom becomes routine rather than a guessing game.
XML Namespaces Explained	Kodning och dataSecurity & WAF	When two XML vocabularies use the same element name for different things, namespaces keep them apart by binding a prefix to a unique URI. The prefix is just a local shorthand; the URI is the real identity. Understanding that split resolves most namespace confusion.
Well-Formed vs Valid XML	Kodning och dataSecurity & WAF	Well-formedness is XML's baseline: one root, properly nested and matched tags, quoted attributes, and escaped specials. Validity is a stronger, separate claim that a document also follows a schema. A parser rejects ill-formed XML outright, which is why these rules come first.
CDATA, Comments, and Processing Instructions	Kodning och dataSecurity & WAF	Not everything in XML is an element. CDATA sections hold raw text that would otherwise need escaping, comments annotate without affecting content, and processing instructions carry directions for an application. Recognizing these three keeps them from looking like mysterious noise.
HTML Forms and Request Encoding: How the Web Ships Your Input	Kodning och dataWeb & HTTP	A form is a contract between a page and a server: which fields, which verb, which wire format. GET puts the answers in the URL; POST puts them in the body; and enctype picks the body's dialect - urlencoded's key=value chains, multipart's boundary-delimited parts built for files. What each choice means for logs, caches, size limits, and debugging, plus the fetch-era footnote: FormData kept the formats alive after forms stopped being the only sender.
URI, URL, URN: What's Actually the Difference?	Kodning och dataWeb & HTTP	The three acronyms everyone uses interchangeably encode one clean idea: identify vs locate vs name. URI is the umbrella - any identifier in the standard grammar; URL is the identifier that also tells you where and how to fetch; URN was the scheme for pure, location-free names (urn:isbn:...). Why the W3C itself declared the classical trichotomy obsolete, what 'URI' means in specs vs 'URL' in conversation, and the naming lesson this site keeps collecting.

Nätverk (105)

Article	Topic	Summary
Hur IPv4-adresser fungerar	Nätverk	De 32 bitarna bakom varje punktquad-adress, och vad privata, loopback- och specialintervall betyder.
The Syslog PRI: One Number, Two Meanings	Nätverk	Every syslog message starts with a PRI, a number in angle brackets that packs a facility and a severity into a single value. The formula is small and the arithmetic is easy once you have seen it: PRI equals facility times eight plus severity.
Grunderna i subnätsindelning	Nätverk	Hur man delar upp ett nätverk i mindre subnät, och varför att låna värdbitar är hela tricket.
Syslog Facilities and Severities, Explained	Nätverk	Syslog defines 24 facilities and 8 severities. The severities are a clean urgency scale from emergency down to debug; the facilities are a mix of genuinely useful categories and historical Unix leftovers, plus eight local slots that network devices lean on heavily.
CIDR-notation förklarad	Nätverk	Vad snedstrecket i 192.168.1.0/24 faktiskt betyder, och hur en prefixlängd definierar ett block av IP-adresser.
Syslog on Network Devices: Which Facility Does What	Nätverk	Firewalls, load balancers, and switches almost all log to the local facilities, but each vendor picks a different default. Knowing that FortiGate defaults to local7, Cisco ASA to local4, and F5 BIG-IP to local0 turns a wall of PRI numbers into a map of which box said what.
Syslog Message Formats: RFC 3164 vs RFC 5424	Nätverk	The PRI is the same everywhere, but what follows it is not. Legacy BSD syslog (RFC 3164) has a loose, year-less format, while the modern format (RFC 5424) is precise and structured. Knowing which one you are looking at explains missing timestamps, ambiguous fields, and why parsers disagree.
VLSM: dela ett block i ojämna subnät	Nätverk	Hur man skär ett adressblock i subnät av olika storlek utan att slösa utrymme, och störst-först-regeln som håller allt prydligt.
En VLSM-tilldelning, löst från början till slut	Nätverk	En fullständig tilldelning av subnät med variabel längd för ett realistiskt nätverk: dimensionera varje segment, sortera från störst till minst, tilldela de verkliga adresserna och bokföra det utrymme som blir kvar.
How Syslog Travels: UDP, TCP, and TLS	Nätverk	Syslog can ride over plain UDP, over TCP, or over TLS, and the choice decides whether messages can be silently lost, reordered, or read in transit. This covers the three transports, the ports involved, and why anything you rely on for audit should not be sent over UDP.
Supernätning och ruttaggregering	Nätverk	Hur sammanhängande prefix slås samman till ett kortare, justeringsregeln som avgör om två block kan smälta ihop, och skillnaden mellan exakt aggregering och ett enda supernät som täcker dem.
The First Hour: Hypothesis-Driven Fault Isolation	NätverkOperations & Fieldcraft	The difference between a two-hour incident and a two-day one is usually decided in the first hour, and it is rarely decided by tools. It is decided by method: aligning onset with change, isolating by scope, reading layer signatures, and treating every explanation as a hypothesis that evidence must support or weaken before anyone acts on it.
Change Windows That Do Not Become Incidents	NätverkOperations & Fieldcraft	Most self-inflicted outages are changes that went wrong with no clean way back. The difference between a change and an incident is rarely the change itself; it is the runbook around it - what you verified before, how you sequenced it, what would make you stop, and whether the way back was written down and tested before you needed it.
Ruttsammanfattning	Nätverk	Varför en enda sammanfattande rutt kan ersätta många specifika, den sammanhängande och justerade tilldelningen den beror på, och risken för svart hål när man sammanfattar ett intervall man inte äger helt.
Root Cause Is a Verb, Not a Noun	NätverkOperations & Fieldcraft	The phrase root cause invites a single villain and a tidy ending. Real incidents rarely have one; they have contributing factors, and the honest work is structuring the candidates and the evidence that would confirm or rule out each - not naming a culprit before the evidence is in.
Subnätsöverlapp och -luckor	Nätverk	Vad det betyder att två prefix överlappar eller att det ena innehåller det andra, varför longest-prefix-match gör vissa överlapp avsiktliga, och hur man hittar de otilldelade luckorna i en adressplan.
Blast-Radius Thinking Before You Change Anything	NätverkOperations & Fieldcraft	Before a change, the question is not only will this work but if it goes wrong, how far does the damage reach. Blast radius is the shape of that reach - target, neighbours, dependents, people - and thinking about it in tiers is how you decide what to contain before you touch anything.
Privat IPv4-adressutrymme och RFC 1918	Nätverk	De tre privata intervallen, varför de inte är dirigerbara på internet och de andra specialblock som CIDR-verktyget flaggar.
Att förstå IPv6-adressering	Nätverk	Hur en 128-bitars IPv6-adress är strukturerad och skriven, reglerna för att komprimera den kanoniskt, vad adresstyperna och omfattningarna betyder, och hur gränssnittsidentifierare och omvänd DNS fungerar.
TAC Cases That Get Triaged Fast	NätverkOperations & Fieldcraft	The slowest support cases are rarely the hardest problems; they are the ones that opened without the diagnostic the vendor needs. A case that arrives complete - clear problem, exact error, the diagnostic bundle, the impact - skips the round trips and starts with an engineer actually working it.
Hur IPv6-värdar får adresser: SLAAC och DHCPv6	Nätverk	Hur en IPv6-värd konfigurerar sig från link-local och uppåt, vad router advertisements beslutar, och skillnaden mellan SLAAC, integritetsadresser, och DHCPv6.
Capture Points Before Packets	NätverkOperations & Fieldcraft	The instinct under pressure is to start tcpdump somewhere convenient and stare at the flood. The senior habit is the opposite: decide where to observe, in what order, and what each observation would mean - before a single packet is collected. Evidence is designed, not fished for.
IPv6-subnätsindelning och /64-gränsen	Nätverk	Varför IPv6-subnätsindelning handlar om struktur snarare än knapphet, varför ett enskilt subnät nästan alltid är ett /64, och hur prefixdelegering delar ut adressutrymme.
Public suffixes and the registered domain (eTLD+1)	NätverkCertifikat och PKI	What a public suffix (eTLD) and a registered domain (eTLD+1) are, why you cannot compute them by taking the last two labels, how the Public Suffix List algorithm resolves them, and where the boundary matters: certificate rate limits, cookies, and same-site.
Grannupptäckt: hur IPv6 ersätter ARP	Nätverk	Hur IPv6 hittar grannar på en länk med ICMPv6 och multicast i stället för broadcast-ARP, de fem grannupptäcktsmeddelandena, och varför broadcast är borta.
Map the Path Before You Troubleshoot	NätverkOperations & Fieldcraft	The most expensive troubleshooting sessions share one flaw: nobody actually knew the path. The senior habit is refusing to reason about a failure until the chain is modeled - resolution included, return leg separate, every rewrite and TLS boundary named, and every unknown left visibly unknown.
Att köra IPv6 och IPv4 tillsammans: dual-stack och översättning	Nätverk	Hur internet överbryggar två inkompatibla adressfamiljer: dual-stack, Happy Eyeballs, NAT64, och de IPv4-inbäddade adresser som får det att fungera.
Baselines Before You Need Them	NätverkOperations & Fieldcraft	Every comparison is only as honest as its weaker side. The discipline is captured baselines before changes, declared confidence instead of remembered health, observation windows that let convergence speak, churn literacy for the counters that always move - and never calling a change successful on green components alone.
What Is an OUI, and How MAC Addresses Are Assigned	Nätverk	How a MAC address is structured, what the OUI (the manufacturer prefix) is and who hands it out, the difference between universally and locally administered addresses, and why a randomized Wi-Fi MAC has no vendor at all.
Fabric Connect and SPBM: Why VOSS Retires Spanning Tree	Nätverk	What Extreme's Fabric Connect actually is - Shortest Path Bridging MAC (SPBM, IEEE 802.1aq) with an IS-IS control plane and a MAC-in-MAC data plane - and why collapsing the core to a single link-state protocol replaces spanning tree and the usual overlay stack.
Reading dig Output From Top to Bottom	Nätverk	A dig answer has a fixed shape: a version line, the header, the flags line, the OPT pseudo-section, the four sections, and the query stats. Once you know what each block is, you can read any response at a glance and spot the one line that explains a resolution problem.
The DNS Header: Opcode, Status, and Flags	Nätverk	The header line and the flags line hold the message-level facts: what kind of query this is, whether it succeeded, and seven single-bit flags (qr, aa, tc, rd, ra, ad, cd) that tell you who answered and how. Reading them correctly is the difference between a two-minute diagnosis and an hour of guessing.
The I-SID: How VOSS Replaces VLAN Stretching	Nätverk	Why Extreme's Fabric Connect provisions services at the edge instead of trunking VLANs hop by hop, what the 24-bit I-SID is, and how Layer 2 VSN, Layer 3 VSN, and IP Shortcuts all ride the same mechanism over an SPBM MAC-in-MAC core.
IS-IS, Nicknames, and B-MACs: The VOSS Control Plane	Nätverk	How SPBM uses IS-IS as its single link-state control plane on fabric links only, what a 20-bit node nickname is and why it must be unique, and how the system-id / backbone MAC drives MAC-in-MAC forwarding.
Reading the Records in a dig Answer	Nätverk	Every record in a dig section is five columns: name, TTL, class, type, and rdata. This walks the columns and then the rdata of the record types you actually meet, from A and CNAME to MX, SOA, SRV, and CAA, so a wall of records reads as plain facts.
EDNS and the OPT Pseudo-Section	Nätverk	The OPT pseudo-section is not a record and not something you queried: it is EDNS(0) metadata that dig surfaces near the top of an answer. It carries the UDP payload size, the DO flag that requests DNSSEC, and options like COOKIE, and it quietly explains a whole class of resolution failures.
Fabric Attach: Auto-Provisioning the Edge (Where VOSS Meets EXOS)	Nätverk	How Fabric Attach lets an edge device signal the service it needs so the fabric provisions the I-SID automatically, the FA Server / Proxy / Client roles, how it rides LLDP (Link Layer Discovery Protocol), and how an EXOS switch attaches to a VOSS fabric without running SPBM itself.
DNSSEC Records in dig Output	Nätverk	Add +dnssec and a dig answer grows a new family of records: RRSIG, DNSKEY, DS, and the NSEC or NSEC3 denial records. This explains what each one is, how they chain from the root down to a zone, and what the ad flag really certifies.
VOSS vs EXOS: Two Extreme Operating Systems	Nätverk	Extreme ships universal hardware that boots either EXOS or VOSS (Fabric Engine). This is what actually differs - a traditional-Ethernet OS with an intuitive CLI versus a fabric-native OS built on SPBM - and the three boundaries at which they interconnect.
Reading nslookup Output	Nätverk	nslookup prints a Server / Address header for the resolver it used, an optional Non-authoritative answer marker, and then the answer in a per-type prose format. Knowing that shape lets you read any result quickly and see at a glance whether it succeeded, where it came from, and what it means.
SMLT and vIST: Dual-Homing a Fabric Edge	Nätverk	How Split MultiLink Trunking dual-homes an edge device to a pair of switches with active-active links and no spanning tree, how virtual IST runs the inter-switch trunk through the SPBM fabric itself, and the smlt-peer-system-id and smlt-virtual-bmac that make the cluster one logical node.
nslookup vs dig: Which to Use	Nätverk	nslookup and dig both query DNS, but nslookup is terser and hides the header flags and TTLs that dig shows in full. This maps one output onto the other and gives a simple rule for which to reach for.
How nslookup Prints Each Record Type	Nätverk	Instead of dig's fixed columns, nslookup labels each record in prose: mail exchanger =, canonical name =, nameserver =, and a multi-line block for SOA. A short guide to reading each type's line.
Authoritative vs Non-Authoritative Answers	Nätverk	The Non-authoritative answer marker in nslookup means the result came from a resolver's cache, not from a server that actually holds the zone. This explains the difference, why it is usually fine, and how to get an authoritative answer when you need one.
nslookup Errors and What They Mean	Nätverk	When a lookup fails, nslookup prints a line like ** server can't find NAME: CODE. The code is the whole diagnosis. This covers NXDOMAIN, SERVFAIL, REFUSED, and timeouts, what each one tells you, and the first thing to check for each.
Reverse DNS Lookups with nslookup	Nätverk	Reverse DNS maps an IP address back to a name through PTR records that live under in-addr.arpa for IPv4 and ip6.arpa for IPv6. nslookup does this automatically when you hand it an address. This covers how the special reverse name is built, why mail servers care, and why the forward and reverse can legitimately disagree.
nslookup Interactive Mode	Nätverk	Run nslookup with no arguments and it drops into an interactive prompt where you can switch resolvers, change the record type, turn on debug output, and look up many names in one session. This covers the handful of commands worth knowing and when interactive beats a one-shot query.
dig Query Options and Output Control	Nätverk	dig's real power is its options: choosing the server to ask, the record type, and exactly how much of the answer to print. This covers the handful you will actually use every day, from @server and -t to +short and the +noall +answer combination that trims dig down to just the records.
Following Delegation with dig +trace	Nätverk	dig +trace resolves a name the way the internet actually does it: starting at the root, following the delegation to the TLD, and then to the domain's own authoritative servers, printing each hop. It is the single best way to see where resolution breaks and to understand how DNS is stitched together.
Reading a curl Command	NätverkWeb & HTTP	A curl command is a shell command: the word curl, a set of options, and a URL. Reading it means seeing how the shell splits the line first (quotes, backslashes, line continuations) and then how curl reads short, long, and clustered flags.
curl Data Flags and the Content-Type Trap	NätverkWeb & HTTP	curl has several ways to attach a body, and they differ in encoding and default Content-Type. The big surprise is that -d defaults to form encoding, not JSON, so a JSON body can be mislabeled and rejected.
Translating curl to fetch()	NätverkWeb & HTTP	The browser fetch API and curl describe the same request differently. Method, headers, and body map across cleanly, but a couple of differences (implicit form Content-Type, cookies, and TLS verification) need care.
Headers, Authentication, and Cookies in curl	NätverkWeb & HTTP	Headers, auth, and cookies are how a request identifies and authorizes itself. -H adds headers, -u is HTTP Basic, a bearer token is just a header, and -b/-c handle cookies. All of them are sensitive.
How curl Infers the HTTP Method	NätverkWeb & HTTP	curl does not always need -X to choose a method. Body data implies POST, -I implies HEAD, -G forces GET, and an explicit -X always wins. Knowing the rules tells you at a glance what a request will do.
curl Flags That Change Security Posture	NätverkWeb & HTTP	A few curl flags change how safe a request is: -k disables TLS verification, http sends everything in clear text, and credentials in the URL can leak. None make a request malicious, but each is worth reading before you run or share a command.
The TCP Proxy: What a Layer 4 Middlebox Does and Does Not See	NätverkWeb & HTTP	A TCP proxy terminates the client's TCP connection and opens a separate one to the server, splicing two independent flows together at Layer 4. It rewrites addresses and ports, can pool and reuse connections, and sees nothing of the application payload above the transport header. This explains full-proxy versus packet-forwarding, why the source IP disappears, and how the Proxy Protocol puts it back.
HTTP Proxies: Forward vs Reverse, Explicit vs Transparent	NätverkWeb & HTTP	An HTTP proxy parses requests at Layer 7, so it can route by URL, rewrite headers, and enforce policy on content a TCP proxy cannot see. Two axes describe every deployment: forward vs reverse (which side it works for) and explicit vs transparent (whether the client knows it is there). This covers the CONNECT method, X-Forwarded-For and Via, and where each combination is used.
The 27 Protocols curl Speaks	NätverkWeb & HTTP	curl is known as an HTTP tool, but the current tool speaks 27 URL schemes: file transfer over FTP, SFTP and SMB, mail over SMTP, POP3 and IMAP, MQTT publish-subscribe, LDAP lookups, and relics like Gopher, DICT and Telnet. Knowing the map, and which schemes start in cleartext, changes how you use it.
HTTP/0.9 vs 1.0 vs 1.1 vs 2 vs 3: Five Versions of the Web's Protocol	NätverkWeb & HTTP	From a one-line GET that could only fetch HTML to a multiplexed protocol riding QUIC: what each HTTP version added, why it was needed, and which RFC defines it today - including the 2022 reorganization that split HTTP semantics (RFC 9110) from the per-version wire syntax.
AltaVista: built to break a processor, and lost by becoming a portal	Nätverk	AltaVista started as a benchmark. A researcher wanted a workload chaotic enough to stress DEC's new Alpha chips, so he pointed a crawler at the entire web. The result led search for years and then was dismantled by its own owners, which makes it the clearest case study in the industry of losing a market you already have.
GPON: How One Fiber Serves a Whole Neighborhood	Nätverk	A Gigabit Passive Optical Network runs one strand of glass from the exchange, splits it with unpowered prisms, and shares it among dozens of homes. How the light is divided, why upstream needs a schedule, and where the decibel budget goes.
Jumbo frames: when 1500 bytes stops being enough	Nätverk	Why Ethernet settled on 1500 bytes, what 9000-byte jumbo frames actually buy, where they shine, and how an MTU mismatch turns into a silent black hole.
HTTP QUERY: the read that finally carries a body	NätverkWeb & HTTP	RFC 10008 (June 2026) gave HTTP its first new method since 2010: QUERY is safe, idempotent, and cacheable like GET, but carries a request body like POST. What it fixes, how its caching and discovery work, why 'safe' is not 'harmless', and what every layer of infrastructure must check before QUERY traffic arrives.
The OSI Model in Practice: Mapping Real Traffic to Seven Layers	Nätverk	The Open Systems Interconnection model earns its place not as trivia but as a shared address system for problems: a MAC address is Layer 2, an IP address Layer 3, a TCP or UDP port Layer 4, and the application on top. How to map real artifacts to layers, where the model bends against TCP/IP reality, and why troubleshooting conversations go faster when everyone points at the same floor.
Switch, Router, Firewall: Who Does What on the Path	Nätverk	Three device roles carry most of every network diagram: switches forward frames inside a Layer 2 domain, routers move packets between networks, and firewalls decide what is allowed to pass. The function and purpose of each, how an application delivery controller relates to all three, and how to read a network diagram without getting lost.
ARP and MAC Addresses: How IP Finds Ethernet	Nätverk	Every packet on a local network is delivered by MAC address, and ARP is the directory service that maps an IP to one. The one-to-one mapping, reading ARP output to prove resolution worked, gratuitous ARP, and MAC masquerading - the failover trick that makes an address move without the switches noticing.
Routing Tables and the Default Gateway: How a Packet Picks Its Next Hop	Nätverk	Why a route is needed at all, what a hop is, and the longest-prefix-match rule that decides which table entry wins - worked through the way the retired fundamentals exam asked: given a destination and a routing table, identify the route to be used. Plus the default route, the entry that answers when nothing else does.
NAT Explained: Source, Destination, and Why the Internet Still Works	Nätverk	Network Address Translation rewrites addresses in flight - source NAT lets a thousand private hosts share one public address, destination NAT publishes an inside service on an outside address, and the translation table is what makes the return traffic find its way home. The function and purpose, the flavors, and the troubleshooting consequences of each.
DHCP: the Lease Lifecycle Behind Automatic Addressing	Nätverk	The Dynamic Host Configuration Protocol hands out addresses, gateways, and resolvers so hosts arrive configured instead of blank. The discover-offer-request-acknowledge exchange, what a lease means and how renewal works, relays that carry requests across subnets, and the failure signatures - including the self-assigned address that says no server ever answered.
The TCP Connection Lifecycle: Handshake, Teardown, and Why Connections Fail	Nätverk	Every TCP conversation has three acts: the SYN handshake that creates it, the data flow that justifies it, and the FIN or RST that ends it. The difference between polite close and abort, the possible reasons a connection terminates, and the short list of causes when one fails to establish at all - the literacy behind every capture you will ever read.
VPN Fundamentals: What Tunnels Protect, and What They Don't	Nätverk	A virtual private network wraps traffic in an encrypted tunnel so it crosses untrusted networks as if it never left home. The rationale - privacy, encryption, and the limits of anonymity - the valid uses from site-to-site links to remote access, and the honest boundaries: what a tunnel genuinely protects, and the claims it cannot keep.
The Last Mile: From POTS to Always-On	Nätverk	The story of residential connectivity is the story of one stubborn stretch of infrastructure - the last mile - being reinvented four times: the plain old telephone service that carried voices, the ADSL trick that made the same copper pair carry data full-time, the cable plant's DOCSIS second life, and fiber to the home. Why 1999's 256 kbps mattered more than its speed, what always-on actually changed, and how one house can end up served by copper's ghost, coax, glass, and the sky at once.
Pagers and Paging Networks: Reachable Before Real-Time	Nätverk	Before the phone in your pocket, there was the bip on your belt: a one-way radio receiver on a simulcast broadcast network, fed - in its classic form - by a human operator who took your caller's words and typed them into the air. How paging networks actually worked, from two-tone beeps to POCSAG and FLEX, why the operator-relay model meant strangers read your life aloud, and why hospitals kept pagers long after everyone else moved on.
LEO Constellations: Why the New Satellite Internet Is a Different Animal	Nätverk	Geostationary satellites solved coverage and lost latency: parked at 35,786 km, physics alone charges half a second round trip. Low Earth Orbit constellations invert the deal - satellites a few hundred kilometers up, latency in the tens of milliseconds, at the price of needing thousands of moving satellites, phased-array terminals that track them, and constant handoffs. The geometry, the engineering it forces, inter-satellite laser links, and the honest trade-offs.
LoRa and LPWAN: Kilometers of Range on a Coin Cell	Nätverk	There is a corner of networking where the requirements invert everything broadband optimizes for: send a few bytes, a few times an hour, kilometers through a city, from a battery that must last years. LPWAN is that corner; LoRa is its best-known citizen - Semtech's chirp spread spectrum radio trading bitrate for astonishing link budgets, and LoRaWAN, the LoRa Alliance's network layer, organizing gateways, device classes, and the duty-cycle etiquette of shared spectrum.
HTTP Methods: The Verbs of the Web	NätverkWeb & HTTP	GET, HEAD, POST, PUT, DELETE, PATCH, OPTIONS, TRACE, CONNECT - and now QUERY. What each method promises, why 'safe' and 'idempotent' are the two properties that actually matter (to caches, retries, proxies, and crawlers), why HTML forms only ever learned two verbs, and how to read an API's soul from the methods it accepts.
HTTP Status Codes: The Five Families	NätverkWeb & HTTP	Three digits, and the first one does most of the work: 1xx continues, 2xx succeeds, 3xx redirects, 4xx blames the client, 5xx confesses for the server. The family logic, the codes an operator actually meets (200, 204, 301 vs 302 vs 307, 304's cache dance, 401 vs 403, 404 vs 410, 429, 500 vs 502 vs 503 vs 504), the famous curiosities, and why an unknown code's first digit is always enough to act on.
HTTP Headers: The Anatomy of the Metadata	NätverkWeb & HTTPSecurity & WAF	Everything HTTP knows about a message that isn't the message travels in headers: name-colon-value lines with case-insensitive names, folded into four working roles - request context, response context, representation metadata, and payload plumbing. The end-to-end vs hop-by-hop split that proxies live by, the Host header that made virtual hosting possible, content negotiation, conditionals, and why header order became a fingerprint.
HTTP Cookies: State Over a Stateless Protocol	NätverkWeb & HTTPSecurity & WAF	HTTP forgets you after every request - by design. Cookies are the retrofit that lets it remember anyway: the server writes a note with Set-Cookie, the browser returns it with Cookie, and everything else - scope, lifetime, security - is rules about when that note travels. Domain and Path scoping, session vs persistent lifetimes, why the server never sees what the browser knows, and where the security flags article picks up.
AJAX, XHR, and fetch: When Pages Learned to Talk Back	NätverkWeb & HTTP	For its first decade the web had one move: click, blank screen, new page. XMLHttpRequest gave pages a second one - request data in the background, update in place - and 'AJAX' named the revolution (which promptly dropped the X for JSON). How XHR worked, what fetch fixed (promises, streams, a sane API), what stayed the same underneath (it is all still HTTP), and the boundary every background request answers to: same-origin, with CORS as the negotiated exception.
HTML, CSS, and the DOM: The Page as a Living Tree	NätverkSecurity & WAF	Three technologies, one division of labor: HTML declares structure, CSS declares presentation, and the DOM is what actually exists at runtime - the tree the browser built from your HTML, the only thing scripts can touch, and the reason 'view source' and 'inspect element' show different worlds. How markup becomes a tree, how selectors address it (the same selectors CSS styles with and scripts query with), and why the DOM is where XSS happens and where CSP stands guard.
What Is an Algorithm? A Working Primer	NätverkWeb & HTTPHashning och krypto	An algorithm is a finite, unambiguous recipe that turns input into output - and the engineering questions are always the same three: is it correct, how does its cost grow, and what does it trade away. Big-O as the grammar of growth, why constants and asymptotes both matter, the core families you already operate (search, sort, hash, graph, state machines), and where each one is already running inside this site's own tools.
The IEEE 802 family, group by group	Nätverk	802 is not one standard but a committee of working groups, each owning a slice of the lower two layers. Here is the map: who owns Ethernet, who owns Wi-Fi, what the numbers after the dot mean, and which groups are alive, hibernating, or long dead.
Structured cabling: the system behind the wall jack	Nätverk	TIA-568 turns a building's wiring from improvisation into a system: horizontal runs, telecom rooms, the 100-meter channel, categories, pinouts, and the fire ratings inspectors actually check. The map from wall plate to backbone.
BGP: how the internet decides where traffic goes	Nätverk	The Border Gateway Protocol is the internet's routing brain - and it works nothing like the routing inside your network. A practical primer: autonomous systems, the path-vector idea, the attributes that encode business policy, why convergence is slow on purpose, and what RPKI fixes.
OSPF: the map, the math, and area 0	Nätverk	Open Shortest Path First is the standard interior routing protocol: every router gets the whole map and runs Dijkstra on it. A practical primer: link-state flooding, areas and the backbone rule, cost and the reference-bandwidth trap, DR elections, and the design habits that keep OSPF boring.
IS-IS: the routing protocol hiding under the internet	Nätverk	OSPF's link-state twin from the OSI world runs the carrier backbones your packets cross daily - and most engineers have never typed its name. A practical primer: the layer-2 trick, NET addresses, levels instead of areas, TLV extensibility, and why the big networks never left.
MPLS: labels, stacks, and the BGP-free core	Nätverk	Push a label at the edge, swap it hop by hop, pop it before the exit - and suddenly the core needs no routing table, VPNs isolate thousands of customers, and traffic goes where engineering says. A practical primer on label switching, L3VPNs, and the Segment Routing present.
Peer-to-peer, from Napster to the swarm: the architectures that outlived the piracy	Nätverk	Napster, Gnutella, Kazaa, eMule, BitTorrent - four years of file-sharing produced five distinct network architectures, each solving the weakness the last one died from. The centralized index, unstructured flooding, the supernode, the distributed hash table, and the swarm - what each actually was, how the courtroom shaped the topology, and why these ideas quietly power Skype, streaming CDNs, and blockchains today.
The Brazilian market reserve, in theory and in practice	Nätverk	For eight years Brazil legally reserved its computer market for domestically-owned companies. The theory was an infant industry that would grow up and compete. The practice was clones, smuggling, a trade war with Washington, and a generation of engineers who learned on machines the policy created. Both halves are true.
Digital transformation: what actually changed, and how to read what comes next	NätverkOperations & Fieldcraft	Transformation is not the technology arriving. It is the moment a capability stops being remarkable and becomes assumed. A look at what genuinely changed across money, work, health, and the state, and then an honest method for reading predictions, including a deadline that is real and moving at the same time.
How the internet gets shut down, and who can actually do it	Nätverk	There is no off switch, but there are chokepoints: cables, routing, exchanges, and the small number of companies most traffic passes through. A tour of the mechanisms, what each state can genuinely do with them, and the uncomfortable conclusion that watching everything is easier than switching anything off.
Who actually governs the internet in Brazil	Nätverk	Brazil built one of the world's most distinctive internet governance models: multistakeholder before that was a word, with a research foundation running the country's first connection and a committee that is not a ministry. The organs, the laws, the state computing backbone underneath it all, and the 2025 ruling that rewrote platform liability.
Amateur radio: callsigns, modes, and why it still matters	Nätverk	A callsign is an identity issued by treaty, readable anywhere on earth. What the letters and the digit mean, how PY2 says São Paulo, the difference between voice and CW and digital, what a repeater actually does, and why a hobby older than broadcasting is still the fallback when everything else fails.
The data communications window, 1968 to 1972	Nätverk	A regulator opened a market. The Carterfone decision let equipment AT&T had not built attach to the telephone network, and within four years an industry of modem and multiplexer companies existed that could not have existed before. The trigger, the window, the products that defined it, and why it closed.
The networking window, 1979 to 1982	Nätverk	Corporations had bought computers for a decade and now needed them to talk to each other inside a building. The window that opened around 1979 produced local area networks and the data PBX, settled a contest between two answers to the same problem, and closed once the answer was obvious.
The radio spectrum: which frequencies go how far, and why	Nätverk	Why a shortwave signal crosses an ocean on 100 watts while your Wi-Fi struggles through a wall. The bands from VLF to EHF, the three propagation modes that explain nearly everything, and the trade that governs all radio: reach or capacity, never both.
The internetworking window, 1984 to 1988	Nätverk	The previous window's success created this one's problem: buildings full of local area networks that could not reach each other. Bridges and routers answered it, a standards war ran alongside, and two trade shows in 1988 made the outcome visible before the argument was formally over.
The two shows of 1988	Nätverk	One trade show put competing vendors' equipment on a single live network in public, where failure would be seen. The other showed an ecosystem that was largely described rather than shipped. The standards argument was formally undecided and a buyer walking both floors did not need it settled.
The founders who kept founding	Nätverk	Reading this industry as a sequence of companies misses that it is substantially the same population of people, recombining. Ungermann left Intel for Zilog and Zilog for Ungermann-Bass; Metcalfe left Xerox for 3Com. What that pattern explains, and what it does not.
BFD: when a link is up and dead at the same time	Nätverk	Routing protocols detect failure with their own timers, measured in tens of seconds. BFD detects it in milliseconds, and exists because the most dangerous link failure is the one where the interface stays up. What it does, what it does not do, and where it goes wrong.
First-hop redundancy: VRRP, HSRP, and the gateway that is a fiction	Nätverk	A host knows one default gateway and cannot fail over. VRRP and HSRP solve that by making the gateway address belong to a role rather than to a router. How they work, why the protocol choice matters less than people think, and the failure modes that make a redundant pair worse than a single router.
Multicast: what it costs to not flood	Nätverk	Multicast sends one copy where unicast would send thousands, and the saving is real. What it buys in bandwidth it pays for in state, and the failure modes are not the ones people expect: a network that floods multicast everywhere is usually working exactly as configured.
Public DNS resolvers: what you are actually choosing	Nätverk	Cloudflare, Google, Quad9, OpenDNS and the rest differ far less in speed than in policy. What each one does with your queries, which ones block by default, why anycast makes 'nearest' complicated, and the trade nobody states: the resolver that protects you also sees everything you ask for.
FortiGate as a DNS server: four modes, and where the filter applies	Nätverk	A FortiGate can relay DNS, answer from its own database, or resolve from the root itself. The four modes behave differently under failure, and the DNS filter profile does not apply to all of them - which is the configuration that looks protected and is not.

Operations & Fieldcraft (4)

Article	Topic	Summary
Terminal, shell, TTY, console	Operations & Fieldcraft	Four words used interchangeably by almost everyone, including the documentation. They name four different things, and the distinction explains why Ctrl+C kills your command but not your shell.
What a Channel Systems Engineer Actually Does	Operations & Fieldcraft	Inside a distributor there is a role almost nobody outside the channel can describe: the systems engineer who supports resellers rather than customers. Bill of materials work on every project that passes through, proofs of concept, presentations, enablement, bootcamps, trade shows. Some of the resellers being supported have no technical staff at all, which is the fact that explains the rest of the job.
What a network operating system actually is	Operations & Fieldcraft	IOS, Junos, EOS, TMOS, FortiOS, PAN-OS and the rest, compared on the axes that matter: what they run on, how components share state, where the planes divide, and what happens when one part fails.
The path a product takes, and the jobs along it	Operations & Fieldcraft	Between the company that builds a thing and the person who depends on it, a product passes through many hands. Each pair belongs to a job with its own clients, suppliers, accountability and measurement — and the measurement is rarely the same as the accountability.

Security & WAF (56)

Article	Topic	Summary
HTTP Security Headers: The Defense-in-Depth Layer	Security & WAF	What HTTP security headers are, why they form a layer of defense on top of secure code rather than a replacement for it, the headers that carry the most weight, and how to read a response's posture at a glance.
Regex Quantifiers and Character Classes	Security & WAFWeb & HTTP	A regular expression is built from two questions: what character do I want, and how many of them? Character classes answer the first, quantifiers answer the second. Get these two right and most of regex falls into place.
SAML 2.0: How Browser SSO Works	Security & WAFIdentitet och tokens	What a SAML assertion is, the roles of the identity provider and service provider, the SP-initiated Web Browser SSO flow end to end, and the difference between the HTTP-POST and HTTP-Redirect bindings that carry the messages.
Content Security Policy, Directive by Directive	Security & WAF	How CSP works as a control against cross-site scripting and injection: the shape of a policy, why default-src matters, what 'unsafe-inline' and 'unsafe-eval' give away, how nonces and hashes allow specific inline code safely, and what report-only mode is for.
Inside a SAML Assertion: Subject, Conditions, and Audience	Security & WAFIdentitet och tokens	The anatomy of a SAML assertion: the Subject and NameID formats, bearer SubjectConfirmation and the NotOnOrAfter / Recipient / InResponseTo checks, the Conditions validity window, the AudienceRestriction, and the AuthnStatement, with the validation a service provider must perform on each.
Regex Groups, Backreferences, and Lookarounds	Security & WAFWeb & HTTP	Parentheses do far more than set precedence in a regex. They capture text for you to reuse, name the pieces you care about, and — with a question mark prefix — let you assert what comes before or after without consuming it.
Catastrophic Backtracking and ReDoS	Security & WAFWeb & HTTP	Some innocent-looking patterns can take seconds, minutes, or effectively forever on a short string. The cause is catastrophic backtracking, and when an attacker controls the input it becomes a denial-of-service bug. Here is why it happens and how to write patterns that cannot.
HSTS and HTTPS Enforcement	Security & WAF	How Strict-Transport-Security closes the HTTP downgrade window, what max-age, includeSubDomains, and preload each do, the trust-on-first-use gap that preloading removes, and the configuration mistakes that quietly disable it.
SAML Signatures and XML-DSig	Security & WAFIdentitet och tokens	How a SAML message is signed with XML Signature: the enveloped ds:Signature, the SignatureMethod and DigestMethod algorithms, why SHA-1 is weak, the difference between signing the Response and signing the Assertion, and how XML signature wrapping attacks work.
Cookie Security Flags	Security & WAF	How Secure, HttpOnly, and SameSite protect session cookies, what each SameSite value means, why SameSite=None requires Secure, and how the __Host- and __Secure- prefixes enforce those guarantees at the browser level.
Regex Anchors and Boundaries	Security & WAFWeb & HTTP	Anchors match a position, not a character: the start or end of the string, or the edge of a word. They are the difference between a pattern that matches anywhere and one that matches only where you mean. This covers ^, $, \b, and their multiline behavior, plus the mistakes they cause.
XXE and Why a SAML Parser Rejects DOCTYPE	Security & WAFIdentitet och tokens	How XML External Entity (XXE) attacks work, the billion-laughs denial-of-service, why both depend on a DTD, and why a hardened SAML decoder rejects any DOCTYPE or entity declaration outright rather than trying to parse it safely.
Clickjacking and Frame Control	Security & WAF	What clickjacking is, how framing makes it possible, the difference between the legacy X-Frame-Options header and the modern CSP frame-ancestors directive, why ALLOW-FROM is obsolete, and how the two controls interact.
Regex Flags and Modes	Security & WAFWeb & HTTP	A flag changes how the whole pattern matches: case sensitivity, whether ^ and $ see lines, whether the dot crosses newlines, and whether whitespace in the pattern is ignored. The same regex can match completely different things depending on its flags, so knowing them prevents a lot of confusion.
SAML Bindings and SP vs IdP Initiation	Security & WAFIdentitet och tokens	A SAML flow can start at the service or at the identity provider, and the messages can travel by two different bindings: an HTTP redirect with the message packed into the URL, or an auto-submitting HTML form that POSTs it. Which binding carries which message, and where the flow begins, explains a lot of SSO behavior.
The SAML Proxy: Inserting an Identity Layer into a Session	Security & WAFIdentitet och tokens	A SAML proxy sits in the SSO flow rather than the packet path: it terminates the user's request, forces authentication against an identity provider, and only then lets the session through, using SAML's browser-redirect model. It can act as a service provider to the IdP and an identity provider to the app at once (a proxy or broker), which is how one login federates many downstream systems. This explains the roles, the flow, and why it is a proxy at all.
Reading OGNL in a WAF Log: What the Payload Was Trying to Do	Security & WAFWeb & HTTPKodning och data	An OGNL payload in a log has two halves worth telling apart: something that tries to switch off the expression sandbox, and something that tries to run a command. A payload with both is an exploitation attempt. A payload with only the second is usually a scanner working through a list. A payload with neither is a probe checking whether input gets evaluated at all - and that answer decides whether anything else in the list could ever work.
XXE and External Entities	Security & WAF	XML lets a document declare entities, and an external entity can point at a file or URL. A parser that resolves one can be tricked into reading local files or making server-side requests, the XXE vulnerability. The fix is blunt and effective: do not process a DOCTYPE at all.
Billion Laughs and Entity Expansion	Security & WAF	Entities can reference other entities, and if each one multiplies the last, a tiny document can expand to gigabytes and exhaust memory. The billion laughs attack weaponizes this into a denial of service. The defense is to cap expansion or refuse the DOCTYPE outright.
How CVSS Scoring Works	Security & WAF	CVSS turns a short vector string into a 0 to 10 severity number using a fixed formula. The Base score is built from two sub-scores: Exploitability (how reachable and easy the flaw is) and Impact (how bad the outcome is). Everything else refines that base. This is arithmetic, not opinion, which is why a calculator can reproduce any published score exactly.
The CVSS Base Metrics, Explained	Security & WAF	The Base score comes from eight metrics in two families. Four exploitability metrics (Attack Vector, Attack Complexity, Privileges Required, User Interaction) describe how hard the attack is, and four impact metrics (Scope, plus Confidentiality, Integrity, Availability) describe the damage. Scope is the subtle one: it is what lets a score exceed the vulnerable component's own boundary.
CVSS Temporal and Environmental Scores	Security & WAF	The Base score is only the starting point. Temporal metrics lower it as facts emerge, such as a patch being released, and can only reduce the score. Environmental metrics let an organization re-score the flaw for its own systems by raising or lowering the importance of confidentiality, integrity, and availability and by overriding base metrics. Both are optional but produce a more honest number.
Reading a CVSS Vector String	Security & WAF	A CVSS vector is a compact, self-describing string: a version prefix followed by slash-separated metric:value pairs. Learning to read it directly, rather than trusting a rendered score, lets you spot transcription errors and understand exactly what a vendor claimed. The Base metrics are mandatory and the rest are optional.
CVSS Severity Bands, and What the Score Does Not Tell You	Security & WAF	The 0 to 10 number maps to five qualitative bands from None to Critical. That mapping is useful for triage, but a CVSS Base score measures severity, not risk. It says nothing about whether a flaw is being exploited, how valuable the asset is, or what controls you have. Treating the base number as a priority queue is the most common way teams misuse CVSS.
CVSS v3.0, v3.1, and v4.0: What Changed	Security & WAF	This decoder computes CVSS v3.0 and v3.1. The two v3 releases share a formula but differ in rounding and one environmental term, so scores can differ by a tenth. CVSS v4.0, released in 2023, is a larger redesign with new metric groups and no Scope metric, and its vectors are not compatible with v3 tooling. CVSS v2 is retired.
Passive TLS Fingerprinting: JA3, GREASE, and the Churn That Led to JA4	Security & WAF	A ClientHello announces the client in the clear, and the combination of versions, ciphers, and extensions is characteristic of the software that sent it. This covers how JA3 turns that into a hash, why GREASE has to be stripped, how extension-order randomization broke JA3 (the churn), how JA3N and JA4 restore stability, and where a TLS fingerprint fits as a signal for secure web gateways and adaptive authentication.
What Is Server-Side Request Forgery (SSRF)	Security & WAF	SSRF is a vulnerability where an attacker makes a server issue an HTTP request to a destination of the attacker's choosing. Because the request originates inside the server's network, it can reach internal services, cloud metadata, and loopback addresses that the attacker could never reach directly. The fix is to validate the destination, not the URL string.
Private, Reserved, and Public IP Ranges	Security & WAF	An SSRF filter has to know which addresses are internal. This is the map: RFC 1918 private space, loopback, link-local, carrier-grade NAT, the documentation ranges, and everything else that is public and routable. Knowing the ranges is what turns a raw address into a safe-or-not decision.
IP Address Obfuscation Tricks	Security & WAF	One IP address can be written in many forms: plain decimal, octal, hexadecimal, short-hand, and IPv4-mapped IPv6. Each form parses back to the same address, which is how attackers slip an internal target past a filter that only blocks the dotted-decimal spelling. This is why SSRF checks must decode, not string-match.
Cloud Metadata Endpoints and SSRF	Security & WAF	Every major cloud gives an instance a metadata service at a fixed link-local address, and it can return temporary credentials for the instance's role. That makes it the single highest-value SSRF target. Knowing the endpoints, and the IMDSv2-style defenses, is essential for both attack understanding and defense.
Defending Against SSRF with Allow-Lists	Security & WAF	The durable SSRF defense is an allow-list of intended destinations, combined with resolving the address before you trust it and re-checking after redirects. Block-lists of internal ranges help, but they lose to obfuscation and DNS rebinding. This is the layered approach that holds up.
Dangerous URL Schemes in SSRF	Security & WAF	SSRF is not limited to http. Schemes like file, gopher, dict, and ftp let an attacker read local files or craft raw bytes to internal services such as Redis and SMTP. A URL fetcher that does not restrict the scheme hands an attacker a far more powerful primitive than a plain web request.
SSL Forward Proxy: How Outbound TLS Interception Works and What Breaks It	Security & WAFCertifikat och PKITLS och transport	To inspect encrypted outbound traffic, a forward proxy performs a controlled man-in-the-middle: it terminates the user's TLS session, opens its own to the real server, and forges a certificate for that server signed by a private CA the organization's own devices trust. This explains the mechanics, the trust model that makes it safe (and dangerous), and why pinning, HSTS, and mutual TLS defeat it.
The LGPD for Engineers: The Vocabulary That Matters	Security & WAF	Brazil's data protection law assigns you a role, gives you ten legal bases instead of one, and puts a three-working-day clock on breach notification. What controlador, operador, and encarregado mean when you are the one running the systems.
Passive Fingerprinting: What You Emit Without Being Asked	Security & WAFNätverk	Every connection announces its stack before a byte of application data flows. How a TCP SYN, a User-Agent string, and the mere order of HTTP headers each identify a client - and why a mismatch between them is the classic proxy and bot tell.
Check Point's Three-Tier Architecture: Management, Gateway, and SmartConsole	Security & WAF	Check Point separates the place policy is written from the place it is enforced, and that split explains almost everything else about the platform: why you install policy rather than just save it, why SIC exists, and why a gateway keeps working when the management server is down.
Check Point Administrators, Sessions, and Objects: Publish Is Not Install	Security & WAF	Check Point gives every administrator a private working session, so your changes are invisible to colleagues until you publish and inert on the gateway until you install. Those are two separate actions and confusing them is the most common early mistake on the platform.
Check Point Logging and Monitoring: Where Logs Go and How to Ask Them Questions	Security & WAF	A log only exists if a rule was set to create it, and it only survives if a log server was there to receive it. Once both are true, the Logs and Monitor view is a query interface rather than a list, and learning to ask it questions is the difference between finding an answer in seconds and scrolling.
Check Point Identity Awareness: Writing Rules About People Instead of Addresses	Security & WAF	Identity Awareness lets a rule say who rather than where. The gateway has to learn the user-to-address mapping from somewhere, and which source you choose decides how quickly identities appear, how accurate they stay, and what happens when someone changes desk.
Check Point HTTPS Inspection, Application Control, and URL Filtering	Security & WAF	Most traffic is encrypted, so the controls that decide which applications and sites are permitted can only see what the handshake reveals unless the gateway decrypts. HTTPS Inspection is what makes the rest work fully, and it is also the feature most likely to break something on the day you enable it.
Check Point Threat Prevention: The Blades, Profiles, and Prevent Versus Detect	Security & WAF	Threat Prevention is several engines under one policy, each catching a different stage of an attack. The setting that matters most is not which engines are on but whether each is preventing or only detecting, because that single choice decides whether you have protection or a report.
Check Point Management High Availability: Active, Standby, and Why Failover Is Manual	Security & WAF	A second management server protects the database, not the traffic. Gateways keep enforcing whatever happens to management, so what you are buying is the ability to keep changing policy — and the synchronisation status is the thing that tells you whether you actually have it.
Check Point Site-to-Site VPN: Communities, Encryption Domains, and Why the Tunnel Is Empty	Security & WAF	A Check Point VPN is built from communities rather than individual tunnel definitions, which is what makes many sites manageable. The recurring fault is not that the tunnel fails to establish but that it establishes and carries nothing, and that almost always traces to the encryption domain or to NAT.
Check Point SmartEvent and the Compliance Blade: Turning Logs into Events Worth Reading	Security & WAF	SmartEvent correlates logs into events so that a hundred related entries become one thing a person acts on. The Compliance Blade audits the configuration itself against best practice. Both are only as useful as the tuning, and an untuned SmartEvent is a second place to ignore alerts.
Check Point Upgrades and Migrations: Order, Compatibility, and Getting the Database Out	Security & WAF	Upgrade order is not a preference: management goes first, because a management server can manage older gateways and an older management server cannot manage newer ones. Migration is a different operation from upgrading, and the thing being moved is the database rather than the machine.
Check Point ElasticXL: One Cluster Object, Many Members	Security & WAF	ElasticXL is Check Point's newer clustering approach, built so that a cluster is configured and managed as a single entity rather than as members that each need attention. The operational argument is that adding capacity should not mean repeating configuration.
How a Proxy Knows Who You Are: User Authentication Methods Inline	Security & WAF	Policy per user is the whole promise of an inline proxy - which means the proxy must attach an identity to every flow, including the ones that cannot log in. The four working patterns: explicit 407 challenges, cookie-based web authentication, agent-asserted identity, and the surrogate-IP compromise - plus where each one breaks, because every one of them breaks somewhere.
Data Loss Prevention: How Machines Recognize Secrets	Security & WAF	Every DLP product answers the same question - is this outbound content sensitive? - with the same four instruments: patterns, dictionaries, exact data matching against fingerprinted records, and indexed document matching against fingerprinted files. What each instrument can and cannot recognize, why confidence scores and proximity exist, and why the hard part of DLP was never the matching.
Sandbox Detonation: Judging a File by What It Does	Security & WAF	Signatures recognize malware that has been seen; a sandbox convicts malware that has not - by running the file in an instrumented cage and watching its behavior. What detonation actually observes, why verdicts take minutes, the patient-zero window that timing creates, how hash sharing turns one verdict into everyone's protection, and the evasion arms race that keeps cage-builders employed.
Browser Isolation: When You Cannot Trust the Page, Move the Browser	Security & WAF	Remote Browser Isolation stops asking whether a page is safe and removes the question: the real browser runs in a disposable cloud container, and the endpoint receives only a rendered projection - pixels or a reconstructed DOM. What each rendering mode trades, why isolation is the answer for the uncategorizable middle, what it costs, and where its honest limits sit.
CORS Explained: The Border Control of the Browser	Security & WAFWeb & HTTP	CORS is the most misunderstood error message in web development, because it punishes the wrong mental model. It is not a wall - the same-origin policy is the wall; CORS is the door: a header protocol by which a server volunteers 'that other origin may read my responses.' Simple requests vs preflights, what OPTIONS is doing in your network tab, why credentials tighten every rule, why '*' is not the fix, and why CORS never protected the server in the first place.
LDAP search filters: reading the parentheses	Security & WAFIdentitet och tokens	Every directory query - PingDirectory, Active Directory, any LDAP server - comes down to one filter string in prefix notation. How to read it: the operators, the six match types, the escapes, the famous AD bit-filter OIDs, and why an unindexed filter can take down a directory.
OAuth flows: choosing the grant in 2026	Security & WAFIdentitet och tokens	One decision starts every integration: which flow. The modern answer is short - authorization code + PKCE for humans, client credentials for machines, the device grant for TVs - and the reasons implicit and ROPC died are worth knowing by heart. RFC 9700 finally wrote it all down.
Memory safety: the bug classes and the defenses that answer them	Security & WAF	Buffer overflow, use-after-free, null dereference, integer overflow - four names for two failures, staying inside an object and only touching it while it is alive. How each one works, why roughly seventy percent of serious vulnerabilities in large C and C++ codebases belong to this family, and what each defensive layer actually buys.
Tor: how onion routing actually works, and what it does not protect	Security & WAF	Onion routing was invented at a US Navy lab, and that paradox is the key to understanding it: anonymity only works if the crowd is diverse. How a three-hop circuit is built, what onion services really are, the threat model Tor openly admits it loses to, and why most Tor traffic never touches the dark web at all.
DNS blocklists: RPZ, ratings, and what a refused answer costs	Security & WAF	Blocking a domain at the resolver is the cheapest security control there is, which is why every vendor sells one. How RPZ feeds work, what a vendor DNS rating actually rates, the two failure modes nobody plans for, and why the block you cannot see is worse than the one you can.

Text & utilities (1)

The Greek Alphabet: Engineering's Second Alphabet
Why Ω means ohms, μ means micro, and λ runs both wavelengths and serverless functions. The 24 letters, the final-sigma rule, and the transliteration gotchas between modern and classical Greek that quietly rename beta and eta.
Text & utilitiesRead

Article	Topic	Summary
The Greek Alphabet: Engineering's Second Alphabet	Text & utilities	Why Ω means ohms, μ means micro, and λ runs both wavelengths and serverless functions. The 24 letters, the final-sigma rule, and the transliteration gotchas between modern and classical Greek that quietly rename beta and eta.

TLS och transport (12)

Article	Topic	Summary
Anatomin hos en TLS-chiffersvit	TLS och transport	Vad en TLS-chiffersvit faktiskt namnger, hur man läser en svit som TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 del för del, och hur samma kodpunkt på två byte dyker upp under tre olika namnkonventioner.
Att läsa chiffersvitsnamn: IANA, OpenSSL och GnuTLS	TLS och transport	Varför samma chiffersvit har tre olika namn och en kodpunkt på två byte, hur man översätter mellan IANA-, OpenSSL- och GnuTLS-konventionerna, och vad IANA:s Recommended-kolumn med Y, N och D verkligen betyder.
AEAD mot CBC: varför läget spelar roll	TLS och transport	Den praktiska skillnaden mellan ett AEAD-chiffer som AES-GCM och ett äldre CBC-chiffer med en separat HMAC, padding-orakel-attackerna som tog kål på MAC-then-encrypt, och den enda kompromiss som AEAD fortfarande begär.
Forward secrecy och nyckelutbytet	TLS och transport	Vad forward secrecy ger, varför statiskt RSA-nyckeltransport inte erbjuder det, hur ECDHE och DHE gör det, och varför autentisering och nyckelutbyte är två skilda uppgifter som en svits namn håller åtskilda.
TLS 1.3-chiffersviter: vad som ändrades	TLS och transport	Varför en TLS 1.3-svit bara namnger ett chiffer och en hash, vart nyckelutbytet och autentiseringen tog vägen, och varför listan över sviter krympte från hundratals till en handfull.
What a Quantum Computer Would Break, and What It Would Not	TLS och transport	A large quantum computer would not weaken all cryptography equally. Shor's algorithm breaks the public-key math behind RSA, Diffie-Hellman, and elliptic curves outright; Grover's algorithm only halves the strength of symmetric ciphers and hashes, which AES-256 and SHA-384 already survive. This explains the split, why 'harvest now, decrypt later' makes it a today problem, and why a broken candidate like SIKE is a reminder to stay humble.
The NIST Post-Quantum Standards: ML-KEM, ML-DSA, and SLH-DSA	TLS och transport	In August 2024 NIST finalized the first three post-quantum standards: FIPS 203 (ML-KEM, from Kyber) for key establishment, and FIPS 204 (ML-DSA, from Dilithium) and FIPS 205 (SLH-DSA, from SPHINCS+) for signatures. This explains what each one is for, why there are two signature standards on different math, and where HQC and FN-DSA fit as the backups still coming down the pipeline.
Hybrid Key Exchange in TLS 1.3: What X25519MLKEM768 Does on the Wire	TLS och transport	The web did not swap classical key exchange for post-quantum; it runs both at once. X25519MLKEM768 combines a 1990s elliptic curve with lattice-based ML-KEM-768 in a single TLS 1.3 group, so a break of either still leaves the session secure. This covers why hybrid rather than replacement, the wire format and its size problem, and where deployment stands across browsers, servers, and the middleboxes it breaks.
Inbound TLS: Offload, Bridging, and Passthrough at the Reverse Proxy	TLS och transportCertifikat och PKI	A reverse proxy handling inbound HTTPS has three choices for the TLS session: terminate it and send plaintext to the backend (offload), terminate and re-encrypt to the backend (bridging), or forward the encrypted bytes untouched (passthrough). Each trades visibility against confidentiality and cost differently. This explains all three, why the proxy holds the server's certificate, and what SNI and mutual TLS change.
TLS 1.2 vs TLS 1.3 vs DTLS vs QUIC: One Handshake Family, Four Shapes	TLS och transport	TLS 1.2 and TLS 1.3 secure a TCP stream, DTLS carries the same guarantees over datagrams, and QUIC absorbs the TLS 1.3 handshake into the transport itself. What each one is, which RFC defines it today, what actually changed between them, and where each one runs.
What Is a JA4 TLS Fingerprint?	TLS och transportSecurity & WAF	How a TLS ClientHello becomes a stable fingerprint of the client software, why JA3 faded once browsers began randomizing extension order, how JA4 fixes that by sorting before hashing, and what JA4 can and cannot tell you.
Why Do We Say SSL When We Mean TLS?	TLS och transport	SSL has been prohibited, deprecated, and dead for years - and the industry still sells 'SSL certificates,' configures 'SSL inspection,' and links openssl. The history explains the habit: Netscape's SSL, the political rename to TLS in 1999 (the wire version field still said 3.1), and a quarter century of marketing inertia. Plus the musing the question deserves: what would a protocol-independent name even look like, and do any exist?

Network and security concepts, explained clearly.

Certifikat och PKI (14)

Anatomin hos ett X.509-certifikat

PEM, DER och certifikatfilformaten

Certifikatsigneringsbegäranden och hur certifikat utfärdas

Hur certifikatvalidering faktiskt fungerar

Certifikatåterkallelse: CRL, OCSP och kortlivade certifikat

Authority Information Access: The OCSP and CA Issuers URLs

OCSP Must-Staple: Closing the Soft-Fail Gap

ACME: how certificates issue and renew themselves

The 47-day era: how TLS certificate lifetimes are shrinking

Certificate validity windows: notBefore, notAfter, and renewal lead time

Let's Encrypt: the free CA and its rate limits

DCV and SII reuse: the validation cadence behind the renewal cadence

Renewing before expiry: lead time, ACME, and ARI

Public vs private PKI: which certificates SC-081v3 governs

Hashning och krypto (15)

Hashning, kryptering och kodning: tre olika saker

Kryptografisk hashning: SHA-256 och SHA-2-familjen

Välja en hash: MD5, SHA-1, SHA-2, SHA-3 och BLAKE

Kollisioner, förbildsmotstånd och födelsedagsgränsen

Lagra lösenord: bcrypt, scrypt och Argon2

HMAC: nyckelförsedd hashning för meddelandeautentisering

Varför HMAC, och inte hash(nyckel + meddelande)

Autentisera API-begäranden med HMAC

Verifiera en HMAC säkert: konstant tid och replay

Why Cryptographic Hashes Are One-Way

Brute Force vs Lookup Tables: Two Ways to Reverse a Hash

Why Salting Defeats Precomputed Tables

Slow KDFs: bcrypt, scrypt, and Argon2

Keyspace, Entropy, and Crack Time

Choosing a Password Hash

Identifierare (5)

UUID:er: slumpmässig v4 och tidsordnad v7

UUID-versioner förklarade: v1 till v8

Kommer UUID:er att kollidera? Sannolikhet och födelsedagsgränsen

UUID:er som databasnycklar: v4, v7 och indexlokalitet

ULID, KSUID, Snowflake och andra sorterbara ID:n

Identitet och tokens (39)

Anatomin hos en JSON Web Token

JWKS and Key Rotation: How Providers Publish Their Keys

OpenID Connect: An Identity Layer on OAuth 2.0

JWK Key Types: RSA, EC, OKP, and oct

JWT-signeringsalgoritmer: HMAC, RSA och ECDSA

The ID Token Claims, and What a Relying Party Checks

JWT-säkerhetsfällor: alg:none, nyckelförväxling och saknade kontroller

OIDC vs OAuth 2.0: Authentication vs Authorization

Verifying a JWT with a JWKS: From kid to Signature

Åtkomsttoken, uppdateringstoken och ID-token

JWK Parameters and Thumbprints

OIDC Discovery: The openid-configuration Document

JWT Algorithm Confusion Attacks

Publika vs konfidentiella klienter, och var PKCE passar in

The OIDC Authorization Code Flow

OAuth 2.0-auktoriseringskodflödet

PKCE: att säkra OAuth-auktoriseringskodflödet

OpenID Connect: identitet ovanpå OAuth 2.0

How TOTP and HOTP one-time passwords work

Validating one-time passwords: drift, windows, and replay

Provisioning Authenticators: otpauth URIs and QR Codes

Installing PingFederate: Requirements, First Run, and the Setup Wizard

Upgrading PingFederate: The Utility, the Merge, and the Cluster Order

The PingFederate Startup Files: Who Controls What

Who Administers PingFederate: Native Accounts, Roles, and Console Login via LDAP

PingFederate Operational Hygiene: License, Notifications, and the Configuration Archive

The PingFederate Endpoints Map: Admin Port, Runtime Port, and What Lives Where

PingFederate Data Stores: LDAP and JDBC, Defined Once, Used Everywhere

How Users Prove Who They Are: PCVs and the Five Adapters

The PingFederate Log Files: Which One Answers Which Question

PingFederate Authentication Policies: Trees, Selectors, and the Contract at the End

LDAP Fundamentals: The Directory Model Behind Identity Systems

Kerberos and SPNEGO: How Silent Desktop SSO Actually Works

SCIM: The Standard That Provisions the Accounts SSO Signs In

The PingAccess Policy Model: Gateway, Agent, and the Rule Stack

The PingDirectory Platform: Store, Aggregate, Sync, Delegate

PingOne: The Platform Behind the Product Names

PingOne DaVinci: Identity Orchestration as a Canvas

From Sun to Ping: The ForgeRock Lineage Decoded

Kodning och data (42)

Byte, kodpunkter och UTF-8