Glossary

The field's terms, acronyms, expressions, jargon, and lore - defined, sourced, and linked to the tools that compute them.

1817 terms

I need a definition →

Type the word; the filter narrows 1817 entries as you go, by headword, expansion and alias.

Decode the jargon →

734 acronyms, expressions and pieces of jargon: what the room means when it says it.

Industry lore →

352 stories the industry tells about itself, each fact-checked against a primary source.

Commonly mistold →

21 entries whose usual telling is wrong, flagged as disputed and corrected in their own context.

Browse a domain →

15 domains, each with its own page: networking, security, the cloud, the trade itself.

Commonly mistold

21 entries carry the disputed marker: the story everybody repeats is not what the sources say. Each entry states the usual version and the correction.

Filter by kind

Filter by domain

109

"a VPN makes you anonymous"loreDisputed / commonly mistoldA commercial VPN moves your trust from the local network to the VPN company: it hides traffic from the coffee shop and your IP from sites, while seeing everything itself.
a hacker scene (regional scenes)termThe community of a place: the people, meetings, boards, conferences, hackerspaces and shared history that make hacking a local culture rather than an individual hobby. Distinct from the Scene, which in release culture means the warez distribution world specifically.
a lista do Anchises (Brazilian security profiles)loreThe roster of Brazilian and Portuguese information-security people and organisations that Anchises Moraes has maintained on his blog since January 2010 - started at 72 entries and grown past 770, with every addition dated in a public changelog at the foot of the post.
a patchy serverloreDisputed / commonly mistoldThe oldest explanation of how Apache got its name: it was a server made of patches.
AA flagtermThe Authoritative Answer bit a DNS server sets when it answers from a zone it serves, printed as aa by dig.
AAAAacronymThe DNS record that maps a hostname to an IPv6 address.
Aaron SwartztermThe programmer and activist who co-authored the RSS 1.0 specification as a teenager, helped build Reddit and the Creative Commons technical infrastructure, co-created SecureDrop, and led the campaign that stopped the SOPA copyright bill - and who took his own life in 2013 at twenty-six while facing federal charges.
ABACacronymAttribute-Based Access Control: authorisation decided per request by evaluating attributes of the subject, the object, the operation and the environment against policy, rather than by looking up a role.
abandonwarejargonSoftware whose vendor is gone or has walked away: no patches, no support, no legal way to buy it - and often no way to run it safely.
ABNT (Associação Brasileira de Normas Técnicas)acronymThe Brazilian Association of Technical Standards: Brazil's national standards body and its ISO member.
abstractiontermHiding how something works behind what it does, so callers depend on an interface rather than on an implementation.
accountingtermThe third A in AAA: recording what an authenticated party actually did, for billing, capacity or evidence.
ACIDacronymThe four guarantees a reliable database transaction should provide.
ACLacronymAccess Control List: an ordered set of permit and deny rules evaluated top-down against traffic, with an implicit deny waiting at the end.
ACMEacronymA protocol that automates getting and renewing TLS certificates.
ACSacronymThe endpoint where a SAML response is delivered to the application.
Active DirectorytermMicrosoft's directory service: the domain's phone book and security authority - users, groups, machines, and the permissions binding them.
active-active vs. active-passiveexpressionThe two shapes of high availability: both nodes serving traffic, or one serving while the other waits.
ADacronymMicrosoft's directory service for identity and authentication.
Ada LovelaceloreThe 19th-century mathematician often called the first programmer for her notes on Babbage's Analytical Engine.
ADCacronymA device that load-balances and optimizes application traffic.
Adi ShamirloreThe S in RSA, joint recipient of the 2002 Turing Award, and the author of the secret-sharing scheme that splits a key so that any k of n holders can reconstruct it.
Adiel AkploganloreThe Togolese engineer who helped bring the first TCP/IP connection to his country, then built the registry that allocates addresses for a continent.
administrative distancetermThe trust ranking a router applies when two routing sources offer the same prefix: lower wins, so connected beats static beats OSPF beats BGP-learned.
Adrian LamotermThe itinerant intruder of the early 2000s - working from libraries and cafes, breaking into Microsoft, Yahoo!, WorldCom and the New York Times, then telling the victims how he did it and offering to help fix it.
ADSLacronymAsymmetric Digital Subscriber Line: broadband over the existing telephone pair by frequency division - voice below ~4 kHz, data above, a DSLAM terminating the data side at the exchange. Asymmetric because downstream gets most of the spectrum. Its arrival made home connections always-on.
ADSPacronymF5's unified platform branding for application delivery and security.
AEADacronymA cipher that encrypts and authenticates in one step, so tampering fails as a single operation.
aerial vs. underground plantexpressionThe two ways outside plant reaches customers: on poles (cheap, fast, storm-exposed) or buried (costly, slow, backhoe-exposed).
AESacronymThe standard symmetric block cipher used almost everywhere for bulk encryption.
AgiletermThe 2001 Manifesto and everything it unleashed - individuals over processes, working software over documentation, responding to change over following the plan.
air gaptermIsolating a system by giving it no network connection at all: the security control made of literal absence.
AiTM (adversary-in-the-middle phishing)acronymPhishing that proxies the real site in real time: the fake page relays the victim's password and one-time code to the genuine service within their validity window, then steals the resulting session cookie.
AIXacronymAdvanced Interactive eXecutive, IBM's proprietary Unix, first released in February 1986 for the RT PC and still current on Power servers; System V with 4.3BSD extensions, and the first operating system with a journaling file system.
AJAXacronymA technique for updating a web page without a full reload.
Al GoreloreUnited States senator, later vice president, whose 1991 legislation funded the research network and the supercomputing centre from which the commercial internet emerged; better known for a sentence he did not say.
Alan TuringloreThe mathematician whose 1936 paper defined what computation is, and what no machine can compute - the boundary every computer since has been built inside.
alarm stormjargonOne real failure detonating into thousands of secondary alarms across the monitoring system.
Albert GonzaleztermThe Miami carder who stole roughly 170 million payment-card numbers between 2005 and 2007 - TJX, Heartland Payment Systems, Dave and Buster's and others - while working as a paid informant for the US Secret Service.
Aleph One and Smashing the StackloreThe 1996 Phrack article by Elias Levy, writing as Aleph One, that explained the stack buffer overflow completely and clearly - stack frames, return addresses, shellcode, NOP sleds - and taught an entire generation how memory corruption actually works.
alert fatiguejargonThe numbness that sets in when monitoring pages so often that real alerts drown among the false ones.
Alessandro VoltaloreThe physicist whose 1800 pile - stacked zinc and copper discs separated by brine-soaked cloth - produced the first steady electric current.
Alexander Graham BellloreThe teacher of the deaf whose 1876 patent on transmitting speech electrically created the network that every later one was built on top of.
ALGacronymCode in a NAT that reads and rewrites addresses inside an application's payload, so protocols such as FTP survive translation.
all models are wrongexpressionGeorge Box's statistics proverb: every model simplifies falsely - the question is whether it is useful anyway.
all your base are belong to usloreA garbled line from a badly translated 1991 video game that became one of the first viral internet memes.
ALOHAnetloreThe 1971 University of Hawaii radio network whose random-access scheme became the ancestor of Ethernet's collision handling.
ALPACAloreA 2021 cross-protocol attack that confuses TLS services sharing a certificate.
Alpine LinuxtermThe small, security-oriented distribution built on musl libc and BusyBox rather than glibc and the full GNU utilities - the default base image for a very large share of container workloads because of its size.
ALPNacronymThe TLS handshake field that negotiates which application protocol to use.
AltaVistaloreThe search engine that led the web before Google, built at DEC as a way to stress-test a processor.
amateur radiotermA licensed radio service for self-training, experimentation, and non-commercial communication, with allocations across the whole spectrum.
Amdahl's lawexpressionThe speedup from parallelizing a task is capped by its serial fraction: infinite processors cannot beat 1/s.
Amplification and reflection attackstermSending small forged requests to public servers so their much larger replies are delivered to a victim - reflection provides the disguise, amplification provides the volume.
analog vs digitaltermThe distinction between a continuous signal that varies smoothly and a discrete one built from countable steps, and the boundary the whole digital age is spent crossing.
ANATELloreAgência Nacional de Telecomunicações: Brazil's telecom regulator, created by the Lei Geral de Telecomunicações (Law 9.472, July 1997) to set rules and supervise the privatized sector in the public interest.
Anchises MoraestermOne of the founders of Garoa Hacker Clube, Brazil's first hackerspace, where he holds the ceremonial title of Supreme Chancellor; founder and organiser of Security BSides Sao Paulo; director of the Brazilian chapter of the Cloud Security Alliance; and author of the long-running blog AnchisesLandia.
André-Marie AmpèreloreThe physicist who turned Ørsted's observation into electrodynamics, and who first drew the distinction between current and voltage.
Android (as a Linux descendant)termThe most widely deployed Linux system in the world, and a deliberate piece of licence architecture: the copyleft kernel underneath, a permissively licensed framework and a purpose-built C library above it, so manufacturers can ship proprietary layers without publishing them.
anonymizationtermTransforming data so individuals can no longer be identified by any reasonably available means - the exit door from data protection law.
AnonymoustermThe leaderless online collective that emerged from imageboard culture around 2003 and became, from 2008, the public face of hacktivism - identified by the Guy Fawkes mask and the line 'We are Legion.' Anyone can act as Anonymous, which is the point and the problem.
ANPDacronymAutôridade Nacional de Proteção de Dados: Brazil's data protection authority - regulator, enforcer, and interpreter of the LGPD.
anycasttermOne IP address announced from many locations, so users reach the nearest instance.
Apache HTTP Server (httpd)termThe web server that ran most of the internet for the best part of two decades, begun in 1995 as coordinated patches to a server nobody was maintaining.
Apache Software Foundation (ASF)acronymThe non-profit incorporated in June 1999 so the Apache projects would outlive any individual volunteer.
APItermA defined way for one program to ask another for something - a contract about what may be called and what comes back.
APIsec UniversitytermFree, certificate-granting API-security training - the fastest on-ramp into the OWASP API Top 10 world.
App ConnectortermZPA's lightweight VM/container beside a private application, making only outbound TLS connections to Service Edges - enrolled with a provisioning key, discovering apps via its own DNS vantage.
App profile (ZCC)termThe Zscaler Client Connector policy object that decides per-application handling on the device: which destinations bypass the tunnel via its PAC logic, and platform-specific behavior per operating system.
AppleTalkloreApple's plug-and-play networking suite of the 1980s and 90s - zero-configuration before the term existed, now discontinued.
Application segmenttermZPA's unit of application definition: a set of FQDNs, wildcards, or IP addresses plus their ports, naming what can be reached. Access policy matches top-down against the most specific segment.
APT (Advanced Persistent Threat)acronymAn adversary with the resources and patience to gain access and keep it - typically state-sponsored or state-tolerated, focused on collection over months or years rather than on immediate gain. The term describes the operator's posture, not a specific technique.
ARCacronymAn experimental email protocol in which each handler of a message records and seals the authentication results it saw.
archive formats (zip, tar, gz, 7z, rar, iso, cab)termContainer formats that bundle files together, compress them, or both - and the distinction between those two jobs is the thing most people never learn.
Ariane 5 Flight 501loreThe 1996 maiden launch destroyed by an integer overflow in software reused from Ariane 4.
ARPacronymAddress Resolution Protocol: how a host asks 'who has this IP?' on the local network and learns the answering MAC address.
ARP poisoningtermAnswering the local network's address resolution requests with a lie, so that traffic for another machine is delivered to you instead.
ARPANETtermThe packet-switched network funded by ARPA that grew into the internet, beginning with four university nodes in 1969.
AS (autonomous system)acronymA network under one administrative routing policy, identified by an ASN.
AS/400 (IBM i)termIBM's Application System/400, the midrange computer announced in June 1988 and released that August, whose operating system and architecture survive today as IBM i on Power Systems: a single-level store, an object-based machine interface and an integrated relational database that have kept forty-year-old applications running on current hardware.
AS3acronymAn F5 extension for declaratively configuring application services via JSON.
ASCIIacronymThe 7-bit character code that numbers 0 to 127 the English letters, the digits, punctuation and 33 control codes; the first 128 code points of Unicode.
ASICacronymApplication-Specific Integrated Circuit: a chip built to do one job, fast, and incapable of being repurposed.
ASLRacronymRandomizing where a process's memory regions land, so their addresses differ on every run.
ASNacronymA number identifying a network under one routing policy.
ASPAacronymA signed RPKI object in which an AS names its transit providers, so that routers can check an AS path for leaks.
assertiontermThe signed statement a federation protocol carries: who authenticated, when, how, for which audience, and for how long it is valid.
assettermSomething an organisation owns or depends on that is worth protecting - and, in practice, something it has to know exists.
assume breachexpressionThe security posture that plans as if attackers are already inside, because someday they will be.
asymmetric routingtermTraffic out one path and back another: perfectly legal IP behavior that quietly breaks stateful firewalls expecting to see both directions.
ATMacronymAsynchronous Transfer Mode - the 1990s bet that all traffic, voice to data, should ride fixed 53-byte cells with hard QoS. Ethernet and IP won instead.
ATP (Advanced Threat Protection)acronymA vendor product category - detonation sandboxes, mail and web filtering with behavioural analysis, endpoint detection bundled under one name - sold as the answer to advanced threats. Three letters away from APT, and constantly confused with it.
attack surfacetermEverything an attacker can reach and try: exposed services, APIs, credentials, people - the sum of ways in.
attack vectortermThe specific path or means by which an attacker reaches and compromises a target.
attackers only need to be right onceexpressionThe defender's dilemma: attackers can fail repeatedly at no cost, while defense must hold everywhere, always.
attenuationtermSignal loss over distance and through obstacles, measured in dB - the budget every link spends whether copper, fiber, or radio.
attestationtermA statement by one party that something about another is true, made in a form somebody else is willing to rely on.
Atwood's lawexpression'Any application that can be written in JavaScript, will eventually be written in JavaScript.'
audittermAn independent examination of whether controls exist and operate as described, producing an opinion somebody else can rely on.
audit trailtermThe tamper-evident record of who did what, when, and from where - the API log every investigation starts from.
authenticationtermEstablishing who or what is making a request - distinct from deciding what they may do.
authentication adaptertermThe PingFederate component that actually authenticates a user - or receives one authenticated elsewhere: HTML Form, HTTP Basic, Kerberos, OpenToken, and Reference ID each embody a different integration pattern.
Authentication Policy ContracttermThe normalized attribute set an authentication policy fulfills on every successful path: whatever adapter or IdP connection authenticated the user, downstream configuration consumes the same contract.
authentication policy treetermPingFederate's runtime decision tree for authentication: nodes are authentication sources and selectors, Fail and Success branches express fallbacks, reusable fragments capture common sequences, and every successful path ends by fulfilling a policy contract.
authorizationtermDeciding what an authenticated party may do - the check that runs on every request, not just at the door.
auto-negotiationtermThe exchange in which two twisted-pair Ethernet ports advertise their speeds and duplex modes and settle on the best they share.
autoscalingtermCapacity that follows demand: instances added on load, removed in quiet - elasticity as the cloud's founding promise.
availability zonetermOne or more data centers with independent power, cooling, and network inside a region - close enough for sync replication, far enough to fail separately.
AWSacronymAmazon's cloud platform - compute, storage, networking, and hundreds of services.

84

Babel FishloreThe web's first machine-translation service, shipped by AltaVista.
baby giantjargonA frame slightly over the classic 1518-byte Ethernet maximum: a tag or label added a few bytes to a standard packet.
Back OrificeloreThe remote-administration tool for Windows released by the Cult of the Dead Cow at DEF CON in August 1998, its name a joke at the expense of Microsoft's BackOffice. It gave an operator near-total control of a remote Windows machine over a small, quiet network channel.
backhaultermThe links carrying aggregated access traffic from towers, cabinets, and OLTs back to the network core - the middle mile.
backhoe fadejargonTelecom's dry name for total signal loss caused by construction equipment digging through the fiber.
backuptermA copy kept so that data can be recovered - which is only true once a restore has been tested.
backup vs. snapshotexpressionSnapshots are fast local restore points sharing the original's fate; backups live elsewhere and survive it - only the second answers ransomware.
BADoSacronymA defense that detects denial-of-service by learning normal traffic behavior.
Banking trojantermMalware built specifically to steal money from online banking sessions - by capturing credentials, injecting fake fields into the bank's page, drawing a convincing overlay window on top of the real application, or altering payment details as a transfer is submitted.
Barbara LiskovloreThe 2008 Turing Award recipient, cited for practical and theoretical foundations of programming language and system design, especially data abstraction, fault tolerance and distributed computing.
Barnaby JackloreThe New Zealand researcher whose 2010 Black Hat talk 'Jackpotting Automated Teller Machines' made two ATMs spray cash across the stage on command - the single most-cited demonstration in conference history, and the origin of jackpotting as a term.
Base64termAn encoding that represents arbitrary bytes using 64 printable characters, so binary data can travel through channels that only accept text.
bastion hosttermThe one hardened, audited entry point for administrative access to a private network - a jump host by design rather than accident.
bazloreThe third metasyntactic placeholder, following foo and bar.
BCP 38 (source address validation)termThe practice of a network verifying that packets leaving it carry source addresses that actually belong to it, and dropping those that do not - blocking address forgery at the point where it originates.
beaconingjargonThe regular, automated check-ins a compromised host makes to its command server.
BEASTloreA 2011 attack decrypting TLS 1.0 traffic by exploiting predictable CBC initialization vectors.
BEBacronymAn edge device in an Ethernet fabric that encapsulates traffic into the backbone.
belt and suspendersexpressionWearing two independent safeguards for the same failure - if one lets go, the trousers stay up.
BFDacronymBidirectional Forwarding Detection - a tiny, protocol-agnostic hello stream that detects a dead path in milliseconds, so routing protocols can fail over before users notice.
BGPacronymThe protocol that decides how traffic is routed between the large networks that make up the internet.
BGP communitiestermNumeric tags attached to BGP routes so that networks can group destinations and request how they are treated.
BGP hijacktermAnnouncing address space you do not hold, so that other networks send you traffic meant for its real owner - effective because routing prefers the most specific announcement and the protocol has no native way to check who is entitled to originate a prefix.
BGP hold timetermHow long a BGP speaker waits without hearing from its peer before it declares the session dead and closes it.
BGPsectermA BGP extension in which every AS on the path signs the route announcement, so the AS path itself can be verified.
BHackloreThe technical security conference of Belo Horizonte, and one of the events that made the Brazilian scene something other than a Sao Paulo scene.
big ball of mudexpressionA system with no discernible architecture - haphazardly structured, sprawling, and held together by expedience.
bikesheddingloreSpending disproportionate discussion on a trivial detail while an important, complex decision passes with little scrutiny.
Bill CheswickloreCo-author of Firewalls and Internet Security in 1994, one of the first books on the subject, written from running AT&T's internet gateway - and the author of the account of watching an intruder inside a deliberately prepared environment.
BINDacronymThe most widely deployed DNS server software.
biometric datatermMeasurements of the body used to identify the person - fingerprints, face geometry, voice, gait - identifiers you cannot rotate after a breach.
bisectiontermHalving a search space repeatedly until one candidate remains, so that a thousand possibilities take ten tests rather than a thousand.
bitloreThe smallest unit of information, a single choice between 0 and 1, and the atom on which the entire digital world is built.
bit bangingjargonDriving a hardware protocol entirely in software, toggling a pin bit by bit instead of using a dedicated controller.
bit bucketjargonThe imaginary place discarded data goes - the destination of everything sent to /dev/null.
bit rotexpressionThe way working software seems to decay over time as the world around it changes.
BitKeeper (and the birth of Git)loreThe proprietary distributed version-control system the Linux kernel used from 2002, offered free to the project - and whose withdrawal in 2005, after a dispute over reverse-engineering its protocol, left the kernel abruptly without version control.
Black HattermThe corporate-facing security conference: research Briefings and paid Trainings, run days before DEF CON.
blameless postmortemtermReviewing an incident to find the conditions that allowed it, rather than the person who acted within them.
blast radiusjargonHow far the damage spreads when one component fails or is compromised.
bloatwarejargonUnwanted software that arrives pre-installed - trials, toolbars, vendor utilities - consuming resources nobody offered.
block ciphertermA cipher that encrypts fixed-size blocks (AES: 128 bits), relying on a mode of operation to handle real message lengths.
block storagetermStorage presented to a machine as a raw disk, which the operating system formats and manages itself.
BlockchaintermAn append-only ledger of batched transactions in which each block carries the cryptographic hash of the one before it, so altering any past record changes every hash after it. Combined with a consensus rule that decides which chain counts, it lets mutually distrustful parties agree on an order of events with no central authority.
blue boxloreThe phone-phreaking device that generated the 2600 Hz tone and signaling frequencies to seize control of the long-distance network.
blue screen of deathjargonWindows's full-screen fatal-error display, and by extension any total, user-visible system failure.
blue teamtermThe defenders: the people and tooling that detect, respond to, and recover from attacks.
BlueKeeploreA 2019 wormable flaw in Microsoft Remote Desktop Services.
Bob KahnloreThe co-designer of TCP/IP with Vint Cerf, and the 2004 Turing Award co-recipient, cited for the design and implementation of the internet's basic communications protocols.
Bob MetcalfeloreThe inventor of Ethernet, at Xerox PARC in 1973, and recipient of the 2022 Turing Award for its invention, standardization and commercialization.
bogonjargonA packet claiming a source address that could never legitimately appear on the public internet.
bohrbugloreA solid, reproducible bug that behaves the same way every time you run it.
boil the oceanexpressionTo attempt something so broad or ambitious that it is doomed by its own scope.
borkedjargonBroken, in the resigned voice of someone who has to fix it - as in 'the upgrade borked the standby unit'.
botnettermA network of compromised machines controlled as one, often for attacks or spam.
BPDUacronymThe frame spanning tree switches exchange to elect a root bridge and decide which ports forward and which block.
braindumpjargonA verbatim collection of leaked real exam questions, sold or shared so candidates can memorize their way to a certification.
BREACHloreA 2013 variant of CRIME that targets HTTP response compression instead of TLS.
break-glass accountexpressionThe sealed emergency credential that bypasses normal controls when identity itself is down - stored offline, alarmed on use, tested on schedule.
brickedjargonRendered as functional as a brick - a device so broken it will not even boot.
bridgetermA device that joins two network segments at layer 2, forwarding only the frames that need to cross.
broadcasttermOne-to-all delivery inside a network segment: a frame or packet addressed so that every host must receive and process it.
broadcast stormtermThe meltdown where broadcast frames multiply through a switching loop until the network drowns in its own traffic.
Brooks's lawexpressionThe principle that adding people to a late software project makes it later.
brownoutjargonA service that is up but deliberately or visibly degraded - dimmed, like the power-grid original, rather than dark.
browser fingerprintingtermIdentifying a browser by its combination of traits - fonts, canvas rendering, hardware, settings - unique enough to track without any cookie.
Bruce SchneiertermThe cryptographer and writer whose 1994 book Applied Cryptography taught a generation of programmers how ciphers work, who designed Blowfish and Twofish, and who then spent decades arguing that the hard problems in security are human and economic rather than mathematical.
brute forcetermTrying every possibility until one works.
BSDacronymA Unix lineage; also the name of the original syslog format.
BSides São PauloloreThe community-run, free security conference of Sao Paulo - born inside Garoa Hacker Clube in 2011, now among the largest BSides anywhere.
BSSIDtermThe identifier of one specific radio in a wireless network - in practice the access point's own address, as distinct from the network name.
buffer overflowtermWriting more data into a buffer than it can hold, so the excess lands in adjacent memory that was never meant to receive it.
bufferbloatjargonLatency caused by oversized buffers: routers queue so much that packets arrive very late instead of being usefully dropped.
bug (the first computer bug)loreDisputed / commonly mistoldThe 1947 logbook entry in which a moth trapped in a Harvard Mark II relay was taped down beside the note "First actual case of bug being found."
bug bountytermA program that pays researchers for responsibly reporting security flaws.
BUMacronymSwitching shorthand for the three traffic types a switch cannot deliver to a single known port and therefore floods: broadcast, unknown unicast, and multicast.
burn ratejargonHow fast a finite budget is being consumed - cash in a startup, error budget in SRE practice.
bus factorexpressionThe number of people who would have to be hit by a bus before a project stalls for lack of knowledge.
bus topologytermA single shared cable that every station taps into, with terminators at each end.
BYODacronymBring Your Own Device: employees working from personal hardware - cheaper fleets, happier users, and a security perimeter made of other people's phones.
BYOIPacronymBring Your Own IP: advertising your own address blocks from the cloud provider's network - your reputation and whitelistings, their infrastructure.
byteloreA group of bits handled as a unit, standardized to eight, and the everyday quantum of computer storage.
Byte order marktermU+FEFF at the very start of a text: it says which byte order a UTF-16 or UTF-32 text uses, and serves as a signature that a text is UTF-8.
Byzantine fault tolerancetermAgreement that survives members which do not merely fail, but lie - sending different answers to different peers, whether through corruption or malice.

158

CtermThe language Dennis Ritchie wrote in the early 1970s, in which Unix was rewritten, and in which most operating systems and network stacks are still written.
C10K problemjargonThe problem, named in 1999, of handling ten thousand simultaneous connections on one machine.
C2acronymThe infrastructure an attacker uses to control compromised machines remotely.
C3DacronymAn F5 feature that re-signs client certificates for backend mutual TLS.
C5acronymGermany's government-backed cloud-security attestation, defined by the BSI.
CAacronymThe trusted issuer that signs digital certificates.
CAAacronymA DNS record declaring which certificate authorities may issue for a domain.
CAA recordtermA DNS record in which a domain owner declares which certificate authorities are permitted to issue certificates for that domain, and where to report violations.
Cable categories (Cat 5e-8)termThe TIA-568 performance grades of twisted-pair cable - what 'Cat 6A' actually promises.
Cable landing stationtermThe facility where a submarine cable comes ashore and connects to terrestrial networks - housing the power feed equipment for the cable's optical amplifiers and the transmission gear that hands traffic to carriers.
Cable repair shiptermA specialised vessel held on standby under regional maintenance agreements to repair submarine cable faults - locating the break, grappling the cable off the seabed, splicing new fibre aboard, testing, and returning it to the bottom.
cache poisoningtermGetting a resolver or proxy to store a forged answer, so every later client asking the same question is given the attacker's version.
cache-controltermThe header that tells caches whether a response may be stored, by whom, and for how long.
callsigntermA unique identifier issued to a licensed radio station, structured as prefix, digit, and suffix.
Campus PartyloreThe tent-city technology festival: thousands of campistas pitching tents inside a convention pavilion for a week of talks, hackathons, and 24/7 connectivity.
CAN (campus area network)acronymCampus area network: several local area networks across adjacent buildings under one owner, joined by cable that owner controls.
canarytermExposing a change to a small, real slice of traffic first, so the failure is discovered by few rather than by everyone.
canary in the coal mineexpressionA sacrificial early-warning signal: something small that suffers first, so the rest can react in time.
canary tokentermA booby-trapped credential, file, or link that phones home when touched - fake AWS keys that alarm the moment someone tries them.
capacitytermHow much load a system can carry before its behaviour degrades - which is not the same as the number on the specification.
Captain Crunch (the 2600 Hz whistle)loreThe phone-phreaking legend that a toy whistle emitting 2600 Hz could seize AT&T long-distance trunks.
Captain MidnightloreThe 1986 HBO satellite hijacking by a Florida uplink engineer protesting a $12.95 monthly fee.
CAPTCHAacronymA challenge meant to tell humans and bots apart.
captive portaltermThe page a network forces a new client to see before granting access, implemented by intercepting the first requests.
Capture the Flag (CTF)termThe competitive format in which teams solve security challenges to recover flag strings. Jeopardy style offers categorised puzzles - binary exploitation, reverse engineering, cryptography, web, forensics - while attack-defence gives every team an identical vulnerable network to break into and simultaneously patch.
CAPWAP (controller-based wireless)acronymThe standardised protocol between a wireless controller and its access points, carrying configuration, radio management and, optionally, the client data traffic itself.
CardingjargonThe trade in stolen payment-card data and the economy around it: dumps are magnetic-stripe tracks for cloning physical cards, CVVs are card-not-present details for online use, and fullz bundles a card with enough identity data to open accounts in the victim's name.
cargo cult programmingloreCopying code or rituals that seem to work without understanding why, in the hope the result follows.
Carlos Afonso and AlternextermThe co-founder, with sociologist Herbert de Souza (Betinho) and Marcos Arruda, of the Brazilian Institute of Social and Economic Analyses (IBASE), and the man behind Alternex - the first internet service in Brazil open to the public, years before commercial providers existed. Inducted into the Internet Hall of Fame in 2021.
CarriertermAn operator that moves somebody else's traffic: the physical substrate everything above it assumes.
carrier hoteljargonA building whose tenants are networks: dozens of carriers and providers colocated where fiber routes converge.
CarterfonetermThe 1968 FCC decision that let equipment the telephone company had not made be attached to the telephone network.
CASBacronymCloud Access Security Broker: the control point between users and SaaS - visibility into which cloud apps are used and policy over what flows into them.
castle-and-moatexpressionThe perimeter security model: strong walls at the edge, broad trust for anyone already inside.
cattle, not petsexpressionThe mindset that servers should be disposable and interchangeable, not lovingly maintained individuals.
CBCacronymAn older block-cipher mode that chains blocks together but provides no integrity on its own.
CCIacronymCloud Confidence Index - Netskope's 0-100 risk rating for tens of thousands of cloud applications, scored against objective criteria adapted from the Cloud Security Alliance's guidance and grouped into enterprise-readiness categories such as certifications and compliance, data protection, access control, auditability, disaster recovery, and legal/privacy terms.
CCMacronymAn AEAD mode combining counter-mode encryption with a CBC-based authentication tag.
CCPA / CPRAacronymCalifornia's consumer privacy law: rights to know, delete, and opt out of the sale of personal information - amended and hardened by the CPRA.
CDATAacronymAn XML section whose content is not parsed as markup.
CDCiber (Centro de Defesa Cibernética)acronymBrazil's military cyber defence centre, created in 2010 under the Ministry of Defence and later expanded into a full command.
CDNacronymContent Delivery Network: copies of your content cached at edge locations worldwide, so users fetch from nearby instead of from origin.
CE (Customer Edge)acronymA node that connects a customer site into F5 Distributed Cloud.
CERT (team)acronymA team that coordinates response to security incidents.
CERT.br and the CGI.br systemtermBrazil's national computer emergency response team, operated by NIC.br under the multi-stakeholder Brazilian Internet Steering Committee (CGI.br), which also runs the .br registry and the country's internet exchange points.
certificatetermA signed statement binding a public key to a name, valid for a period, issued by an authority the relying party has decided to trust.
Certificate authority (CA)termAn organisation trusted by browsers and operating systems to vouch that a public key belongs to a given name. The set of them a client trusts is its root store - on the order of a hundred-plus organisations across many jurisdictions.
certificate pinningtermRequiring that a server present one specific certificate or public key, rather than any certificate a trusted authority will sign.
Certificate Transparency (CT)acronymThe system requiring publicly issued certificates to be recorded in append-only public logs, with browsers refusing certificates that lack proof of logging - so that any issuance for any domain is observable by anyone.
CGI.brloreComitê Gestor da Internet no Brasil: the multistakeholder Internet Steering Committee created in 1995 by the Science & Technology and Communications ministries to set internet directives and policies in Brazil, including governance of the .br domain.
CGNATacronymCarrier-Grade NAT: the ISP shares one public IPv4 address among many subscribers, translating at provider scale because the addresses ran out.
cgroups (control groups)termThe Linux kernel facility that limits, accounts for and isolates the resource use of a group of processes - processor time, memory, block input and output, network - and one of the two features that make containers possible.
chain analysistermTracing cryptocurrency flows across a public blockchain to follow the money.
chain of custodytermThe unbroken record of who held evidence, when, and what they did with it.
change managementtermThe process by which planned changes are proposed, reviewed, scheduled and recorded.
change management (ITSM)termThe gate through which production changes pass: assessed for risk, scheduled in windows, approved, and rollback-ready.
channel widthtermHow much spectrum one wireless channel occupies - wider carries more per transmission and leaves fewer non-overlapping channels.
Chaos Communication Congress (CCC)termThe annual conference the Chaos Computer Club has run between Christmas and New Year since 1984 - tens of thousands of attendees, numbered by edition, with a summer outdoor sibling, the Chaos Communication Camp.
Chaos Computer ClubloreEurope's oldest and most influential hacker association - German, political, and deeply serious about technology and civil rights.
Chaos MonkeyjargonNetflix's tool that randomly kills production instances, and the name for deliberately injecting failure to prove resilience.
CHAPacronymThe Challenge-Handshake Authentication Protocol - PPP's secure alternative to sending a password in the clear.
Charles-Augustin de CoulombloreThe French engineer who turned the torsion balance into an instrument for measuring charge, and proved the electric force follows an inverse square law.
check layer 1expressionThe first commandment of troubleshooting: before anything clever, confirm the cable, the port, the power.
checksumtermA small value computed from data so a receiver can notice accidental corruption - detection, not correction, and not protection.
Chesterton's fenceexpressionThe principle that you should not remove something until you understand why it was put there.
chkrootkitloreThe Unix rootkit detector written in 1997 by Brazilians Nelson Murilo and Klaus Steding-Jessen - a shell script that uses ordinary system tools to look for the signatures and behavioural traces of known rootkits, and still maintained decades later.
choose boring technologyexpressionDan McKinley's principle: prefer proven, well-understood tools, and spend your few innovation tokens deliberately.
CIA triadtermThe three core goals of information security: confidentiality, integrity, and availability.
CIDRacronymA compact way to write an IP network as an address plus a prefix length, like 10.0.0.0/8.
cipher suitetermThe specific set of algorithms a TLS connection agrees to use for key exchange, encryption, and integrity.
circuit breakertermA pattern that stops calling a failing dependency for a while, so one outage does not drag everything down.
circuit switchingtermReserving a dedicated path end to end for the duration of a conversation, whether or not anything is being sent on it.
Cisco certifications (CCNA / CCNP / CCIE)termThe certification ladder that defined the industry: CCNA to prove you can run a network, CCNP to prove you can build one, CCIE to prove it under lab pressure.
Cisco LivetermThe vendor mega-event that began as Networkers: certification labs, the World of Solutions floor, and the annual pilgrimage of the Cisco-certified.
CISSPacronymThe management-level security certification - (ISC)2's flagship since 1994: eight domains, a mile wide, and the credential security leadership job posts ask for by name.
Citizenfour (2014)loreLaura Poitras's documentary, filmed inside the Hong Kong hotel room where Edward Snowden handed the NSA archive to journalists - the disclosure itself, recorded as it happened, and winner of the 2015 Academy Award for documentary feature.
Citizens Band (CB)termA small licence-free or lightly-licensed radio allocation near 27 MHz with fixed channels and low power limits.
Clarke's third lawexpression'Any sufficiently advanced technology is indistinguishable from magic.'
Claude ShannonloreThe author of the 1948 paper that founded information theory, and, a decade earlier, of the thesis showing that Boolean algebra describes switching circuits.
clean pipejargonInternet transit that arrives already scrubbed of DDoS traffic - the provider filters the flood upstream and delivers only the clean flow.
CLIacronymA text-based interface where you type commands to control software.
client-servertermAn architecture where requesting clients talk to a designated server that holds the resource and answers.
Cliff StolltermThe Berkeley astronomer turned accidental investigator who, told to reconcile a 75-cent accounting discrepancy in 1986, followed it to a West German intruder selling access to US military systems to the KGB - and wrote it up as The Cuckoo's Egg.
Clifford CocksloreThe GCHQ mathematician who in 1973 worked out an implementation of Ellis's idea - equivalent in substance to what became RSA - four years before RSA was published.
Clipper (the xBase compiler)termNantucket's compiler for the dBASE III language, first released in 1985, which turned interpreted database programs into standalone DOS executables; millions of small-business applications were built in it before Computer Associates bought it in 1992, and its last release was CA-Clipper 5.3b in 1997.
ClippyloreMicrosoft's animated paperclip assistant, beloved in memory and despised in use, the cautionary tale of proactive UI.
cloud IAMtermThe permission system of a cloud platform - who and what may call which interface on which resource.
Cloud Security AlliancetermThe industry body that defines how cloud security is assessed and attested.
cloud VPNtermThe managed IPsec tunnel between your premises and your VPC - the quick, encrypted, internet-riding alternative to a dedicated circuit.
CMDBacronymConfiguration Management Database: the inventory of every asset and the relationships between them - what talks to what, and who screams when it dies.
CMTSacronymCable Modem Termination System: the head-end router that owns every cable modem in its footprint, granting each its timeslots and speed tier.
CNAMEacronymA DNS record that makes one name an alias for another.
CNAPPacronymCloud-Native Application Protection Platform: the industry's umbrella merging posture, workload protection, and permissions analysis into one platform.
Co-channel interference (and airtime)termThe throughput loss that occurs when neighbouring access points share a channel: they do not corrupt each other's transmissions, they defer to them, so the available airtime is divided rather than added.
COBITacronymISACA's governance framework for enterprise IT - the auditor's answer to the question ITIL doesn't ask: who decides, who is accountable, and how do we prove it.
Code RedloreThe July 2001 IIS worm that defaced sites with 'Hacked By Chinese!' and infected hundreds of thousands of servers in hours.
code smellexpressionA surface sign in code that hints at a deeper design problem, without being a bug itself.
cold-potato vs. hot-potato routingexpressionTwo philosophies for carrying traffic: hot-potato hands it to the next network as soon as possible; cold-potato keeps it on your backbone as long as possible.
collision domaintermThe stretch of shared network in which two devices transmitting at once garble each other: one collision domain, one conversation at a time.
command and controltermThe channel a compromised host uses to receive instructions and report back.
compilertermA program that translates source code into something a machine can execute - a category Grace Hopper both built and named.
compliancetermDemonstrating that an organisation meets an external requirement - which is a different objective from being secure.
compliance is not securityexpressionThe audit-season reminder that passing a checklist proves documentation, not protection.
Computer InquirytermThe FCC proceedings that drew a line between regulated communications and unregulated data processing.
Concentration risk (internet infrastructure)termThe exposure created when a large share of unrelated organisations depend on the same provider, region, network or authority - so that a single failure, decision or legal order reaches all of them at once.
conditional accesstermSign-in policy with context: who, from which device, from where, at what risk level - and only then, with which second factor, access.
ConfickerloreThe 2008 Windows worm that built one of history's largest botnets and popularized domain-generation algorithms.
configuration driftjargonThe slow divergence between what a system is supposed to look like and what it actually runs.
confused deputytermA privileged service tricked into using its authority on behalf of an unauthorized caller - the deputy is honest, just confused about who is asking.
congestion controltermThe sender's job of inferring how much the network can carry and slowing down before it collapses - distinct from flow control, which protects the receiver.
consensustermThe problem of getting several machines to agree on one value when any of them may be slow, may fail, and cannot tell those apart.
consent (privacy)termOne lawful basis among several: a freely given, specific, informed, unambiguous yes - revocable as easily as it was given.
containertermA process isolated by kernel features rather than by a separate operating system - sharing the host's kernel with everything else running on it.
containmenttermLimiting how much a fault affects, without addressing why it happened.
Content Security PolicyacronymA browser policy that restricts what a page may load and run, to blunt attacks like XSS.
control frameworktermA published set of controls used as a common reference - so an organisation can describe what it does in terms others recognise.
control planetermThe part of a system that makes decisions, as opposed to the data plane that moves the traffic.
Conway's lawexpressionThe observation that systems end up mirroring the communication structure of the organizations that build them.
cookie bannertermThe consent interface for non-essential tracking - born of the ePrivacy rules and GDPR consent standards, degraded by design into a click-through ritual.
coordinated disclosuretermReporting a defect privately, agreeing a deadline, and publishing after the fix - the compromise the field settled on between full disclosure and silence.
CopylefttermA licensing mechanism (the GPL family) that permits modification and redistribution on one condition: the redistributed version must carry the same freedoms forward. Copyright law used against its usual grain - the share-alike rule is the mechanism, the pun is the philosophy.
Correlated failuretermFailures that happen together because the things that failed share something - a control plane, a configuration pipeline, a provider, a physical route - rather than failing independently as a redundancy calculation assumes.
CORSacronymThe browser mechanism that decides whether a web page may make requests to a different origin.
CORS preflighttermThe OPTIONS request a browser sends first, asking the server's permission, before it is willing to send certain cross-origin requests at all.
CortextermPalo Alto Networks' security-operations family, announced in February 2019: detection, response, and automation for the SOC.
COSacronymCorporation for Open Systems: a vendor consortium formed to certify OSI conformance.
Countdown to Zero Day (Zetter, 2014)loreKim Zetter's reconstruction of Stuxnet: how a worm carrying four zero-days crossed an air gap into Natanz, spun Iranian centrifuges to destruction while replaying recorded normal readings to the operators, and was found only because it escaped into the wild.
cowboy codingjargonDevelopment with no process between the idea and production: no review, no tests, no branch, just push.
CPEacronymCustomer Premises Equipment: any provider-managed device at the customer site - modem, ONT, router - the equipment half of every 'is it you or is it me?' call.
Craig NewmarkloreProgrammer whose 1995 email list of San Francisco events became Craigslist, the site that moved classified advertising onto the internet and, by the same act, out of the newspapers.
crash cartjargonThe wheeled cart with a monitor, keyboard, and cables that gets pushed to a server that stopped answering the network.
credential stuffingtermAutomated login attempts using username and password pairs stolen from other breaches.
CRIMEloreA 2012 attack recovering secrets by observing the size of compressed TLS requests.
Cristine HoeperstermThe general manager of CERT.br, Brazil's national incident response team, where she has worked on incident handling since 1999 - and the researcher most responsible for the country's honeypot measurement work and for helping new incident response teams get founded across Latin America.
CRLacronymA published list of certificates that have been revoked.
cross-border data transfertermMoving personal data between jurisdictions - lawful only through recognized mechanisms: adequacy decisions, contractual clauses, or specific exceptions.
Cross-device authentication (CDA)termThe flow that lets a passkey held on one device authorise a sign-in on another - the site displays a code, the phone scans it, and the two link over Bluetooth Low Energy using the CTAP hybrid transport.
Crossover cabletermA patch cord wired T568A on one end and T568B on the other - once required to connect like devices, now made obsolete by auto-MDIX.
crown jewelsjargonThe small set of assets whose compromise would actually hurt: the data, keys, and systems the business cannot lose.
CRUDacronymThe four basic operations of persistent storage: create, read, update, and delete.
cruftjargonThe accumulated leftover junk in a system - old configs, dead code, objects nobody dares delete.
crunchy outside, chewy centerexpressionThe classic critique of perimeter-only security: a hard shell around a soft, defenseless inside.
CryptoRaveloreSão Paulo's crowdfunded cryptoactivism marathon: 24 uninterrupted hours of privacy, security, and digital-rights activities - free, volunteer-run, and pointedly without corporate sponsorship.
CSA STARacronymThe Cloud Security Alliance's public registry of cloud-provider security postures - self-assessment through third-party certification.
CSMA/CAacronymWi-Fi's channel etiquette: a radio cannot hear a collision while it is transmitting, so stations work to avoid collisions up front with waits, random backoff, and per-frame acknowledgements.
CSMA/CDacronymClassic Ethernet's channel etiquette: listen before you talk, talk only when the wire is quiet, and if two stations collide anyway, stop, jam, and retry after a random backoff.
CSPMacronymCloud Security Posture Management: continuous scanning of cloud configuration against best practice - the tool that finds the public bucket before the researcher does.
CSRacronymA signed request containing the public key and details for a certificate.
CSRFacronymAn attack that tricks a logged-in user's browser into making an unwanted request.
Cult of the Dead Cow (cDc)termThe oldest continuously active hacker group in the United States, formed in Lubbock, Texas in 1984 - equal parts security research, absurdist zine and political theatre. It coined the word hacktivism and shipped the remote-administration tool Back Orifice at DEF CON in 1998 to humiliate Microsoft into taking Windows security seriously.
Cunningham's lawexpressionThe observation that the best way to get a right answer online is to post a wrong one.
CVEacronymA public catalogue entry that uniquely identifies one specific known vulnerability.
CVSSacronymA standard 0 to 10 score that rates the severity of a vulnerability.
CWEacronymA community catalog of software weakness types, each with a stable identifier like CWE-787.
CWNP / CWNAacronymThe vendor-neutral Wi-Fi certification body - and CWNA, its flagship: the credential that proves you understand radio, not just controllers.
CWPPacronymCloud Workload Protection Platform: runtime defense for the workloads themselves - VMs, containers, functions - vulnerabilities, integrity, and behavior.
Cyber EssentialstermThe UK government's baseline cyber-hygiene certification, run by the NCSC.
Cyberpunk (Hafner and Markoff, 1991)loreKatie Hafner and John Markoff's 1991 book telling three long-form stories from the 1980s underground: the young Kevin Mitnick and his Los Angeles circle, the German KGB hackers around Hanover, and Robert Morris and his worm.

118

"deleting a file erases it"loreDisputed / commonly mistoldDelete removes the directory entry and marks the space reusable - the bytes remain until overwritten, which recovery tools exploit daily.
DADacronymAn IPv6 check that a chosen address is not already in use.
daemontermA long-running background process that waits quietly to do its job, named after a benevolent spirit, not a demon.
Dan KaminskyloreThe researcher who found the 2008 DNS cache-poisoning flaw that affected every resolver at once, and then coordinated the simultaneous multi-vendor patch rather than publishing it.
Daniel J. BernsteinloreThe cryptographer and programmer behind qmail and djbdns, and of the curve and cipher designs now widely deployed - and the person who put money behind a security guarantee for his own software.
Daniel KarrenbergloreGerman network engineer who helped build EUnet, wrote the report that argued Europe should run TCP/IP, co-founded RIPE, and in 1992 set up the world's first regional internet registry - intending to be finished with the internet a year later.
Danny CohenloreThe engineer who put real-time voice and video onto a packet network in 1973, by adapting a flight simulator.
dark fibertermInstalled but unlit fiber strands leased as raw glass: the customer brings the optics and owns the capacity ceiling.
dark launchjargonShipping a feature to production silently, running it on real traffic before any user can see it.
dark webtermThe subset of the deep web reachable only through anonymity networks, where sites hide their location as well as their content.
darknettermAn overlay network that runs on the public internet but is reachable only with specific software, configuration, or authorization.
DARPA (Defense Advanced Research Projects Agency)acronymThe United States defence research agency created in 1958, and the funder of the network that became the internet.
data at resttermData sitting in storage rather than moving - and, usually, shorthand for encrypting it there.
data breach notificationtermThe legal duty to report a personal-data breach to the authority and, when risk is high, to the affected people - on a clock that starts at discovery.
data brokertermA company whose product is other people: profiles assembled from purchases, apps, public records, and location trails, sold to whoever pays.
Data center tierstermThe Uptime Institute's I-to-IV classification of data-center resilience - from basic capacity to fault tolerance.
Data centre operatortermColocation, hosting and interconnection: the businesses that own the places where networks physically meet.
data classificationtermDeciding which data is sensitive and how each class must be handled - the step every other data control depends on.
data controllertermThe party that decides why and how personal data is processed - and therefore the one accountable for it.
data in transittermData moving across a network - and the encryption applied so that whoever carries it cannot read it.
data minimizationtermCollecting and keeping only the personal data you actually need, for only as long as you need it.
Data PBXtermA switch that connected terminals to computers the way a PBX connected telephones to lines.
data portabilitytermThe right to take your data with you in a machine-readable format - and, where feasible, have it sent straight to the next provider.
Data Privacy FrameworktermThe mechanism for lawfully transferring personal data from the EU/UK/Switzerland to certified US companies.
data processing agreementtermThe contract binding a processor to the controller's instructions: security measures, sub-processors, breach duties, and deletion at the end.
data processortermThe party processing personal data on a controller's documented instructions - the cloud provider, the SaaS, the payroll bureau.
data residencytermRequirements that certain data physically remain within a jurisdiction's borders - law expressed as region selection.
data retentiontermKeeping data only as long as its purpose requires, then deleting on schedule - the discipline that shrinks both risk and discovery scope.
data storetermA reusable connection definition to an external identity source - an LDAP directory with failover hosts and a service bind, or a JDBC database with its driver and validation query - configured once and referenced by validators, attribute lookups, and provisioning.
David ClarkloreThe architect who put the internet's governing philosophy into one sentence in 1992: no kings, no presidents, no voting - rough consensus and running code.
David FarberloreThe organiser of CSNET, and one half of the 1981 agreement that let one network's traffic cross another's without anyone counting it.
dBASE (II, III, IV)termThe microcomputer database management system and programming language Ashton-Tate sold from 1980 as dBASE II, the most successful of its day: a database engine, a query system, a forms engine and a language in one package, whose dialect became the xBase family of dBASE III, FoxPro and Clipper.
DCVacronymProving you control a domain before a certificate is issued.
DCWF (DoD Cyber Workforce Framework)acronymThe United States Department of Defense's own catalogue of cyber work roles, aligned with but distinct from the NICE Framework.
DDoSacronymAn attack that overwhelms a service with traffic from many sources at once.
dead droptermA method of passing information without the parties ever meeting.
debuggingtermThe systematic process of finding and fixing defects in software.
DECnetloreDigital Equipment Corporation's networking suite - the protocol that ran the VAX era, evolving from proprietary roots toward OSI.
dedicated interconnecttermA private physical circuit from your premises into the cloud provider's edge - predictable latency, real bandwidth, no public internet in the path.
Deep BlueloreThe IBM machine that defeated world chess champion Garry Kasparov in May 1997, the first machine victory over a reigning champion in match play.
deep webtermEverything on the web that search engines do not index, which is most of it.
DEF CONloreThe world's largest hacker conference - Las Vegas every August since 1993 - and the cultural center of gravity of the scene.
DEF CON GoonstermThe volunteer staff who run DEF CON - identifiable by their red shirts, and the reason a conference of tens of thousands of hackers works at all. Goons handle lines, rooms, speakers, contests, safety and the moment something goes wrong, and every one of them pays their own way to be there.
default routetermThe route of last resort - 0.0.0.0/0 - matching everything no more specific route claims; the packet's way out of the building.
default-free zonejargonThe part of the internet whose routers carry the full routing table and no default route - nowhere to forward blindly.
defense in depthtermLayering multiple independent controls so that if one fails, others still stand.
DEFLATE, gzip and zlibtermThe compression algorithm inside ZIP, PNG, Git and most of the web; the file format that wraps it; and the library that implements both.
demarcation pointtermThe contractual boundary where the provider's network ends and the customer's begins - and with it, whose problem the fault is.
Demi GetschkotermThe engineer on the team that made Brazil's first internet connection, at FAPESP in São Paulo, and the person most associated with the country's naming and governance ever since - administrative contact for the .br domain since 1989, member of the Brazilian Internet Steering Committee since its creation in 1995, later an ICANN board member and chief executive of NIC.br.
Dennis RitchieloreThe creator of the C programming language and co-creator of Unix, and joint recipient with Ken Thompson of the 1983 Turing Award for the development of generic operating systems theory and the implementation of Unix.
dependency helljargonThe state where software cannot be installed or upgraded because its dependencies' versions conflict.
deprovisioningtermRemoving an identity's access when a person leaves or a role changes - the half of the lifecycle nobody is waiting on.
DERacronymA strict binary encoding for X.509 certificates and keys.
designated routertermThe router an OSPF broadcast network elects to speak for the segment, with a backup designated router ready to replace it.
Detection engineeringtermTreating each detection as an engineered artefact rather than a switch: a stated hypothesis, the data it requires, logic under version control, a test that proves it fires, a false-positive budget, a named owner and a documented response.
Deviant OllamloreThe physical security researcher and TOOOL member whose lockpicking talks put the discipline in front of network audiences that had never considered the door.
device drivertermThe software that teaches the operating system to speak to a specific piece of hardware - and the first suspect when that hardware misbehaves.
DevSecOpstermA culture and practice of building security into development and operations, not bolting it on.
DFacronymAn F5 hardware designation for a dual-fan platform variant.
DHacronymA method for two parties to agree on a shared secret.
DHCPacronymThe protocol that gives an IPv4 host its address and settings, such as mask, router and DNS servers, usually on a time-limited lease.
DHCP option 43termThe DHCP option that carries vendor-specific information, such as the controller address a wireless access point needs.
DHCP option 82termThe relay information option: the access device stamps each DHCP request with the physical line it arrived on, giving the ISP per-port identity.
DHCP relay agenttermA router or host that passes DHCP messages between clients on one subnet and a DHCP server on another.
DHCP snoopingtermA switch feature that only allows address-assignment replies from ports you have declared trustworthy.
DHCPv6acronymThe IPv6 version of DHCP: a server leases addresses, delegates prefixes or simply hands out options such as DNS servers.
DICTacronymA protocol for querying network dictionary servers.
differential privacytermA mathematical guarantee: query answers barely change whether or not any one person is in the dataset - privacy as provable noise.
DigiNotar (2011)loreThe Dutch certificate authority compromised in 2011, whose fraudulently issued certificates for major services were used to intercept traffic in Iran - and which went bankrupt within weeks of the disclosure.
digital signaturetermA cryptographic proof that a message came from a specific key holder and was not altered.
Dijkstra's algorithmtermThe shortest-path method link-state routers run: the closest tentative node's distance is final, so it is fixed next.
discard routetermA route for a summary prefix whose next hop is nowhere, so traffic for unreachable parts of the summary is dropped.
DistributortermA company that sells to resellers rather than to the organisations that use the equipment - the middle tier of two-tier distribution.
DKIMacronymAn email-authentication method that cryptographically signs messages.
DLPacronymData Loss Prevention: recognizing sensitive data - card numbers, records, secrets - and stopping it from leaving through email, uploads, or clipboards.
DMARCacronymAn email policy in DNS under which mail passes only if an SPF or DKIM pass is aligned with the domain in the visible From.
DMZacronymDemilitarized zone: the buffer network between the internet and the inside, where public-facing servers live under stricter watch.
DNSacronymThe distributed, hierarchical naming system that maps names such as example.com to addresses and other typed data.
DNS filteringtermBlocking or rewriting DNS answers to stop clients reaching chosen domains.
DNS header flagstermThe one-bit fields of a DNS message header, qr, aa, tc, rd, ra, ad and cd, that dig prints on its flags line.
DNS over HTTPSacronymSending DNS lookups inside encrypted HTTPS so they cannot be read or tampered with in transit.
DNSKEYacronymThe DNS record that publishes a zone's public signing key.
DNSSECacronymExtensions that add origin authentication and integrity to DNS data, with signatures a validating resolver can check.
Do Not TracktermThe browser header that politely asked sites not to track - and, lacking any legal force, was almost universally ignored.
DOCSISacronymThe standard that turns cable-TV coax into broadband, sharing spectrum among a neighborhood of modems under one CMTS scheduler.
DoD (United States Department of Defense)acronymThe United States Department of Defense.
dogfoodingjargonUsing your own product internally, so its failures bite you before they bite customers.
DoHacronymDNS queries sent inside HTTPS, indistinguishable from ordinary web traffic.
don't roll your own cryptoexpressionThe first commandment of applied cryptography: use the vetted algorithms and libraries, never your homemade ones.
Donald DaviesloreThe National Physical Laboratory scientist who arrived at the same idea independently in the mid-1960s, named it packet switching, and built a working network at NPL to prove it.
DongleloreDisputed / commonly mistoldA small piece of hardware you plug into a port to make something work: originally to prove you had paid for software, now usually to give a machine back a capability it shipped without.
DORAacronymShorthand for the four messages of a first DHCP lease: DHCPDISCOVER, DHCPOFFER, DHCPREQUEST and DHCPACK.
DoTacronymDNS queries carried inside TLS on their own port, 853.
Douglas ComerloreThe Purdue professor who wrote the books that taught a generation how the internet actually works.
Douglas EngelbartloreThe engineer who demonstrated the mouse, hypertext, windows, word processing and video conferencing in a single session on 9 December 1968 - the presentation now called the Mother of All Demos.
DPDacronymDead Peer Detection - how an IPsec endpoint learns its IKE partner is gone: an on-demand are-you-there exchange, so dead tunnels get torn down and failover can happen.
DPI (Deep Packet Inspection)acronymExamining traffic beyond its headers to classify what protocol or application it carries - used legitimately for network management and troubleshooting, and equally for blocking, throttling and surveillance.
DPIAacronymData Protection Impact Assessment: the structured 'what could this do to people?' analysis required before high-risk processing begins.
DPOacronymData Protection Officer: the designated guardian of a data protection program - advisor inside, contact point for regulators and data subjects outside.
DragonJARloreColombia's leading hacker conference, grown out of the DragonJAR community - and deliberately delivered entirely in Spanish.
drift detectiontermSpotting the gap between infrastructure as declared and infrastructure as it actually is - the console edit that code never knew about.
drink the Kool-AidexpressionTo adopt a belief or technology with uncritical, group-driven enthusiasm.
drinking from the firehoseexpressionAbsorbing information far faster than anyone could - the universal description of onboarding into a complex system.
drop cabletermThe final cable from the pole, pedestal, or splitter box to the customer's building - the piece of plant most exposed to weather, trees, and trucks.
DROWNloreA 2016 attack that breaks TLS by exploiting a server's support for obsolete SSLv2.
DRYexpressionThe principle that every piece of knowledge should have a single, authoritative representation in a system.
DS-LiteacronymA broadband design that carries subscribers' IPv4 inside IPv6 to a carrier NAT, so the access network can be IPv6-only.
DSARacronymData Subject Access Request: a person exercising their right to see the data held about them - and the clock that starts when they ask.
DSLAMacronymDSL Access Multiplexer: the exchange-side rack that terminates hundreds of copper DSL lines and hands their traffic to the backhaul.
DTLSacronymTLS adapted to run over UDP instead of TCP.
dual stacktermRunning IPv4 and IPv6 side by side on the same hosts and links - the standard transition strategy while both internets coexist.
dumpster divingjargonRecovering sensitive information from the trash - printouts, sticky notes, unwiped drives.
duplextermWhether a link can carry traffic in both directions at once, or must take turns.
duplex mismatchtermOne end at full duplex, the other at half: the link works, slowly and with late collisions - the classic 'network is weird' root cause of the 2000s.
DVD Jon (Jon Lech Johansen)termThe Norwegian teenager who in 1999 co-released DeCSS, the program that decrypted DVD content scrambling so films could be played on Linux, and who was prosecuted twice in Norway and acquitted both times.
DVMRPacronymDistance Vector Multicast Routing Protocol - the first multicast routing protocol, and the engine of the MBone: RIP's logic, pointed at delivery trees.
DWDMacronymDense Wavelength Division Multiplexing - many independent light colors down one fiber. The reason a single strand can carry terabits and the backbone of every long-haul network.
Dwell timetermHow long an intruder is inside before anyone notices - measured from first compromise to detection, and the single most honest number a security programme reports about itself.

69

E1acronymThe international 2.048 Mb/s digital carrier - 32 timeslots of 64 kb/s, the E-carrier answer to T1, and the line Brazilian networking grew up on.
EAPacronymThe Extensible Authentication Protocol of RFC 3748: a framework of four packet codes that carries any of dozens of authentication methods between a peer and an authenticator, usually over PPP or Ethernet, without needing IP.
EAP-FASTacronymFlexible Authentication via Secure Tunneling, Cisco's EAP Type 43 of RFC 4851: a TLS tunnel that can be established with a Protected Access Credential rather than a server certificate, with the real authentication carried as TLVs inside it.
EAP-MSCHAPv2acronymMicrosoft's CHAP version 2 of RFC 2759, a challenge-response that proves a password without sending it and adds mutual authentication, carried inside EAP and, in practice, inside the PEAP or EAP-TTLS tunnel.
EAP-pwdacronymEAP Authentication Using Only a Password, RFC 5931 at EAP Type 52: a password-authenticated key exchange that is secure against offline dictionary attacks even with a weak password, and needs no certificates or PKI on either side.
EAP-SIM and EAP-AKAacronymThe EAP methods that let a mobile operator's SIM authenticate a device to a network: EAP-SIM (RFC 4186, Type 18) using GSM credentials and EAP-AKA (RFC 4187, Type 23) using the UMTS Authentication and Key Agreement of the USIM.
EAP-TLStermWireless and wired authentication using certificates on both sides, rather than a shared password.
EAP-TTLSacronymEAP Tunneled TLS of RFC 5281, EAP Type 21: a TLS tunnel authenticated by the server, inside which the client can authenticate with almost anything, including PAP, CHAP, MS-CHAP and MS-CHAP-V2 as well as another EAP method.
east-west / north-south trafficexpressionThe two axes of data-center traffic: north-south crosses the perimeter to users; east-west flows between servers inside.
easter egg headerjargonA response header that carries a tribute, a joke or an invitation, placed where only people who read headers will find it.
eBGP and iBGPacronymThe two kinds of BGP session: external, between routers in different autonomous systems, and internal, within one.
ECDHacronymElliptic-curve key exchange - the non-ephemeral form lacks forward secrecy.
ECDHEacronymA key-exchange method that gives every session its own throwaway keys, so past traffic stays safe if a long-term key leaks.
ECDSAacronymA signature algorithm using elliptic curves - smaller keys than RSA for the same strength.
ECMAacronymA standards body behind JavaScript and JSON specifications.
ECMPacronymEqual-Cost Multi-Path: when several routes tie on cost, traffic is hashed across all of them - free load sharing, per flow, not per packet.
ECSacronymAn EDNS option that forwards part of the client's address to the authoritative server.
edge computingtermRunning computation near where data is produced or consumed, instead of sending it to a central location first.
EDNSacronymAn extension that adds capabilities to the original DNS message format.
EDRacronymEndpoint Detection and Response: the agent that records what endpoints do - processes, connections, changes - detects the malicious, and can isolate the host.
Edward SnowdentermThe NSA contractor who in 2013 handed journalists a large archive of documents on US and allied signals-intelligence programmes, then left for Hong Kong and eventually Russia, where he remains beyond the reach of American prosecution.
Edward WestonloreThe engineer who made electricity measurable in the field, with the first accurate portable direct-reading meters and a cell stable enough to calibrate them.
EFFacronymThe nonprofit defending civil liberties in the digital world - and the maker of Certbot.
EFnet (Eris Free Net)loreOne of the oldest surviving IRC networks, formed in 1990 when a set of servers removed a machine called Eris that accepted connections from anyone - the name is short for Eris Free Net, and it is a policy stated as a network topology.
EGPacronymExterior Gateway Protocol - the class of protocols that route BETWEEN autonomous systems, and also the name of the specific 1980s protocol BGP replaced.
egress costtermThe per-gigabyte charge for data leaving the cloud - in is free, out is billed, and architecture quietly bends around that asymmetry.
egress feetermWhat a cloud provider charges for data leaving its network - typically free to receive and priced to send.
egress filteringtermControlling what may leave the network, not just what may enter - the outbound rules that starve malware of its command channel.
EHFacronymAn out-of-band fix F5 issues for a specific urgent problem.
EIA/TIAacronymThe standards lineage behind structured cabling - the TIA-568 family that defines the categories, connectors, and distances of every wiring closet.
EIGRPacronymEnhanced Interior Gateway Routing Protocol - Cisco's advanced distance-vector protocol: the DUAL algorithm keeps loop-free backup routes precomputed, so convergence is nearly instant.
EkopartyloreLatin America's biggest hacking conference: Buenos Aires, every year since 2001, where the region's security community - and more than a few world-class vulnerabilities - come out on stage.
elastic IPtermA static public address you own and can remap between instances - identity that survives the workload behind it.
elephant flowjargonA single long-lived flow so large it dominates a link - one elephant among thousands of mice.
ELIZAloreJoseph Weizenbaum's 1966 chatbot whose users confided in a pattern-matching script, naming the ELIZA effect.
Elizabeth FeinlerloreThe information scientist who ran the Network Information Center from 1972 to 1989 - the Host Naming Registry for the whole internet - and whose group devised the .com, .edu, .gov, .mil, .org and .net scheme and built the first WHOIS server.
EmacstermThe extensible editor from the GNU project, closer to a programmable environment that happens to edit text.
Embedded systemtermA computer built into something that is not thought of as a computer, with a fixed job and usually nobody watching it.
EMBRATELloreEmpresa Brasileira de Telecomunicações: Brazil's long-distance and data carrier, created in 1965 and folded into the Telebrás system; ran the country's first commercial internet trial in December 1994; privatized in 1998 to MCI WorldCom, sold to Telmex in 2004, incorporated into Claro in 2015.
Emmanuel Goldstein (Eric Corley)termThe editor of 2600: The Hacker Quarterly since 1984, host of the radio programme Off The Hook, and founder of the HOPE conferences - the closest thing the American underground has to a permanent institution, named for Orwell's fictional dissident.
encodingtermRepresenting data in a form a particular channel or reader can carry - a reversible transformation with no secrecy and no integrity attached.
encryption is easy, key management is hardexpressionThe crypto veteran's summary: encrypting data is the easy part; protecting, rotating, and not losing the keys is the hard part.
end-to-end encryptiontermEncryption where only the communicating endpoints can read the messages, not the servers in between.
endianness (On Holy Wars)loreThe byte-ordering split whose names Danny Cohen borrowed from a satirical war in Gulliver's Travels.
ENEacronymEnterprise Network Event: the 1988 trade show positioned as the OSI counterpart to the TCP/IP demonstrations.
ENIacronymElastic Network Interface: the cloud's detachable virtual NIC - addresses, security groups, and MAC that can move between instances.
entropytermA measure of unpredictability; in security, the randomness that makes keys and secrets hard to guess.
envelope encryptiontermEncrypting data with a data key, then encrypting that key with a master key - bulk work done locally, the crown jewel guarded centrally.
EOLacronymEnd of life: the date after which a product receives no fixes, no patches, and no vendor sympathy.
ephemeral keytermA short-lived key generated for a single session and then discarded.
EPSSacronymA data-driven score estimating the odds a vulnerability gets exploited.
ES256acronymA JWT signing algorithm: ECDSA with SHA-256.
escalationtermMoving a ticket up - functionally to deeper expertise, hierarchically to management - when the current tier cannot or should not resolve it.
escalation (operational)termHanding a problem to someone with more authority, more knowledge, or the ownership needed to act on it.
ESPacronymThe IPsec protocol that encrypts and authenticates packet payloads.
ETagtermAn opaque identifier for a specific version of a resource, used to ask whether a cached copy is still current.
EternalBlueloreThe NSA-developed SMB exploit leaked in 2017 that powered WannaCry and NotPetya.
EthernettermThe LAN technology sketched at Xerox PARC in 1973 that won every networking war and now carries almost everything.
EtherTypetermThe two-octet field after an Ethernet frame's addresses that names the protocol inside: 0x0800 for IPv4, 0x86DD for IPv6, 0x0806 for ARP.
EUIacronymAn IEEE identifier format used to build IPv6 interface IDs.
event logtermThe operating system's diary of errors, warnings, and audits - where 'it just crashed' becomes a source, an ID, and a timestamp.
everything fails, all the timeexpressionWerner Vogels' cloud axiom: at sufficient scale, failure is not an event but a permanent background condition.
exfiltrationtermGetting stolen data out - the stage where an intrusion becomes a breach with consequences.
exit nodetermThe final Tor relay, where traffic leaves the network toward its destination.
exit scamtermWhen an operator suddenly shuts down and disappears with users' funds.
EXOSacronymExtreme Networks' switch operating system.
ExpecttermThe Tcl extension, written by Don Libes in 1990, that automates programs which only offer an interactive terminal.
exploittermCode or a technique that turns a vulnerability into actual unintended behaviour.
eyeball networkjargonAn ISP whose customers are people watching screens - the networks where the eyeballs are.

58

"forced password changes make you safer"loreDisputed / commonly mistoldMandatory 90-day rotations trained people into Password1, Password2 - predictable mutations attackers model. Current guidance: long unique passphrases, changed on evidence of compromise.
F5 DevCentraltermF5's official technical community - articles, Q&A, and two decades of iRules knowledge, with a recognized MVP program.
FA (Fabric Attach)acronymA protocol that auto-attaches edge switches to an Ethernet fabric.
Fabio AssolinitermThe Brazilian malware analyst on Kaspersky's Global Research and Analysis Team whose published work is the main public record of how Brazilian banking fraud actually operates - boleto manipulation, overlay attacks and the families that became known as the Tetrade.
fail open vs. fail closedexpressionThe design choice of what a control does when it breaks: allow everything through, or block everything.
failovertermMoving service from a failed component to a standby, restoring availability without repairing the fault.
FAPESPloreFundação de Amparo à Pesquisa do Estado de São Paulo: São Paulo's research-funding foundation whose data-processing team built Brazil's academic network (ANSP), received Jon Postel's delegation of the .br domain in 1989, made the country's first TCP/IP connection in 1991 (to ESnet via Fermilab), and ran .br registration until NIC.br took over.
fat-fingerjargonTo cause an outage with a typo - the wrong command, the wrong device, or one digit off in a config line.
fault tolerancetermContinuing to provide service while something is broken - which requires deciding in advance which failures are survivable and paying for that in redundancy.
FCSacronymThe four-octet checksum at the end of an Ethernet frame, a CRC-32 the receiver recomputes to detect corruption.
federationtermAccepting an identity proven somewhere else, so a user authenticated by their own organisation can reach a service run by another.
Federico KirschbaumtermCo-founder of Ekoparty (2001) and, with Francisco Amato, of Infobyte - the Argentine research company behind Faraday, the collaborative penetration-testing platform.
FedRAMPacronymThe US government's standardized security-authorization program for cloud services - High, Moderate, and Low baselines.
FenasoftloreBrazil's giant computing fair of the 1990s: the Anhembi pavilions, endless entry queues, and a nation meeting the personal computer - all at once.
file inclusiontermGetting an application to read or execute a file the caller chose, by controlling a path it builds from input.
Filipe BalestratermCo-organiser of the Hackers to Hackers Conference in Sao Paulo alongside Rodrigo Rubira Branco, founder of PRIDE Security, and a researcher whose published work includes automated teller machine jackpotting. He took sole leadership of H2HC from 2025.
FIPSacronymUS government standards for cryptography and computer security.
firefightingjargonOperating in permanent emergency mode: all effort goes to the incident of the day, none to preventing the next one.
firewalltermA device or function that decides which traffic may pass between networks, enforcing a policy at a boundary.
FirmwaretermCode stored in a chip of a device and run from its processor's reset vector, or as an extension of other firmware.
Firmware vs softwareexpressionThe distinction a vendor draws between code that is part of the device and code that runs on top of it - and the reason it decides who fixes your problem.
FIRST (org)acronymThe global body of incident-response teams behind CVSS and EPSS.
first-call resolutiontermThe percentage of issues closed in the first contact, no callbacks, no escalation - the metric that best predicts user happiness.
five ninesjargon99.999% availability - about five minutes of downtime allowed per year.
five-tupletermThe connection's fingerprint: source IP, source port, destination IP, destination port, protocol - the key by which firewalls, NATs, and balancers track flows.
flag dayjargonA cutover where everything must change at once, with no coexistence between old and new.
flappingjargonAn interface or route that keeps going down and up, down and up - never quite dead, never quite stable.
FLOSSacronymAn umbrella term for software that is both free (as in freedom) and open source.
flow logstermThe cloud's NetFlow: records of accepted and rejected connections per interface, subnet, or VPC - who talked to whom, and who was refused.
foo / barloreThe canonical placeholder names in programming examples, used when the specific name does not matter.
footgunjargonA feature or API so easy to misuse that it invites you to shoot yourself in the foot.
forensicstermEstablishing what happened on a system, in a way that survives being questioned afterwards.
forklift upgradejargonAn upgrade so total that the old equipment leaves on a forklift - nothing is reused, everything is replaced.
Fortinet CommunitytermFortinet's official user community - forums, knowledge-base articles, and ideas exchange for the FortiGate ecosystem.
Fórum Brasileiro de CSIRTstermThe annual meeting of Brazilian incident response teams, organised by CERT.br, now in its fourteenth edition and paired with a workshop on MISP, the open-source threat-intelligence sharing platform.
forward proxytermA server that sits in front of clients and forwards their outbound requests.
forward secrecytermA property that keeps past sessions safe even if the server's long-term key is later stolen.
Forwarding profiletermZCC's traffic-plumbing document: for each network state (on/off/VPN trusted) it assigns the forwarding action - Z-Tunnel 1.0/2.0, Tunnel with Local Proxy, Enforce Proxy, or None for ZIA; Tunnel or None for ZPA.
FPGAacronymField-Programmable Gate Array: a chip whose logic can be rewired after it is manufactured.
FQDNacronymA complete domain name that specifies a host's exact location in DNS.
fragmentationtermSplitting a packet because it is larger than a link along the path will carry.
Frame RelaytermThe packet-switched WAN service that replaced X.25 and defined enterprise connectivity in the 1990s and 2000s.
Francisco AmatotermCo-founder of Ekoparty and of Infobyte, and the author of Evilgrade - the framework that demonstrated how software update mechanisms could be abused to deliver attacker-supplied code to a victim who was doing exactly what security advice told them to do.
FREAKloreA 2015 attack forcing servers to use weak, factorable export-grade RSA keys.
free as in beerexpressionThe disambiguation of 'free software': gratis (free beer) versus libre (free speech) - price versus liberty.
Free software (software livre)termSoftware whose users have the four freedoms of the Free Software Definition: run for any purpose (0), study and change (1, which requires source), redistribute copies (2), and distribute modified versions (3). Free refers to liberty, not price - free as in freedom, not free as in beer.
frobnicatejargonTo fiddle with a setting or object, adjusting it without deep intent - classic hacker-dictionary vocabulary.
FTPacronymAn old, unencrypted protocol for transferring files between hosts.
FTPSacronymFTP wrapped in TLS to encrypt the control and data channels.
FTTHacronymFiber to the Home: optical fiber running the entire last mile into the residence, with no copper or coax remainder.
FUBARloreSlang for something broken beyond any reasonable repair.
FUDacronymA tactic of spreading fear, uncertainty, and doubt to undermine a competitor or idea.
full tablejargonThe complete set of internet routes, taken over BGP from a transit provider - the whole map, not a summary.
full-disk encryptiontermEncrypting the entire drive so a lost or stolen machine leaks nothing - BitLocker, FileVault, LUKS - unlocked at boot, transparent after.
Furukawa (Lightera)termFurukawa Electric LatAm - the name on Brazil's structured cabling for decades: the Curitiba-based operation of Japan's 1884-founded Furukawa Electric, whose cabling brand now carries the Lightera name.
fusion splicetermJoining two fibers by melting them together in an arc - the lowest-loss, permanent way to connect glass, at about 0.02 dB.
fuzzingtermFeeding a program vast quantities of malformed or random input to see what makes it crash.
Fyodor (Gordon Lyon) and NmaptermThe author of Nmap, published in Phrack in 1997 and still the standard port scanner and host-discovery tool - the program that taught the industry what its own networks actually expose.

48

Gall's lawexpressionA complex system that works is invariably found to have evolved from a simple system that worked.
GambiarraloreDisputed / commonly mistoldBrazilian Portuguese, feminine noun. An improvised fix built from whatever is to hand - precarious, unorthodox, and working. The word carries admiration and disapproval at the same time, and Brazilians hear both.
Garoa Hacker ClubeloreSao Paulo's hackerspace - one of Brazil's first, and the room where BSidesSP was born.
Gary McKinnontermThe Scottish systems administrator who between 2001 and 2002 wandered through dozens of US military and NASA computers looking, by his own account, for suppressed evidence of free-energy technology and UFOs - and who found his way in largely through blank and default passwords.
gatewaytermThe address a host sends to when the destination is not on its own network, and, more generally, any device that translates between two systems.
GCMacronymAn AEAD mode that turns AES into an authenticated cipher using a counter and a nonce.
GDBacronymThe GNU debugger: it runs a program under control so you can stop it, inspect it, and step through it.
GDPRacronymThe European Union's comprehensive data protection law, in force since 2018.
generative AItermSystems that produce new text, images, audio or code rather than classifying or ranking existing material.
GENEVEacronymGeneric Network Virtualization Encapsulation: a tunnelling format designed to carry arbitrary metadata rather than a fixed set of fields.
Georg OhmloreThe German physicist whose 1827 law relates voltage, current and resistance - the first thing anyone learns about circuits, and the last thing they stop using.
George BooleloreThe mathematician who in 1854 built an algebra of logic, ninety years before anyone had a machine to run it on.
George Hotz (geohot)termThe New Jersey teenager who in 2007, at seventeen, performed the first unlock of the original iPhone from AT&T, and who in 2010 published the root keys of the PlayStation 3 after Sony removed its Linux feature.
Ghost in the Wires (Mitnick, 2011)loreKevin Mitnick's memoir of his years as a fugitive, written as a chase narrative: the social-engineering calls reconstructed line by line, the identity changes, the surveillance, and the arrest.
GIGOacronymGarbage in, garbage out: no computation improves the quality of its inputs.
Glenn RicartloreThe man who built the first place where separate networks met as equals, and who led the first TCP/IP implementation for the IBM PC.
Global Privacy ControltermA browser signal declaring 'do not sell or share my data' automatically on every site - opt-out as a setting instead of a per-site chore.
Go To Statement Considered HarmfulloreDijkstra's 1968 letter arguing that unrestricted goto makes programs hard to reason about.
god boxjargonA single appliance that does everything - routing, firewalling, VPN, IPS, load balancing - one box to rule them all.
Godwin's lawexpressionThe adage that as an online argument grows longer, a comparison to Nazis becomes inevitable.
gold-platingjargonAdding polish and features nobody asked for - effort spent past the point where the requirement was met.
golden imagetermThe blessed master build of an operating system plus standard apps and settings, cloned onto every new machine.
Goodhart's lawexpression'When a measure becomes a target, it ceases to be a good measure.'
goodputjargonThe throughput that actually matters: useful application data delivered, after all the overhead and retransmissions.
googolloreThe digit one followed by a hundred zeros, and the word Google is a misspelling of it.
GOPHERacronymA pre-web protocol for browsing menus of documents.
Gordon MooreloreThe Fairchild and later Intel co-founder whose 1965 article observed that the number of components per integrated circuit was doubling on a regular cadence.
GOSIPacronymGovernment OSI Profile: a procurement mandate requiring OSI protocols in government purchases.
GPL (GNU General Public License)acronymThe copyleft licence family from the Free Software Foundation: you may use, study, modify and redistribute the software, provided that anything you distribute built from it carries the same freedoms and ships its source.
GPOacronymGroup Policy Object: Windows domain settings pushed centrally to users and machines - wallpaper to password policy, mapped drives to lockdown.
GPONacronymGigabit Passive Optical Network: one fiber from the OLT is split passively among up to 64 or 128 subscribers, sharing 2.5 Gbps down and 1.25 up.
Grace HopperloreThe mathematician and US Navy rear admiral who built one of the first compilers, coined the word, and drove the English-language programming that became COBOL.
graceful degradationtermDesigning a system so that when part of it fails, the rest keeps working in a reduced way.
GrafanatermThe open source analytics and visualisation application Torkel Ödegaard released in January 2014, which draws dashboards over other systems' metrics, logs and traces without storing them itself; the product of Grafana Labs and the face of the LGTM observability stack.
GraphQLtermA query language for interfaces where the caller specifies exactly which fields it wants, in one request.
gratuitous ARPtermAn unsolicited ARP packet in which a host announces its own IP address and MAC address to everyone on the link.
gray failurejargonA failure that is real but not clean - the system is degraded in a way the health checks do not see.
GREacronymGeneric Routing Encapsulation: the minimal IP-in-IP envelope (24 bytes with its delivery header, protocol 47) - no encryption, no authentication, just carriage.
GRE tunnelacronymGeneric Routing Encapsulation: wraps one packet inside another so traffic can cross networks that could not route it natively - a tunnel, without encryption.
GREASEloreA mechanism that sends random dummy values to keep TLS implementations tolerant of unknown extensions.
greenfield vs. brownfieldexpressionBuilding on an empty field versus building inside what already exists - the two starting conditions of every project.
Greenspun's tenth ruleexpression'Any sufficiently complicated C or Fortran program contains an ad hoc, informally-specified, bug-ridden, slow implementation of half of Common Lisp.'
grokexpressionTo understand something so completely that it becomes part of how you think.
GSLBacronymGlobal Server Load Balancing: DNS-level traffic steering across sites and regions - answering each resolver with the healthiest, closest, or least-loaded destination.
GTS / GTERtermNIC.br's twin working groups - GTS for network security, GTER for network engineering and operations: the free meetings where Brazil's internet operators compare notes, twice a year, for decades.
GTSMacronymA check that accepts a protocol's packets only when they arrive with TTL 255, so they cannot have crossed a router.
Guglielmo MarconiloreThe engineer and entrepreneur who turned Hertz's laboratory effect into a transatlantic service, claiming reception of a signal across the Atlantic in 1901.
GUIacronymA visual, point-and-click interface to software.

55

H2HCloreHackers to Hackers Conference: Latin America's oldest security research conference - Sao Paulo, every year since 2004.
hackloreOriginally, an inventive or elegant solution admired for its cleverness, not a break-in.
Hackers (1995)loreThe rollerblading, neon-soaked teen movie whose depiction of hacking is almost entirely fantasy and whose cultural influence on hackers is almost entirely real - source of the war cry 'Hack the planet!'
Hackers: Heroes of the Computer Revolution (Levy, 1984)loreSteven Levy's history of the first three hacker generations - the MIT model-railroad and PDP crowd, the Homebrew hardware builders, and the early game programmers - and the book that first wrote down the hacker ethic.
HacktivismtermHacking as political protest - defacement, leaks, denial of service or circumvention tooling deployed to make a point rather than money. The word was coined by a member of the Cult of the Dead Cow in the mid-1990s.
hairpin NATjargonReaching your own public address from inside your own network - the traffic goes out to the NAT and hairpins straight back in.
halt and catch fire (HCF)loreDisputed / commonly mistoldA jokingly named machine instruction said to make a CPU seize up - and, on some chips, a real undocumented opcode that does.
handovertermTransferring a problem to another person or team, along with the state of understanding that goes with it.
handshaketermThe exchange that establishes a conversation before data flows - agreeing that both sides are present, and on what terms.
Hanlon's razorexpressionThe heuristic to never attribute to malice what is adequately explained by stupidity or mistake.
Hans Christian ØrstedloreThe Danish physicist who observed in 1820 that a current-carrying wire deflects a compass needle, showing electricity and magnetism to be one phenomenon.
hardware implanttermSomething added to a device during manufacture or transit that the buyer cannot see and the vendor may not know about.
hash collisiontermWhen two different inputs produce the same hash output.
hash functiontermA one-way function that turns any input into a fixed-size fingerprint.
Have I Been PwnedtermA free service that tells you whether your email or password has appeared in a known data breach.
have you tried turning it off and on again?expressionSupport's opening liturgy and its most statistically justified question: a restart clears the accumulated state where most transient faults live.
HD MooretermThe creator of Metasploit, the open-source exploitation framework released in 2003 that turned exploit development from artisanal one-off code into a shared platform with modules, payloads and a common interface.
HDLCacronymHigh-Level Data Link Control - the ISO framing standard that underlies a whole family of serial protocols.
health checktermThe probe that decides whether a target receives traffic - an endpoint answering 'am I alive?' on a timer, with consequences.
HeartbleedloreThe 2014 OpenSSL flaw that let attackers read chunks of a server's memory, including keys and passwords.
Heinrich HertzloreThe physicist who in 1887 built a spark-gap transmitter and a loop receiver and demonstrated the waves Maxwell had predicted, turning radio from mathematics into an engineering problem.
heisenbugloreA bug that changes behaviour or disappears when you try to observe it.
hello, worldloreThe tiny program that just prints a greeting, traditionally the first thing you write in a new language.
HFacronymHigh frequency, 3 to 30 MHz: the shortwave range where signals refract off the ionosphere and travel worldwide.
HFCacronymHybrid Fiber-Coaxial: the cable-TV plant architecture - fiber from the headend to neighborhood nodes, coaxial for the final drop - that DOCSIS turned into a shared broadband network.
HIPAAacronymThe US healthcare-privacy law governing protected health information (PHI).
HITBloreHack In The Box - the 'deep-knowledge' security conference born in Kuala Lumpur in the early 2000s, whose stages have moved across Asia, Europe, and the Middle East.
HMACacronymA way to prove a message is authentic and unaltered, using a hash and a shared secret.
Hofstadter's lawexpressionThe self-referential rule that things always take longer than you expect, even accounting for this rule.
honeypottermA decoy system built to be attacked: no legitimate user ever touches it, so every interaction is a signal.
HOPE (Hackers On Planet Earth)termThe conference 2600 has organised in New York since 1994, held for most of its history in the Hotel Pennsylvania across from Penn Station, and named after the magazine's founding conviction that hacking belongs to everyone.
hope is not a strategyexpressionThe SRE reminder that wishing a system stays up is not the same as engineering it to.
host-to-hosttermA direct association between two endpoints, with no intermediary acting as the resource.
host-to-multihosttermOne sender reaching many receivers at once: the one-to-many communication pattern.
hosts filetermA local text file that maps host names to IP addresses, descended from HOSTS.TXT, the single host table the early network used before DNS.
Hot / cold aisletermThe data-center layout that keeps equipment intake air separate from exhaust - rows face front-to-front and back-to-back.
hot / warm / cold standbyexpressionThe three temperatures of a backup system: running and synchronized, running but behind, or powered off until needed.
hotfixtermAn urgent, narrowly scoped fix shipped outside the normal release cycle.
HOTPacronymA one-time code advanced by a counter rather than a clock.
Howard FrankloreThe engineer who decided where the ARPANET's links should actually go, treating network shape as an optimisation problem.
HP OpenViewtermThe former name of Hewlett-Packard's network and systems management family, built on Network Node Manager, an SNMP network monitor; rebranded HP BTO Software in 2007 and sold with HP Software to Micro Focus in 2017.
HP-UXtermHewlett Packard Unix, HP's System V Unix for the HP 9000 and later the Itanium-based Integrity servers, first released in the early 1980s and out of support since 31 December 2025.
HQCacronymA code-based post-quantum key-encapsulation algorithm selected by NIST as a backup.
HS256acronymA JWT signing algorithm: HMAC with SHA-256.
HSMacronymHardware Security Module: a tamper-resistant device that generates, holds, and uses keys internally - the keys can be used but never extracted.
HSTSacronymA header that forces browsers to use HTTPS for a site.
HTTP QUERY methodtermThe HTTP method standardized in June 2026 (RFC 10008) for read-only queries that carry a request body: safe and idempotent like GET, body like POST, cacheable with the body in the cache key.
HTTP/2termA revision that multiplexes many requests over one connection and compresses headers, without changing what a request means.
HTTP/3termHTTP carried over QUIC on UDP, so loss on one stream no longer stalls the others.
hubtermA repeater that copies every frame to every port - the device switches replaced, and the reason older networks shared bandwidth.
hub-and-spokeexpressionThe topology where everything connects through a central hub instead of to each other - fewer links, central control, one very important middle.
hybrid topologytermAny real network: a mix of topologies stitched together, chosen per layer for what that layer needs.
HyperlinktermA reference from one document to another that a reader can follow directly, and the mechanism the web is built on.
hypervisortermThe layer that presents virtual hardware to several operating systems and keeps them apart.
Hyrum's lawexpressionWith enough users, every observable behavior of your system will be depended on by somebody, contract or not.

72

"incognito mode makes you anonymous"loreDisputed / commonly mistoldPrivate browsing deletes local history and cookies when the window closes - nothing more. Websites, employers, and providers see you exactly as before.
"is it worth the time?"expressionThe question of whether automating a task actually saves more time than it costs to automate.
IaaS / PaaS / SaaSacronymThe cloud's three service layers: rent the infrastructure, rent the platform, or rent the finished application - each trading control for convenience.
IAMacronymIdentity and Access Management: who exists, what they may do, and under which conditions - the permission fabric of the cloud.
IANAacronymThe function that manages global IP, port, and protocol-number assignments.
ICANNacronymThe body that coordinates the internet's domain-name and number systems.
ICAPacronymA protocol for handing HTTP content to an external service for adaptation.
ICCC demonstrationloreThe 1972 public demonstration of the ARPANET at the International Conference on Computer Communication.
ICMPacronymThe protocol IP uses for error and diagnostic messages, like ping.
ICMP Time ExceededtermThe ICMP error (type 11, type 3 in ICMPv6) sent when a packet's TTL runs out in transit or its fragments miss reassembly.
ICMPv6acronymThe control and error protocol of IPv6, which also carries Neighbor Discovery, so IPv6 cannot work without it.
ID-10-T and friendsjargonThe joke 'error codes' for user-caused issues - ID-10-T, PICNIC, layer 8 - support's private shorthand, best kept private.
IDCMAacronymIndependent Data Communications Manufacturers Association: the trade body for vendors competing with the carriers.
idempotencetermThe property that doing something twice has the same effect as doing it once.
idempotency keytermA unique token attached to a request so the server can safely ignore accidental duplicates.
idempotenttermAn operation that has the same effect whether you run it once or many times.
identity providertermThe party that authenticates the user and asserts the result: in SAML the IdP issues assertions, in OIDC the same role is the OpenID Provider issuing ID tokens.
IDStermA system that watches traffic or hosts and reports what looks like an attack - and, as an IPS, blocks it.
IEEEacronymThe engineering society whose 802 committee defines the LAN standards everything on this site runs over.
IETFacronymThe body that standardizes the internet's protocols, in the open, as RFCs.
if it hurts, do it more oftenexpressionThe counterintuitive delivery principle: painful, risky activities become safe through frequency, not avoidance.
IGMPacronymInternet Group Management Protocol: how IPv4 hosts tell the routers on their link which multicast groups they want to receive.
IGPacronymInterior Gateway Protocol - the class of routing protocols that run inside one autonomous system: OSPF, IS-IS, EIGRP, RIP.
IISacronymMicrosoft's web server software for Windows.
IKEacronymThe protocol that negotiates keys and security parameters for IPsec VPNs.
IKEv2acronymInternet Key Exchange version 2: the negotiation that authenticates both ends of an IPsec tunnel and establishes the keys, replacing a first version whose complexity was its main flaw.
illegal numberloreA number whose mere possession or publication is claimed to be unlawful, the reductio ad absurdum of information control.
IMAPacronymA protocol for reading email kept on the server, across multiple devices.
IMAPSacronymIMAP encrypted with TLS.
IMDSacronymInstance Metadata Service: the link-local endpoint (169.254.169.254) where a cloud instance asks about itself - and collects its temporary credentials.
Immutable backup (and the 3-2-1 rule)termA backup copy that cannot be altered or deleted for a defined period, even by an administrator - achieved through storage-level object lock, genuinely offline media, or a separate trust domain with its own identity.
immutable infrastructuretermAn approach where servers are never modified in place; to change one, you replace it with a new build.
IMPacronymInterface Message Processor: the ARPANET's packet switch, a separate minicomputer sitting between a host and the network.
incastjargonThe many-to-one traffic collapse: dozens of servers answer one request simultaneously and their combined burst overruns the receiver's switch port.
incidenttermAn unplanned interruption or reduction in quality of a service, as distinct from a request for something new.
incident vs. service requestexpressionThe great ITIL fork: an incident is something broken; a request is something wanted - different queues, clocks, and expectations.
Infovia BrasíliatermThe Brazilian federal government's own metropolitan network in Brasília, running on state-owned fibre and operated by Serpro exclusively for public bodies.
infrastructure as codetermManaging servers and networks through version-controlled configuration files rather than manual setup.
InmetroacronymBrazil's national metrology, quality and technology institute, responsible for measurement standards and conformity assessment.
integer overflowtermAn arithmetic result too large for its type, so the value silently wraps around instead of growing.
inter-frame gaptermThe mandatory idle time between Ethernet frames, 96 bit times, that gives every receiver a beat to reset before the next frame arrives.
intermittent faulttermA failure that occurs unpredictably and cannot be triggered on demand, so it cannot be tested against directly.
internet exchangetermA shared fabric where many networks interconnect directly, instead of paying a third party to carry traffic between them.
internet gatewaytermThe VPC component that gives public subnets a door to the internet - horizontally scaled, no bandwidth knob, no single box to fail.
Internet shutdowntermA government-ordered disconnection of internet access for a population - nationwide or regional, total or limited to mobile data - executed by licensed operators under legal instruction rather than by any technical attack.
InteroploreThe trade show that began as a TCP/IP interoperability demonstration and became the industry's proving ground.
IoCacronymA forensic artifact that indicates a system may have been breached: a hash, an IP, a domain, a filename, a registry key.
IOS (Cisco)acronymCisco's long-standing operating system for routers and switches.
IPtermThe best-effort, connectionless delivery layer that addresses and routes packets across interconnected networks, the thin waist every internet application stands on.
IP transittermPaying a bigger network to reach the whole internet - the ISP's upstream bill, priced per megabit of committed rate.
IPAMacronymIP Address Management: the system of record for who owns which range - allocations, assignments, and conflicts, tracked instead of remembered.
IPoEacronymIP over Ethernet: subscriber access without PPPoE - plain DHCP, with identity taken from the line itself rather than a login.
IPSacronymA control that detects and blocks attacks inline.
IPsecacronymThe standard suite for encrypting and authenticating IP traffic, powering most site-to-site VPNs; keys are negotiated by IKE.
IPX/SPXacronymNovell NetWare's networking protocols - the LAN standard of the file-server era, derived from Xerox XNS.
Ira FuchsloreThe CUNY administrator who built the academic network for everyone the ARPANET had left out, starting with one link to Yale in 1981.
IRAPacronymAustralia's assessment framework letting cloud services be validated against the government's security manual.
IRC (Internet Relay Chat)acronymThe text chat protocol written by Jarkko Oikarinen in Finland in 1988: servers federate into a network, users join channels prefixed with #, and the whole thing is simple enough to speak by hand over a raw socket. Standardised late, in RFC 1459 and its successors.
IRIXtermSilicon Graphics' Unix for its MIPS workstations and servers, System V with BSD extensions, named from release 3.0 in 1988 and ended with 6.5.30 in August 2006; the birthplace of XFS and OpenGL.
IS-ISacronymIntermediate System to Intermediate System - OSPF's link-state twin from the OSI world: the protocol you have probably never configured, running the carrier backbones your traffic crosses every day.
ISC2termThe certification body behind the CISSP - the credential most often gatekeeping senior security roles.
ISM bandtermIndustrial, scientific and medical bands: spectrum usable without an individual licence, subject to power and interference rules.
ISO/IEC 27001acronymThe international standard for an information security management system (ISMS) - the certification most vendor trust centers lead with.
ISO/IEC 27017acronymThe cloud-security extension of ISO 27001 - controls specific to being, or using, a cloud service provider.
ISO/IEC 27018acronymThe privacy extension of ISO 27001 - protecting personally identifiable information processed in the public cloud.
ISPacronymA company that provides internet access.
ISRGacronymThe nonprofit that runs Let's Encrypt.
IT asset managementtermTracking hardware and software through their whole lifecycle - procurement, assignment, patching, retirement - so licenses, budgets, and audits reconcile.
it's always DNSexpressionThe troubleshooting proverb that whatever the symptom, the root cause will turn out to be DNS.
ITILacronymThe IT service management framework - the shared vocabulary of incidents, problems, changes, and services that lets operations teams and their tickets speak one language.
IVacronymA starting value that makes a cipher produce different output for identical input.
IXPacronymInternet Exchange Point: the shared switching fabric where dozens or hundreds of networks meet to peer in one place.

30

J.C.R. LickliderloreThe psychologist who ran ARPA's Information Processing Techniques Office from 1962 and addressed his memos to the Members and Affiliates of the Intergalactic Computer Network.
JA3acronymA fingerprint of a TLS client built from the fields in its ClientHello.
JA4acronymA newer, more robust family of TLS and network fingerprints.
Jaap AkkerhuisloreDutch network engineer who helped build Europe's first international internet gateways at CWI in Amsterdam, later steered the .nl registry, and now sits on the body that assigns the world's two-letter country codes.
Jaime Andrés Restrepo (DragonJAR)termFounder of DragonJAR, the Colombian security company and the largest Spanish-speaking security community of its era, and creator of the DragonJAR conference in Manizales - recognised with Ekoparty's lifetime achievement award.
James Clerk MaxwellloreThe theorist whose 1865 equations described electricity, magnetism and light as one field, and predicted that electromagnetic waves travel at the speed of light.
James EllisloreThe GCHQ researcher who conceived non-secret encryption around 1969-70, several years before the public discovery of public-key cryptography, and could tell nobody.
James Prescott JouleloreThe physicist who showed that electrical energy, heat and mechanical work are the same quantity in different forms.
James WattloreThe engineer who in 1788 put a spinning-weight governor on a steam engine, creating the mechanical ancestor of every control loop in computing.
Jean-Charles PeltierloreThe clockmaker who found in 1834 that passing current through a junction of two dissimilar metals heats one side and cools the other, depending on direction.
Jeff Moss (Dark Tangent)termThe founder of DEF CON, which began in 1993 as a farewell party for a friend's bulletin-board network and became the largest hacker gathering in the world, and of Black Hat, its commercial sibling for the people who had to expense the trip.
JeitinholoreDisputed / commonly mistoldBrazilian Portuguese. The knack of getting something done by going around a rule rather than through it - usually with charm, usually without money changing hands, and usually at a small cost to somebody who is following the rule.
Jim McKieloreMember of the Amsterdam team that put Europe on Usenet, who in 1982 told the continent's Unix users that the Mathematical Centre would call anyone, and who later worked at Bell Labs on Plan 9, the successor to Unix.
jittertermVariation in delay between packets - the reason a call sounds broken on a link whose average latency looks fine.
John Logie BairdloreThe engineer who demonstrated working television to the Royal Institution on 26 January 1926, to an audience that did not appear to realise what it had seen.
John MarkofftermThe New York Times technology reporter whose front-page coverage in the 1990s turned Kevin Mitnick into the world's most famous hacker, and who co-wrote Cyberpunk (1991) and Takedown (1996), the account of Mitnick's capture written with Tsutomu Shimomura.
John von NeumannloreThe mathematician whose 1945 EDVAC draft set out the stored-program architecture - instructions held in the same memory as data - that almost every computer still follows.
Jon PostelloreThe RFC Editor from 1969 until his death in 1998, author or editor of the RFCs that define IP, ICMP and TCP, and the first director of IANA - a job he volunteered for and at first did by hand.
Joybubbles (Joe Engressia)termThe blind phone phreak with perfect pitch who discovered at the age of seven that whistling a particular tone into a receiver made the network obey - and who could produce 2600 Hz with his mouth, no equipment at all.
Jude Milhon (St. Jude)termThe self-taught programmer and civil-rights activist who helped build Community Memory - the first public computerised bulletin board, in 1970s Berkeley - coined the word cypherpunk, and wrote as St. Jude in Mondo 2000.
juice jackingjargonThe attack theory that a public USB charging port could push malware or pull data while it charges your phone.
Julian Assange (Mendax)termThe Australian hacker who as a teenager, under the handle Mendax, was part of the International Subversives and pleaded guilty in 1996 to intrusions including Nortel - later the founder of WikiLeaks and the most disputed figure of the disclosure era.
jumbo framestermEthernet frames carrying more than the standard 1500-byte payload, typically 9000: fewer headers per gigabyte, and misery when one hop in the path disagrees.
Jun MurailoreThe Keio professor who built Japan's first inter-university network in 1984 and the research consortium that followed it.
just-in-time accesstermPrivileges granted for the task and the hour, then automatically revoked - standing admin rights replaced by requested, approved, expiring ones.
JWICSacronymThe US intelligence community's network for top secret and compartmented information, the most restricted of the three tiers.
JWKacronymA JSON format for representing a cryptographic key.
JWKSacronymA published set of keys used to verify signed tokens.
JWSacronymA standard for signing data represented as JSON.
JWTacronymA compact, signed token that carries claims about a user, used to prove identity between services.

28

k-anonymitytermA dataset property where every person is indistinguishable from at least k-1 others on the quasi-identifiers - hiding in a crowd of size k.
KalpanaloreThe Sunnyvale startup that shipped the first multiport Ethernet switch in 1990 and, four years later, became one of Cisco's most consequential acquisitions.
KanbantermToyota's pull system, adapted to knowledge work: visualize the flow, limit work in progress, and let capacity pull tasks instead of schedules pushing them.
Kanchana KanchanasutloreThe computer scientist credited with bringing the internet to Thailand, and with obtaining the country's domain.
Karen BanksloreThe GreenNet engineer whose gateway carried mail for sixty partner organisations across three continents, using the wrong technology on purpose.
Katie MoussourisloreThe researcher who created Microsoft's bug bounty programme and helped create the first one at the US Department of Defense, and who has spent the years since arguing about how they should be run.
KDCtermKey Distribution Center: the Kerberos authority - Authentication Service plus Ticket-Granting Service - that verifies principals and issues the TGT and service tickets; in Active Directory it runs on the domain controllers.
KDFacronymA function that turns a secret into one or more cryptographic keys.
keep the lights onjargonThe baseline operational work that keeps existing systems running - maintenance, patching, renewals, the unglamorous constant.
Kees NeggersloreThe Dutch network director behind the first European backbone, and behind the exchange that made Amsterdam a place traffic goes.
Ken ThompsonloreCo-creator of Unix and joint recipient of the 1983 Turing Award, and author of the Turing lecture that showed a compiler can hide a backdoor no source review would ever find.
KerberostermThe ticket-based network authentication protocol behind enterprise silent sign-on: a Key Distribution Center issues time-limited tickets that services can verify offline, so passwords travel once at login and never again.
Kerckhoffs's principleexpressionA cryptosystem must remain secure even if everything about it, except the key, is public knowledge.
kerneltermThe part of an operating system that runs with full hardware privilege, mediating memory, processes, devices and the network for everything else.
Kernighan's lawexpression'Debugging is twice as hard as writing the code in the first place. Therefore, if you write the code as cleverly as possible, you are, by definition, not smart enough to debug it.'
Kevin MitnickloreThe 1990s hacker whose social-engineering exploits made him the era's most famous computer intruder.
Kevin PoulsenloreThe hacker who seized a radio station's phone lines to be caller 102 and win a Porsche, then became a security journalist.
Key escrowtermAny arrangement in which a copy of a decryption key is held by a third party so encrypted material can be recovered without the owner's cooperation - proposed for law enforcement, and used legitimately inside organisations for recovering data when an employee leaves.
key exchangetermHow two parties agree on the session's secret key - the part of a cipher suite that decides whether recorded traffic stays sealed.
key managementtermGenerating, storing, rotating, revoking and retiring cryptographic keys - the part of cryptography that actually fails.
key rotationtermReplacing cryptographic keys and credentials on schedule, so a stolen secret has an expiry date instead of a lifetime.
keytabtermA file holding a service account's long-term Kerberos keys, letting a service - often on Linux, outside the domain - decrypt the tickets clients present without interactive domain membership.
KISSexpressionThe design principle that systems work best when kept simple rather than made complex.
kludgeloreA clumsy, inelegant fix that works despite being ugly.
KMSacronymKey Management Service: the managed vault where encryption keys live, guarded by hardware, used via API, and never exported in the clear.
knowledge basetermThe searchable library of known issues, fixes, and how-tos - support's compound interest, paid into one resolved ticket at a time.
KRACKloreA 2017 attack on WPA2 Wi-Fi that resets encryption keys to replay traffic.
KubernetestermAn open-source system for automating the deployment and scaling of containerized applications.

73

L0pht Heavy IndustriestermThe Boston hacker collective of the 1990s - a rented loft full of salvaged hardware where Mudge, Weld Pond, Space Rogue, Kingpin, Brian Oblivion, Tan and Stefan Von Neumann did serious vulnerability research and published it for free.
L2TPacronymLayer Two Tunneling Protocol: carries PPP frames across an IP network, providing no encryption of its own, which is why it is almost always paired with IPsec.
L3acronymThe network layer, where IP routing happens.
L4acronymThe transport layer, handling ports and connections like TCP/UDP.
L4 vs. L7 load balancingexpressionBalancing on addresses and ports versus on the application itself: L4 is fast and blind, L7 reads HTTP and routes by path, header, or cookie.
L7acronymThe application layer - where protocols like HTTP live in the OSI model.
LACNICacronymThe Latin American and Caribbean internet registry - the steward of the region's IP addresses and AS numbers, whose twice-yearly meetings double as the region's operator congress.
LACPacronymLink Aggregation Control Protocol: bundles multiple physical links into one logical channel for bandwidth and redundancy, negotiated rather than hoped for.
lamer, noob, newbie, script kiddiejargonThe underground's ladder of contempt, and the distinctions matter. A newbie or newb is simply new and willing to learn. A noob (or n00b) is new and unwilling - demanding answers, ignoring the manual. A lamer is neither new nor learning, claiming credit for others' work. A script kiddie runs tools they cannot read or modify.
LANacronymLocal area network: a network within one site, under one administration, where the links are yours and bandwidth is cheap.
landing zonetermThe pre-built, governed foundation of a cloud estate: account structure, identity, networking, logging, and guardrails, ready before the first workload.
LANEacronymLAN Emulation - the ATM Forum's scheme for making a cell network impersonate Ethernet. Famously the moment many engineers decided ATM to the desktop was a bad idea.
large language model (LLM)acronymA model trained on very large amounts of text to predict what comes next, which turns out to be enough to do a great many other things.
Larry RobertsloreThe ARPA programme manager who decided in 1967 that the network would be packet switched, then funded, designed and managed it into existence.
last miletermThe final stretch of network between the provider's infrastructure and the customer's door - the most expensive kilometers in telecom.
latencytermThe time between sending something and it arriving - distinct from bandwidth, which is how much arrives per second.
lateral movementtermSpreading from one compromised system to others across a network.
LatinowaretermThe Latin American congress of free software and open technologies, held since 2004 at the Itaipu Technology Park in Foz do Iguaçu.
layer 8jargonThe unofficial OSI layer above application: the human - where a startling share of network problems actually occur.
LBacronymA device or service that spreads traffic across multiple servers.
LCSacronymThe longest sequence common to two inputs, keeping order.
LDAPacronymThe protocol for querying and modifying directory services like Active Directory.
LDAPSacronymLDAP encrypted with TLS.
LDNSacronymThe DNS server that queries a GSLB system on a client's behalf, and whose address the GSLB takes as the client's location.
leaf-spinetermThe modern data-center fabric: every leaf switch connects to every spine, giving any two servers the same short predictable path.
leaky abstractionexpressionAn abstraction that is supposed to hide complexity but lets details of what is underneath show through.
least privilegetermGiving each user or process only the access it needs to do its job, and no more.
Lee de ForestloreThe engineer who added a third electrode to a vacuum tube in 1906, producing the first device that could amplify a signal.
leet (1337, eleet)jargonElite, spelled the way the bulletin-board underground spelled it: letters replaced by digits and symbols, 3 for E, 1 for L, 7 for T. 31337 is eleet, and remains a running joke that shows up as port numbers, version strings and CTF flags.
left-padloreThe eleven-line npm package whose 2016 removal broke builds across the JavaScript world.
Legion of Doom (LOD)termThe most influential American hacker group of the 1980s, founded around 1984 by a phreak calling himself Lex Luthor and named after the Super Friends villains. Its members were deep telephone-switch specialists whose technical files, published in Phrack, taught a generation how the phone network actually worked.
legitimate interesttermThe lawful basis for processing without consent when the controller's genuine need outweighs the person's rights - after a documented balancing test.
Lei Carolina Dieckmann (Law 12.737/2012)termThe Brazilian statute of November 2012 that made unauthorised access to a computing device a crime in its own right, inserting article 154-A into the Penal Code. It took effect in April 2013.
LEO constellationtermA fleet of satellites in Low Earth Orbit - hundreds of kilometers up rather than geostationary's 35,786 km - trading one motionless satellite for thousands of moving ones: latency drops to tens of milliseconds, at the cost of constant handoffs, phased-array terminals, and fleet logistics. Starlink is the operating example at scale.
Léon FoucaultloreThe physicist who demonstrated the Earth's rotation with a pendulum in 1851, discovered eddy currents, and gave the gyroscope its name.
Leonard AdlemanloreThe A in RSA and joint recipient of the 2002 Turing Award, later the founder of DNA computing.
Leonard KleinrockloreThe queueing theorist whose early-1960s work on delay in networks of nodes underpinned ARPANET performance analysis, and whose UCLA laboratory hosted the first node.
Leonardo PigñertermCo-founder and chief executive of Ekoparty, the Buenos Aires conference that became Latin America's largest hacking event - one of the five who started it in 2001, alongside Juan Pablo Daniel Borgna, Federico Kirschbaum, Jeronimo Basaldua and Francisco Amato.
Leslie LamportloreThe 2013 Turing Award recipient for imposing order on distributed systems: logical clocks, distributed snapshots, Paxos, Byzantine fault tolerance, the safety and liveness distinction - and LaTeX.
LGPDacronymLei Geral de Proteção de Dados: Brazil's general data protection law (13.709/2018), governing personal data processing on GDPR-inspired principles with Brazilian teeth.
LGTMacronymThe code-review approval stamp: looks good to me.
Liane TaroucotermThe researcher who built the Rede Sul de Teleprocessamento, the first initiative to connect Brazilian universities, wrote the first book on computer networks published in Brazil, and contributed to the country's first internet backbone. Inducted into the Internet Hall of Fame in 2021.
Libera.Chat and the freenode exodusloreThe IRC network founded in May 2021 by the volunteer staff who resigned from freenode after a disputed change of control, taking most of the free-software projects that had used freenode with them within days.
lift and shiftjargonMigrating a workload to the cloud exactly as it is - same VM, same architecture, new landlord.
line ratetermThe theoretical maximum a link can carry for a given frame size - and the claim that benchmarking exists to check.
link aggregationtermSeveral parallel Ethernet links grouped so that both ends treat them as one logical link, for more capacity and for resilience.
link-local addresstermAddresses valid only on the local segment: IPv6's fe80::/10 on every interface by design, IPv4's 169.254.0.0/16 usually meaning DHCP failed.
link-state routingtermA routing method in which every router floods a description of its own links and computes paths from the shared map.
Linus TorvaldstermThe Finnish student who announced a free operating-system kernel on the comp.os.minix newsgroup in August 1991 - 'just a hobby, won't be big and professional like gnu' - and who, in 2005, wrote Git in about ten days after the kernel lost access to its proprietary version-control system.
Linus's lawexpression'Given enough eyeballs, all bugs are shallow.'
Linux distribution (distro)jargonA complete operating system assembled around the Linux kernel: the kernel plus userland tools, a package manager, an installer, default configuration, and a promise about how updates will arrive and for how long.
Linux namespacestermThe kernel mechanism that gives a process its own view of a system resource - process table, network stack, mount points, hostname, users, inter-process communication - so that what it sees is not what the host sees.
lit fiberjargonFiber with the electronics attached and light flowing - a working service, as opposed to dark fiber you light yourself.
living off the landjargonAttacking with the tools already installed on the victim's systems, so nothing malicious ever has to be downloaded.
LLDPacronymLink Layer Discovery Protocol: neighbors introduce themselves on the wire - device, port, capabilities - turning 'what is on the other end?' into a show command.
LLMacronymA neural network trained on vast text that generates and understands language.
Load balancertermA device or service that accepts client traffic on one address and distributes it across a set of backend servers, tracking which of them are usable.
load balancingtermSpreading incoming work across several servers so no one server is overwhelmed.
local preferencetermThe BGP attribute that carries an autonomous system's own preference for a route to its internal peers; higher wins.
Log4ShellloreThe 2021 vulnerability in the ubiquitous Log4j logging library that let a logged string execute arbitrary code.
loggingtermRecording what happened so it can be answered for later - by an operator during an incident, or by an investigator afterwards.
LogjamloreA 2015 attack downgrading Diffie-Hellman key exchange to weak 512-bit export parameters.
longest prefix matchtermThe routing rule that the most specific matching prefix wins: /32 beats /24 beats /0, regardless of protocol or metric.
looking glassjargonA public web interface into a network's router, letting outsiders run ping, traceroute, and BGP queries from inside that network.
loopback interfacetermA virtual interface that never goes down, giving the router a stable identity for routing protocols and management regardless of physical link state.
LoRatermA long-range, low-power radio technique (Semtech's chirp spread spectrum) and, via LoRaWAN (the LoRa Alliance's network specification), an LPWAN architecture: kilometers of range, years of battery, bytes of payload, gateways forwarding whatever they hear.
Lotus Notes and DominotermLotus Notes, the client, and Domino, the server: the collaborative platform Ray Ozzie's Iris Associates built for Lotus from 1984 and shipped in December 1989, bought with Lotus by IBM in 1995 and owned by HCL since July 2019; a replicated document database with mail, calendars, directory, applications and public-key security built in.
LSAacronymThe unit of an OSPF link-state database: one router's or one network's local state, flooded to every router in its scope.
LTEtermThe fourth-generation mobile standard, and the point at which mobile networks became entirely packet-based.
Lucky ThirteenloreA 2013 timing attack against CBC padding in TLS.
Luigi GalvaniloreThe physician who saw dead frog legs twitch at the touch of dissimilar metals in 1780 and called it animal electricity.
Luiz Eduardo dos SantosloreThe founder whose idea the ISTS podcast was, and who spent months insisting the three of them record a pilot; co-founder of the YSTS conference that grew out of it.
LulzSectermThe six-person splinter from Anonymous that ran a fifty-day spree in 2011 - Sony, PBS, the CIA's public site, an FBI affiliate, games companies - announcing each breach on Twitter with a cartoon mascot and mocking the victims' security.

88

"MAC addresses are unique and permanent"loreDisputed / commonly mistoldThe burned-in address stopped being either: operating systems randomize Wi-Fi MACs per network by default, and any MAC can be set in software in seconds.
"more bandwidth means a faster connection"loreDisputed / commonly mistoldBandwidth is lane count; latency is trip time. Past a modest threshold, page loads, calls, and games are ruled by latency and bufferbloat - which a bigger plan does not fix.
MAB (MAC Authentication Bypass)acronymMAC Authentication Bypass: the 802.1X fallback in which a switch, finding no supplicant on a port, submits the device's MAC address to the RADIUS server as its identity, so that printers, phones and other things that cannot authenticate are admitted by a list.
MAC (message authentication code)acronymA short tag that proves a message came from someone holding the shared key and was not altered.
MAC addresstermThe hardware address that identifies a network interface on a local network.
MAC flappingtermThe same MAC address appearing rapidly on different switch ports - the signature of a loop, a bad bond, or a device bridging where it should not.
Mafiaboy (Michael Calce)loreThe alias of Michael Calce, the Montreal fifteen-year-old whose February 2000 denial-of-service spree - Project Rivolta - knocked Yahoo!, Amazon, eBay, CNN, Dell and E*Trade offline using university machines he had compromised.
magic numberjargonAn unexplained constant buried in code, or the signature bytes that identify a file format.
magic smokejargonThe smoke inside electronics that, once released, can never be put back - the joke explanation for why fried hardware stays dead.
maintenance windowtermThe scheduled low-impact period when changes are allowed - announced, bounded, and rollback-planned; work outside it needs an emergency's justification.
make it work, make it right, make it fastexpressionKent Beck's ordering of concerns: first correctness, then design, then - and only then - speed.
malwaretermSoftware that runs on a system to serve someone other than its owner.
MANacronymMetropolitan area network: a network across a city, larger than one site and smaller than a carrier's long-haul.
man-in-the-middletermAn attacker positioned between two parties who each believe they are talking directly to the other, able to read and alter what passes.
mandelbugjargonA bug whose causes are so complex and tangled that its behavior looks chaotic or nondeterministic.
MANRS (Mutually Agreed Norms for Routing Security)acronymA community agreement on baseline routing hygiene: filter announcements from your customers, prevent traffic with spoofed source addresses from leaving your network, keep your public routing data accurate, and coordinate with other operators.
Marco Civil da Internet (Law 12.965/2014)termBrazil's framework law for internet rights and duties, enacted in 2014: it establishes network neutrality, privacy and freedom of expression as principles, sets data-retention obligations for connection and application providers, and conditions the removal of content on a court order in most cases.
Marcus Hutchins (MalwareTech)termThe young British researcher who stopped WannaCry in May 2017 by noticing an unregistered domain in the malware and buying it for about ten dollars - which turned out to be the worm's kill switch, halting a global outbreak within hours.
Margaret HamiltonloreThe director of the Software Engineering Division at the MIT Instrumentation Laboratory, who led the on-board flight software for the Apollo Guidance Computer, and who argued for calling the work engineering at all.
Marisa BellisarioloreItalian executive who, from 1981, turned the state telecommunications manufacturer Italtel from what the press called a national scandal into a profitable company, and whose planned merger into a group of European scale was cancelled, her foundation records, because a partner would not have a woman as chief executive.
martian packettermA packet whose source or destination address could not legitimately appear where it did, as if it arrived from Mars.
Martin HellmanloreCo-author of New Directions in Cryptography and of the key-exchange method that carries his name with Diffie's; joint recipient of the 2015 Turing Award.
Masters of Deception (MOD)termThe New York hacker crew of the late 1980s and early 1990s, formed around Mark Abene (Phiber Optik) after his split from the Legion of Doom - younger, more urban and more publicly defiant than their Texan rivals, and deeply at home inside the switches of the regional telephone companies.
Max Butler (Iceman)termThe security researcher turned card thief who, as Iceman, hacked and forcibly merged the rival carding forums of the mid-2000s into his own CardersMarket - a hostile takeover of an entire criminal marketplace - before receiving a thirteen-year sentence in 2010.
MCPacronymAn open protocol that lets AI models call external tools and data sources in a standard way.
MD5acronymAn old 128-bit hash function, cryptographically broken and unsafe for security use.
MDF / IDFacronymMain and Intermediate Distribution Frames: the building's cabling hierarchy - everything homes to the MDF, floors terminate in IDFs.
MDMacronymMobile Device Management: enrolling phones, tablets, and laptops under central policy - configure, patch, locate, and wipe from one console.
MDNacronymMozilla's widely used web-technology documentation site.
MEDacronymAn optional BGP attribute by which a neighbouring AS suggests which of several links into it to use; lower wins.
Media convertertermThe small box that translates one physical medium to another - classically copper Ethernet to fiber and back.
meet-me roomjargonThe room in a carrier-neutral facility where networks physically interconnect - the cross-connect floor where the internet is literally patched together.
MeltdownloreA 2018 attack letting user programs read protected kernel memory via speculative execution.
memory leaktermMemory that a program allocates and never releases, so its footprint grows until something gives.
memory safetytermThe property of never accessing memory outside what a program legitimately owns, in space or in time.
Mente BináriatermThe Brazilian nonprofit teaching computing and security from first principles - free courses, an active forum, and open-source tooling.
Merkle treetermA tree of hashes that lets you verify one item belongs to a large set efficiently.
mesh topologytermNodes connect to many other nodes directly, so traffic has multiple independent paths.
mesh Wi-FitermMultiple cooperating access nodes forming one seamless network, relaying wirelessly where cable cannot reach.
metadatatermData about data: who contacted whom, when, from where, how often - everything except the content, and often more revealing than it.
Metcalfe's lawexpressionThe value of a network grows with the square of its number of connected users.
metricstermNumbers sampled over time - cheap to store, fast to query, and unable to explain a single request.
MFAacronymRequiring two or more independent proofs of identity to log in, not just a password.
Michael FaradayloreThe experimenter who showed in 1831 that a changing magnetic field induces a current - the reciprocal of Ørsted, and the basis of generation and of every inductive coupling problem since.
Michal Zalewski (lcamtuf)termThe Polish researcher who wrote American Fuzzy Lop, the coverage-guided fuzzer that made automated bug-hunting genuinely effective, and the books Silence on the Wire and The Tangled Web on passive reconnaissance and browser security.
microburstjargonA traffic spike so brief that it overflows a switch buffer and drops packets, yet vanishes inside the utilization averages.
MicrocodetermA layer inside a processor that implements its published instruction set in terms of simpler internal operations.
microsegmentationtermDividing a network into small, individually controlled zones to limit lateral movement.
microservicetermAn architecture that splits an application into independently deployable services communicating over the network.
MicrotunneltermZPA's per-application, per-user-session thread riding inside the TLS connections from client and App Connector, stitched at a Service Edge.
middle milejargonThe network segment between the local access network and the internet's core - the haul from the neighborhood to the exchange.
Midori (Microsoft's post-Windows research OS)loreMicrosoft's incubation project, running from around 2008 until it was wound down in 2015, to build an operating system from scratch in managed code - kernel, drivers and applications all memory-safe - as a commercial descendant of the Singularity research OS, designed for concurrency and capability-based isolation.
Mike JensenloreThe engineer who spent decades connecting the organisations nobody was going to connect commercially.
MIMEacronymA standard for labeling the type of a piece of content.
Mind the SectermThe corporate-scale information-security conference of Sao Paulo - where the Brazilian market's decision-makers meet the vendor ecosystem.
MirailoreA 2016 botnet that hijacked IoT devices to launch record DDoS attacks.
MITREtermThe US not-for-profit that operates federally funded R&D centers - and, for practitioners, the home of ATT&CK, CVE, and CWE.
MITRE ATT&CKtermThe public knowledge base that catalogues what attackers actually do, organised as tactics (the goal: initial access, persistence, exfiltration) and techniques (the method), each with observed procedures and the groups seen using them.
mixer (tumbler)termA service that blends many parties' cryptocurrency together to obscure who paid whom.
ML-KEMacronymThe NIST-standardized post-quantum key-encapsulation algorithm.
MojibaketermGarbled text produced when bytes written in one charset are read in another: café shown as cafÃ©, don’t as donâ€™t.
Moonlight MazeloreThe intrusion campaign discovered in 1998 that had been quietly reading US military, NASA, Department of Energy and university systems since at least 1996 - the first sustained state-scale espionage operation ever detected on the internet, and the effective birth of the category later called the advanced persistent threat.
Moore's lawexpressionThe observation that the number of transistors on a chip roughly doubles every couple of years.
Morse code / CWtermEncoding of characters as short and long tones, sent as an on-off keyed carrier and known on the air as CW.
move fast and break thingsexpressionA mantra prizing speed and iteration over caution, accepting that some breakage is the cost of learning fast.
MPLSacronymMultiprotocol Label Switching - forwarding by short labels instead of IP lookups: push a label at the edge, swap it hop by hop, pop it before the exit. The machinery under most carrier services.
MQTTacronymA lightweight publish-subscribe protocol for IoT and telemetry.
MQTTSacronymMQTT encrypted with TLS.
Mr. Robot (2015-2019)loreThe television series about a security engineer and vigilante hacker whose technical scenes are, by broad agreement among practitioners, the most accurate ever committed to screen - real tools, real command output, plausible operations.
MRTGacronymThe Multi Router Traffic Grapher, Tobias Oetiker's free SNMP tool that polls two counters every five minutes and draws the daily, weekly, monthly and yearly traffic graphs that became the universal picture of a busy link.
MSRDPacronymMicrosoft's protocol for remote graphical desktop sessions.
MSSacronymThe largest chunk of actual data a TCP segment carries, after headers.
MSS clampingexpressionRewriting TCP's advertised Maximum Segment Size downward in the SYN so segments fit a tunnel's reduced MTU without fragmentation or black holes.
Mt. GoxloreThe Tokyo exchange that handled most of the world's bitcoin trades until 850,000 of them vanished in 2014.
MTAtermThe server that accepts mail and passes it on toward its destination.
MTA-STS (and DANE for mail)acronymA mechanism by which a domain declares that mail sent to it must travel over authenticated TLS, published over HTTPS with a DNS pointer - closing the downgrade gap left by SMTP's opportunistic encryption. DANE solves the same problem using DNSSEC instead.
MTTRacronymMean Time To Repair: the average clock from failure to restoration - the operational number behind every SLA repair promise.
MTUacronymThe largest packet, in bytes, a link will carry without fragmenting.
Mudge (Peiter Zatko)termThe L0pht member who wrote L0phtCrack, published early and widely read work on buffer overflows, and led the 1998 Senate testimony - later a DARPA programme manager, and head of security at Google's Motorola division and at Twitter.
multi-tenancytermOne system serving several customers from shared infrastructure, with isolation enforced by software rather than by separate hardware.
multicasttermDelivery of one IP datagram to a host group, a set of hosts named by a single address, with the network making the copies.
multihost-to-hosttermMany senders converging on one receiver: the many-to-one pattern, also called incast.
Multilink PPPacronymMultilink PPP - bundling several physical links into one logical PPP connection for more bandwidth.
Multimode fibertermThe short-reach fiber of buildings and data centers - a wide core, cheaper optics, distances of hundreds of meters.
mungjargonTo transform data through a series of changes, often messily or destructively.
Murphy's lawexpression'Anything that can go wrong will go wrong' - engineering's oldest planning assumption.
MWCacronymMobile World Congress - the GSMA's Barcelona mega-show where the telecom industry announces its year: handsets, networks, and roughly a hundred thousand badge-wearers.
MXacronymThe DNS record that says which servers receive a domain's email.

56

"NAT is a firewall"loreDisputed / commonly mistoldThe belief that address translation is a security control. NAT hides topology as a side effect, but it filters nothing by policy - a stateful firewall does.
NagiostermThe open source monitoring system Ethan Galstad released as NetSaint on 14 March 1999 and renamed Nagios in 2002; a scheduler that runs plugins and reads their exit codes, with a St. Paul company behind it since 2007 and a family of forks around it.
nanotermA small, unmodal terminal editor that shows its own shortcuts along the bottom of the screen.
NANOGacronymThe North American Network Operators' Group: the town hall where the people who actually run the internet compare notes - three meetings a year and one legendary mailing list, since 1994.
NATacronymRewriting IP addresses, and usually ports, as packets cross between address realms, so many private hosts can share one public address.
NAT gatewaytermThe managed service that lets private subnets reach out to the internet without being reachable from it - outbound yes, inbound no.
NAT-TacronymNAT Traversal: IPsec's repair for address translation - detecting NAT in IKE and re-wrapping ESP in UDP/4500 so per-flow ports exist again.
NAT64acronymStateful translation that lets IPv6-only clients reach IPv4 servers by sharing a few public IPv4 addresses.
native VLANtermThe VLAN whose frames cross an 802.1Q trunk without a tag, and into which a trunk port places any untagged frame it receives.
NCPacronymNetwork Control Program: the ARPANET host protocol that TCP/IP replaced.
Neighbor Discovery ProtocoltermThe IPv6 protocol, carried in ICMPv6, by which nodes on a link find each other, their routers and link-layer addresses.
Nelson BritoloreThe creator of T50, the packet injection and stress-testing tool, and the only Brazilian to have presented at PH-Neutral in Berlin, in 2011.
Nelson MuriloloreThe author of chkrootkit, the rootkit detector that has been part of the Unix security toolkit since the late 1990s, and one of the three founders of the ISTS podcast and the YSTS conference.
nerd snipejargonPresenting someone an irresistibly interesting problem, derailing whatever they were supposed to be doing.
NETacronymThe OSI-style address every IS-IS router needs: an area address, a system ID and a selector of 00.
NetFlowtermFlow telemetry: routers export who-talked-to-whom records (addresses, ports, bytes, duration) so you can see traffic patterns without capturing packets.
Netsplit (and riding the split)jargonA partition of an IRC network when the link between servers drops: each side keeps running, users on the far side appear to quit en masse, and when the link returns the two halves merge their state back together.
NetWaretermNovell's network operating system, the file and print server of the LAN era: file sharing instead of disk sharing in 1983, hardware-independent NetWare 286 in 1986, NLMs with NetWare 386 in 1989, a directory service in 1993, TCP/IP as the core protocol in 1998, and a last service pack in May 2009.
network ACL (cloud)acronymThe stateless subnet-level filter in cloud networks: numbered allow and deny rules evaluated in order, both directions filtered independently.
network topologytermThe shape of a network: how nodes are connected, drawn either as the cables actually run or as the traffic actually flows.
Neuromancer (Gibson, 1984)loreWilliam Gibson's 1984 novel, written on a manual typewriter by an author with almost no computer experience, which gave the culture the word cyberspace, the image of the console cowboy, and ICE for intrusion countermeasures.
never touch a running systemexpressionThe conservative operator's creed: if it works, leave it alone.
NewEdgetermNetskope's privately operated global network of data centers - the infrastructure the Netskope One security cloud runs on. Every data center provides full compute for single-pass inspection, with extensive peering close to users and to the major SaaS providers.
NFVacronymNetwork Functions Virtualization: firewalls, routers, and gateways as software on standard servers instead of dedicated appliances.
NIC.brloreNúcleo de Informação e Coordenação do Ponto BR: the entity that implements CGI.br's decisions - formalized in 2003, operating the .br registry (Registro.br) since 2005, plus measurement, IX, and security functions.
NICE Framework Work Role CategoriestermThe five high-level groupings the NICE Framework uses to organise cybersecurity work: Oversight and Governance, Design and Development, Implementation and Operation, Protection and Defense, and Investigation.
Nii Narku QuaynorloreThe Ghanaian scientist recognised for pioneering internet development across Africa.
Nikola TeslaloreThe engineer whose alternating-current systems and 1891 resonant transformer made high frequency and high voltage into tools rather than curiosities.
NimdaloreThe September 2001 worm that attacked through five vectors at once, a week after 9/11.
NIPRNetacronymThe unclassified but sensitive network of the US Department of Defense, and the one with controlled connections to the public internet.
NIS2acronymThe EU directive massively expanding cybersecurity obligations across essential and important sectors.
NISTacronymThe US standards agency whose cryptographic and security publications function as global engineering baselines.
NIST CSF (Cybersecurity Framework)acronymThe NIST Cybersecurity Framework: a voluntary structure for organising security work around a small set of high-level functions.
NIST CSRC (Computer Security Resource Center)acronymThe Computer Security Resource Center, NIST's publication hub for its security standards, guidance and reference data.
no plan survives contactexpressionMoltke's maxim: the plan is what you have until reality responds, then adaptation is the actual skill.
no silver bulletexpressionFred Brooks's claim that no single technique will yield an order-of-magnitude gain in software productivity, because complexity is essential, not accidental.
NODATAtermA negative DNS answer meaning the name exists but holds no record of the type asked: NOERROR with an empty answer.
node splittermDividing a congested cable or PON serving area into two smaller ones, halving the subscribers who share the same capacity.
noisy neighborjargonA tenant whose heavy resource use degrades performance for others sharing the same infrastructure.
noncetermA number used once, included in a protocol so the same message cannot be replayed.
NORAD (North American Aerospace Defense Command)acronymThe binational United States-Canada command (1958) that watches North American airspace - and, since 1985, aerospace - for attack, headquartered at Peterson with its hardened alternate inside Cheyenne Mountain. One command, two countries, one warning picture: a Canadian officer can order the defense of American skies and vice versa.
not invented hereexpressionThe bias toward building something yourself rather than adopting a perfectly good external solution.
NotPetyaloreA 2017 destructive malware outbreak disguised as ransomware.
Novell certifications (CNA / CNE / CNI)termNovell's certification ladder, the first in the IT industry: the Certified Novell Instructor from 1986, the Certified Novell Engineer from 1989 or 1990, the Certified Novell Administrator from 1992 and the Master CNE from 1995, with over 150,000 CNEs by 1999.
NSECacronymA DNSSEC record that proves a name does not exist.
NSEC3acronymA hashed version of NSEC that hides a zone's contents.
NTLMacronymA legacy Microsoft challenge-response authentication protocol.
NTPacronymThe Network Time Protocol: the protocol that keeps clocks across a network agreeing with each other, and with the rest of the world.
nuke and pavejargonTo stop debugging a sick machine and simply wipe it and reinstall from scratch.
null pointer dereferencetermFollowing a pointer that holds null, so the program reads or writes address zero and is stopped by the operating system.
Nullbyte Security ConferencetermThe Salvador, Bahia security conference - technically oriented, community-run, and one of two annual security events the Bahian community sustains.
NullconloreIndia's flagship hacker conference, grown out of null - the country's largest open security community - and held on the beaches of Goa since 2010.
number portingtermMoving a phone number between carriers while keeping it - a regulated right, a database update, and a fraud vector when hijacked.
NVDacronymThe US government's public database of known vulnerabilities.
NVGREacronymNetwork Virtualization using Generic Routing Encapsulation: a network virtualisation scheme carrying tenant traffic inside an existing tunnelling protocol.
NX bit / DEPtermMarking memory pages as either writable or executable, but never both, so injected data cannot run as code.

41

O Rei da Internet (2026)loreThe 2026 Brazilian biographical crime film directed by Fabrício Bittar, starring João Guilherme as Daniel Nascimento - a teenager who joined one of the country's large online criminal operations in the dial-up era, moved millions through card and banking fraud before turning seventeen, and became the target of a Federal Police investigation.
OAuthtermA standard that lets an app access your data on another service without handling your password.
object storagetermStorage addressed by key rather than by path or block, with metadata attached and no filesystem semantics.
observabilitytermHow well you can understand what a system is doing internally from the signals it emits.
observer effecttermWhen the act of measuring changes the behaviour being measured, so the fault disappears while you are watching for it.
OC levels (OC-3 to OC-768)termThe SONET Optical Carrier ladder - OC-3, OC-12, OC-48, OC-192 - every rung 51.84 Mb/s times n, with SDH's STM names for the same speeds.
OCSPacronymA protocol to check in real time whether a certificate has been revoked.
off-by-one errorloreThe classic error of counting one too many or one too few, especially at the boundaries of a loop or range.
OGNL (Object-Graph Navigation Language)acronymAn expression language for reading and writing Java object properties, used as a configuration feature by some products and as an attack vehicle against others.
OIDCacronymAn identity layer on top of OAuth 2.0 for authenticating users.
OKRacronymObjectives and Key Results - Andy Grove's goal-setting discipline from Intel: a qualitative ambition, measured by a few brutally quantitative results.
OLTacronymOptical Line Terminal: the provider-side head of a PON, terminating hundreds of subscriber fibers and scheduling every upstream burst.
on the internet, nobody knows you're a dogexpressionThe 1993 New Yorker cartoon that named the internet's founding identity condition: online, nobody can tell who or what you are.
onboarding / offboardingexpressionThe account-and-access lifecycle at hiring and departure: created and granted on day one, revoked completely on the last - the second half is the audit finding.
onion routingtermA privacy technique that wraps traffic in layers of encryption and bounces it through several relays.
ONTacronymOptical Network Terminal: the customer-side box that converts the PON's light into Ethernet - the fiber modem, in everyday speech.
Open GraphtermA small set of HTML meta tags that tell other sites how to display a link to your page - the title, image, and description in the preview card.
open relaytermA mail server that will forward messages from anyone to anyone - the default in the early internet and a liability ever since.
Open sourcetermSoftware under a license meeting the Open Source Initiative's ten criteria: free redistribution, available source code, permission for derived works, and no discrimination against people or fields of use. The term was coined in 1998 (Christine Peterson) as a business-friendlier name for what the four freedoms already described.
OpenTokentermPing Identity's encrypted token format for integration kits: the authenticated identity travels between PingFederate and an application as an OpenToken carried by cookie, query parameter, or POST.
OpenVPNtermAn open-source tunnel that runs its own protocol over UDP or TCP using TLS for key exchange, independent of any vendor's appliance.
OpenWrtloreThe replacement Linux firmware for consumer and small-business network devices, which began after a router vendor's use of Linux obliged them to publish their source under the kernel's licence.
Operation AuroraloreThe 2009 espionage campaign against Google and dozens of companies that dragged nation-state hacking into the open.
Operation SundevilloreThe US Secret Service crackdown of May 1990: coordinated raids across fourteen cities that seized bulletin-board systems, computers and floppies from the hacker underground, aimed at credit-card and telephone fraud.
OPSECacronymThe discipline of protecting the small pieces of information that together reveal too much.
OPTacronymA pseudo-record that carries EDNS options in a DNS message.
opt-in vs. opt-outexpressionThe two default postures of consent: nothing happens until you say yes, versus everything happens until you say no - defaults decide outcomes at population scale.
optical power budgettermThe decibels a link can afford to lose between transmitter and receiver; splitters, splices, connectors, and distance all spend from it.
optical splittertermThe passive glass component that divides one PON fiber into many - no power, no electronics, just engineered light loss.
OSI modeltermThe seven-layer reference model of network communication, from the physical signal at layer 1 to the application at layer 7.
OSINETacronymA testbed network for checking that OSI implementations from different vendors actually interoperated.
OSPFacronymOpen Shortest Path First: the standard link-state interior routing protocol, in which every router maps the whole area and computes shortest paths.
OSPF areatermA group of OSPF networks and routers that shares one link-state database, its topology hidden from the rest of the domain.
OTDRacronymOptical Time-Domain Reflectometer: fires light pulses down a fiber and reads the reflections, mapping every splice, bend, and break by distance.
OTPacronymA password valid for a single login or a short window.
OUIacronymThe 24-bit prefix the IEEE Registration Authority assigns to an organisation, forming the first half of the MAC addresses it issues.
out-of-band managementexpressionA separate management path - console servers, dedicated ports, even 4G - that still works when the production network is the thing that broke.
overlay networktermA network built on top of another one, whose links are tunnels across the network beneath it.
overload bittermA flag in an IS-IS router's LSP that tells other routers not to use it for transit, while still reaching it as a destination.
oversubscriptiontermSelling or provisioning more aggregate capacity than the uplink actually has, betting that everyone never peaks at once - a ratio, and a promise.
OWASPacronymA nonprofit community that produces free, widely used guidance on application security.

120

"public Wi-Fi means instant hacking"loreDisputed / commonly mistoldA decade-old truth gone stale: with HTTPS now near-universal, the café network sees hostnames, not contents. The realistic risks shrank to fake portals, rogue twins, and the rare unencrypted service.
PACacronymA JavaScript file that tells a browser which proxy to use per URL.
Package managertermThe system that installs, upgrades and removes software while tracking dependencies, file ownership and integrity - apt and dpkg on Debian lineages, dnf and rpm on Red Hat and SUSE, pacman on Arch, apk on Alpine, portage on Gentoo.
packettermA unit of data with its own header, forwarded independently of whatever came before or after it.
packet filtertermThe simplest filtering: decide on each packet independently, by addresses, protocol and ports, with no memory of what came before.
packet losstermPackets that never arrive - discarded by a full queue, corrupted in transit, or dropped by policy.
packet switchingtermForwarding data as independent packets that share links with everyone else's, instead of holding a dedicated path open for the duration of a conversation.
PagertermA one-way radio receiver on a simulcast broadcast network - the bip: no transmitter, no uplink, everything in range decoded and only your address displayed. Classic service relayed messages through human operators; POCSAG and FLEX carried the digital formats.
PageRanktermGoogle's ranking idea: score a page by who links to it, weighting links from well-linked pages more heavily.
PAMtermControlling and recording the use of administrative accounts - checking credentials out, brokering the session, and rotating the secret afterwards.
PANacronymPersonal area network: the few metres around one person, where devices pair with each other rather than joining an infrastructure.
PAPacronymThe Password Authentication Protocol - PPP's simplest, and least safe, way to log in: the password in plaintext.
Parkinson's lawexpression'Work expands so as to fill the time available for its completion.'
PascaltermNiklaus Wirth's imperative, procedural programming language of 1970, designed as a small, efficient language to encourage structured programming and data structuring; the teaching language of the 1980s, displaced by C, and the root of Object Pascal and Delphi.
PasskeytermA public-private key pair created for one specific site, where the private key never leaves the authenticator and the browser will only offer it to the exact origin it was registered for.
Password Credential ValidatortermPingFederate's reusable password-checking component: given a username and password, a PCV answers valid or invalid against a source such as an LDAP directory - and adapters consume it rather than users meeting it directly.
password managertermA vault that generates and stores a unique strong password per site, unlocked by one master secret - the practical end of password reuse.
passwordlesstermAuthenticating with a key held by a device rather than with a shared secret the user types.
PATtermTranslating many private addresses onto one public address by also rewriting ports - what most people mean when they say NAT.
patchtermA change applied to existing software to fix a defect or close a vulnerability.
patch managementtermThe cycle of testing and deploying software updates across the fleet - balancing the risk of the bug against the risk of the fix.
patch paneltermThe passive frame where permanent cabling terminates in numbered jacks, so changes happen with patch cords instead of a punch-down tool.
Patch Tuesday, Exploit WednesdayexpressionThe rhythm of Windows security: fixes ship on the second Tuesday, and reverse-engineered attacks follow within days.
Path MTU DiscoveryacronymHow a sender finds the smallest MTU along the whole route, not just the first hop.
path-vector routingtermA routing method in which each route carries the list of autonomous systems it has crossed, not just a distance.
Paul BaranloreThe RAND engineer who designed the distributed network - no central switch, messages cut into blocks routed independently - in studies published from 1960 and collected in 1964 as On Distributed Communications.
Paul VixieloreThe engineer behind BIND and much of the operational practice around DNS, founder of the Internet Systems Consortium, author of Vixie cron, and creator of the first successful commercial anti-spam service.
PaxostermLeslie Lamport's consensus algorithm, the first proved correct for an asynchronous network where machines may fail, and the basis of most replicated systems built since.
payloadtermThe part of an attack that carries out the intended action, once delivery succeeds.
pcap or it didn't happenexpressionThe network engineer's evidence standard: claims about traffic are settled by a packet capture, not by opinion.
PCI DSSacronymThe payment-card industry's security standard for anyone who stores, processes, or transmits cardholder data.
PDFacronymA fixed-layout document file format.
PEAPacronymProtected EAP, EAP Type 25: a TLS tunnel authenticated by the server's certificate, inside which a second, weaker EAP method (in practice almost always EAP-MSCHAPv2) authenticates the user with a password.
PEBKACacronymHelpdesk code for 'the problem exists between keyboard and chair': the user.
peer-to-peertermAn architecture where every node is both client and server, providing resources to the others directly.
peeringtermTwo networks exchanging each other's customer traffic directly, usually settlement-free - because both save on transit.
PEMacronymA Base64 text wrapper for certificates and keys, with BEGIN/END lines.
penetration testtermAn authorized simulated attack that finds weaknesses before a real attacker does.
peppertermA secret value added alongside the salt when hashing passwords.
percussive maintenancejargonThe time-honored art of fixing a device by striking it firmly - occasionally effective on oxidized contacts, always effective on morale.
perfect is the enemy of goodexpressionVoltaire's warning that pursuing the flawless blocks shipping the sufficient.
persistencetermAn attacker's arrangements for surviving a reboot, a password change or a partial cleanup.
PERÚHACK (and LimaHack)termPeru's annual offensive-security conference in Lima - free to attend, deliberately technical, and explicitly carrying forward the spirit of its predecessor LimaHack, with a lineage the organisers date to 2013.
Peter EckersleyloreThe EFF technologist who co-founded Let's Encrypt, and so removed the price of encrypting a website.
PGP (Pretty Good Privacy)acronymThe encryption program Phil Zimmermann released free in 1991, combining public-key and symmetric cryptography for mail and files, and the OpenPGP standard and implementations - notably GnuPG - that grew from it.
Phiber Optik (Mark Abene)termThe New York phone-switch specialist who left the Legion of Doom to found Masters of Deception, became the most visible hacker of the early 1990s, and served a year in federal prison in 1994 for conspiracy.
Phil ZimmermanntermThe author of PGP, who released strong encryption free to the public in 1991 and spent three years under US criminal investigation for munitions export because the software left the country.
phishingtermTricking someone into revealing credentials or running malware, usually by email.
PhrackloreThe underground e-zine, published since 1985, that carried hacker culture's founding texts and its deepest technical writing.
PhreakingjargonThe exploration and manipulation of the telephone network - the craft that preceded computer hacking and named itself with the ph of phone. Its golden age ran on in-band signaling: the network carried its control tones on the same line as the voice, so whoever could produce the tones could command the switch.
Piet BeertemaloreSystem administrator at Amsterdam's Mathematical Centre who ran the machine at the junction of European network traffic, registered .nl, and on 17 November 1988 at 2:28 in the afternoon received the message that put Europe on the internet.
PIIacronymAny data that can identify a specific person, on its own or combined with other data.
PIMacronymProtocol Independent Multicast - the routing of multicast: building the delivery trees that carry one stream to many networks, using whatever unicast routing table already exists.
PINacronymA short numeric secret used to authenticate a person.
pingtermThe tool that sends ICMP Echo Requests and times the Echo Replies: the first test of whether a host is reachable.
pizza boxjargonA flat 1U rack-mount server or switch - the form factor of a large pizza, stacked by the dozen.
PKCEacronymAn OAuth extension that protects the authorization-code flow.
PKIacronymThe system of certificates and authorities that lets strangers trust each other's public keys.
Plenum-rated cabletermThe fire rating that decides where a cable may legally run - plenum (CMP) for air-handling spaces, riser (CMR) for vertical shafts.
PMTUDacronymPath MTU Discovery: sending with Don't Fragment set and shrinking on ICMP Fragmentation Needed replies - which over-filtered networks silently break.
podtermThe smallest deployable unit in Kubernetes: one or more containers that share networking and storage.
PoEacronymPower over Ethernet: the switch feeds power down the data cable, so phones, cameras, and access points need no outlet.
PoE injectortermThe midspan device that adds Power over Ethernet to a link whose switch cannot supply it.
Poe's lawexpressionWithout a clear marker of intent, parody of extreme views is indistinguishable from the views themselves.
pole attachmenttermThe regulated right to hang cables on utility poles owned by power or phone companies - rented space, strict rules, long queues.
Policy sprawl (and the exception register)termThe accumulation of rules and exceptions that outgrows anyone's ability to review them, ending in permits nobody can justify and nobody dares remove.
PONtermA fibre access network where one feed is split optically to many homes, with no powered equipment between the exchange and the subscriber.
POODLEloreA 2014 attack that forces a downgrade to SSL 3.0 to exploit its broken CBC padding.
PoPacronymPoint of Presence: a provider's physical edge site - where the CDN caches, the transit hands off, and the backbone touches the ground.
POP3acronymAn older, simple protocol for downloading email from a server.
porttermA sixteen-bit number that identifies which service or conversation on a host a packet belongs to.
port mirroring (SPAN)termCopying a port's or VLAN's traffic to another port so an analyzer or IDS can watch without sitting inline.
port securitytermSwitch-port rules limiting which and how many MAC addresses may appear, so a rogue hub or spoofed device trips the port instead of joining it.
Port-block allocation (deterministic NAT)termAssigning each subscriber a fixed, predictable block of source ports for the duration of a session, and logging that assignment - rather than logging every individual translation as it happens.
PoSacronymPacket over SONET - IP straight onto the optical hierarchy in PPP framing, skipping ATM's cell tax. The backbone link of the early-2000s internet core.
POSIXacronymA standard defining a portable interface for Unix-like operating systems.
post-incident reviewtermThe meeting or document that examines an incident after service is restored, to decide what changes as a result.
post-quantum cryptographytermNew algorithms designed to stay secure even against a future large-scale quantum computer.
Postel's lawexpression'Be conservative in what you do, be liberal in what you accept from others' - the robustness principle from the TCP specification.
postmortemtermA written account, after an incident is resolved, of what happened and what should change.
Posture profiletermA named device-state check evaluated by Zscaler Client Connector - disk encryption, OS state, certificate presence, and similar signals - consumed by ZPA access rules as conditions and surfaced to ZIA as device trust.
POTSacronymPlain Old Telephone Service: the analog telephone network - a voice in the 300-3400 Hz band over a dedicated twisted pair for the duration of a call. Dial-up internet was data squeezed through its voice channel, one occupied line at a time.
PPPacronymThe Point-to-Point Protocol - the standard way to run IP (and more) over a serial link, from dial-up to modern broadband.
PPPoEacronymPoint-to-Point Protocol over Ethernet: wraps each subscriber's traffic in an authenticated session, so the ISP knows who you are before routing you.
PPTPacronymPoint-to-Point Tunneling Protocol: the first widely deployed remote-access VPN, broken repeatedly since 1998 and retained only as a lesson.
premature optimizationexpressionTuning code for speed before you know it matters, at the cost of clarity and time.
PRFacronymA function that stretches a secret into as much key material as a protocol needs.
PRIacronymThe leading field in a syslog message encoding facility and severity.
PrilexloreThe Brazilian threat group active since 2014 that began with automated teller machine malware - jackpotting more than a thousand machines at one bank in a single 2016 incident and cloning some twenty-eight thousand cards - then rebuilt itself around point-of-sale systems.
PrintNightmareloreA 2021 set of flaws in the Windows Print Spooler enabling remote code execution.
PrismatermPalo Alto Networks' cloud-security family, announced in May 2019: securing cloud workloads, cloud access, and the WAN that reaches them.
privacy by designtermBuilding data protection into systems from the first sketch - minimization, defaults, and safeguards as architecture, not as patches.
privacy-enhancing technologiestermThe toolbox that lets data be used while exposing less of it: differential privacy, homomorphic encryption, secure multiparty computation, federated learning.
private DNS zonetermDNS names that resolve only inside your VPCs - internal service names invisible to the public internet.
private endpoint / PrivateLinktermConsuming a service through a private address inside your own VPC, so the traffic never touches the public internet.
Private Service EdgetermA ZPA Service Edge instance the customer hosts in their own environment, brokering the same stitched Microtunnels as the cloud's Public Service Edges but keeping the meeting point local.
privilege creepjargonThe slow accumulation of access rights by a person or an account as jobs change and old permissions are never withdrawn, until what they can do bears no relation to what they need to do.
privilege escalationtermTurning limited access into greater access, ideally administrator or root.
problem managementtermThe ITIL practice that hunts the cause behind recurring incidents: incidents restore service, problems remove the reason it broke.
profilingtermAutomated evaluation of a person from their data - predicting behavior, interests, reliability, movement - the model of you that decisions get made against.
Project MACloreThe MIT time-sharing research project whose people and ideas seeded much of computer communications.
promiscuous modetermA network interface setting that accepts every frame on the wire, not just those addressed to it.
provisioningtermThe automated chain that turns a signed contract into a working service: records created, equipment authorized, speed profile applied.
proxytermAn intermediary that terminates one connection and makes another on the requester's behalf, rather than forwarding packets.
ProxyLogonloreA 2021 chain of Microsoft Exchange flaws exploited widely in the wild.
ProxyShellloreA 2021 Exchange exploit chain related to ProxyLogon.
PRTGacronymPaessler's monitoring software, named Paessler Router Traffic Grapher, which counts and licenses everything in sensors, one sensor per measured value, with a free edition up to 100 of them.
pseudonymizationtermReplacing identifiers with pseudonyms while keeping the mapping elsewhere - reversible by design, protective in the meantime.
PSSacronymA randomized RSA signature scheme, more robust than the older deterministic padding.
PTP (Precision Time Protocol)acronymPrecision Time Protocol, IEEE 1588: time synchronisation to sub-microsecond accuracy, achieved by putting timestamps in hardware rather than software.
PTRacronymA DNS record that maps an IP address back to a hostname.
Public Service EdgetermZscaler's enforcement node in its worldwide data centers: terminates sessions, applies identity and policy, originates the onward connection; packet data stays in memory, never on disk.
public vs. private subnetexpressionThe basic VPC split: public subnets route to the internet gateway and can be reached; private subnets reach out through NAT and cannot.
public-key cryptographytermEncryption using a pair of keys, one public and one private, so no shared secret must be exchanged first.
purple teamtermRed and blue working together, so every offensive finding immediately improves the defence.
purpose limitationtermData collected for one stated purpose may not be quietly reused for another - the principle that keeps datasets from wandering.
PVAacronymF5 hardware that accelerates simple Layer 4 traffic.
Pwn2OwnloreThe hacking contest founded at CanSecWest in 2007 where researchers compromise fully patched software - browsers, operating systems, phones, and later cars - live, for cash and for the device itself. Working exploits are handed to the vendors under coordinated disclosure.
pwnedloreSlang for having been thoroughly defeated or compromised.
PXEacronymThe firmware convention for booting a machine over the network: a DHCP exchange, then a TFTP download of a boot program.

7

"quantum computers will break all encryption"loreDisputed / commonly mistoldShor's algorithm threatens today's public-key math (RSA, elliptic curves) on a large fault-tolerant quantum computer - which does not yet exist. Symmetric ciphers and hashes mostly just double their key sizes.
QAacronymThe discipline of building confidence that software does what it should, before users find out otherwise.
QATacronymIntel hardware that offloads cryptography and compression from the CPU.
QoSacronymTechniques that prioritize some network traffic over others to meet performance needs.
QRacronymA 2D barcode that phones scan to read data quickly.
QRadartermThe security intelligence platform Q1 Labs built in Fredericton, sold to IBM in 2011, and split in 2024 between IBM, which kept the on-premises product, and Palo Alto Networks, which bought the SaaS version.
quorumtermThe minimum number of members that must agree for a distributed system to act - normally a majority, so that two disjoint groups can never both decide.

95

RA-GuardacronymA switch feature that drops IPv6 Router Advertisements arriving on ports where no router is supposed to be.
rabbit holeexpressionAn investigation that keeps pulling you deeper, well past where you meant to stop.
RaccoonloreA 2020 timing attack on TLS-DH that can recover the session key in rare cases.
race conditiontermA bug where the outcome depends on the unpredictable timing of concurrent operations.
Rack (19-inch) and rack unittermThe 19-inch frame that standardizes how equipment mounts - and the rack unit (U), the 1.75-inch height quantum everything is measured in.
Radia PerlmanloreThe engineer who invented the spanning tree algorithm at Digital in the 1980s, making bridged Ethernet survivable, and who wrote the algorithm's poem.
radio propagationtermHow a radio signal actually travels from transmitter to receiver, which depends far more on frequency than on power.
radio spectrumtermThe range of electromagnetic frequencies used for radio, conventionally divided into bands from VLF to EHF.
RADIUSacronymThe AAA workhorse: authenticates who connects, authorizes what they get, and accounts for what they used - for ISPs, VPNs, and Wi-Fi alike.
RADIUS CoA (Change of Authorization)acronymThe Dynamic Authorization Extensions to RADIUS of RFC 5176: Disconnect-Request and CoA-Request messages a server sends to a network access server on UDP 3799 to end a session or change its authorisation while it is running.
RadSec (RADIUS over TLS)termRADIUS over TLS, RFC 6614: the whole RADIUS packet carried inside a TLS session on TCP port 2083, with both ends authenticated by X.509 certificates and the RADIUS shared secret fixed to the literal string "radsec".
RafttermA consensus algorithm designed to be understandable, giving the same guarantees as Paxos through an explicit leader, an append-only log and a defined election.
RAGacronymA technique that feeds an AI model retrieved documents so its answers are grounded.
RAIDtermCombining several disks so the array survives losing one - or more, depending on the layout chosen.
RAID is not a backupexpressionThe storage truth that redundancy protects against disk failure, not against deletion, corruption, or ransomware.
rainbow tabletermA precomputed lookup that reverses unsalted password hashes quickly.
Ralph MerkleloreThe third name on the public-key patent with Diffie and Hellman, who arrived at the idea independently as a student, and the inventor of the hash tree that carries his name.
Randy BushloreThe operator who spent forty years helping other countries build their own networks, and who later went after the routing system's security.
RansomwaretermAn intrusion that ends in encrypting the victim's data for payment - and, in its modern form, in copying that data out first so the threat to publish survives any recovery.
rate limitingtermCapping how often something may happen, to protect a system from load it cannot absorb.
Ray TomlinsonloreThe BBN engineer who in 1971 made a message reach a person on a different machine, and picked the at sign to say which one.
RBACacronymRole-Based Access Control: permissions granted to roles, people assigned to roles - access managed by job, not by individual favor.
RCEtermA defect that lets an attacker run their own code on a system across the network, without needing an account on it.
RCODEacronymThe status code in every DNS response, such as NOERROR (0), SERVFAIL (2), NXDOMAIN (3) or REFUSED (5).
RDAPtermThe structured, authenticated successor to WHOIS: the same registration data, returned as JSON over HTTPS, with differentiated access instead of one public answer for everyone.
read-only FridayexpressionThe ops tradition of making no production changes on Friday, because weekends exist.
Real Programmers Don't Use PascalloreA 1983 satirical essay whose 'Real Programmer' is a macho hacker who scorns high-level niceties.
recursive resolvertermA DNS server that answers on a client's behalf, from its cache or by querying authoritative servers until it has the answer.
red teamtermA group that plays the adversary to test an organization's defences realistically.
ReddittermThe threaded, voted discussion platform whose networking and vendor subreddits carry an outsized share of real-world troubleshooting.
ReDoSacronymA denial-of-service caused by a regular expression that takes catastrophically long on certain input.
referraltermA DNS response that holds no answer itself but names the servers of a zone closer to the name that was asked.
Reflections on Trusting TrustloreKen Thompson's 1984 demonstration that a compiler can hide a self-propagating backdoor invisible in the source.
regextermA compact pattern language for matching and extracting text.
regiontermA geographic area where a cloud provider runs data centres, and the boundary most cloud services do not cross by default.
region (cloud)termA geographic cluster of availability zones, isolated from every other region - the blast-radius boundary and the data-residency unit.
regressiontermA defect introduced by a change, where something that previously worked stops working.
regression testingtermRe-running existing tests to confirm that a change did not break something that already worked.
remote desktoptermTaking over a user's screen and input from afar - RDP, VNC, and their commercial cousins - support's teleportation.
remote handsexpressionData-center staff acting as your on-site body: swap the drive, read the LEDs, move the cable - your eyes and hands, billed by the quarter hour.
repeatertermA radio station on high ground that receives on one frequency and simultaneously retransmits on another, extending the range of low-power stations.
replay attacktermCapturing a valid message and sending it again to produce an unauthorized effect.
replicationtermKeeping copies of data on more than one machine, so the loss of one does not lose the data.
ResellertermThe company that sells and installs somebody else's products for the organisation that will run them; also called a value-added reseller or integrator.
reserva de mercadoloreThe Brazilian policy that legally reserved the domestic computer market for nationally-owned companies from 1984 to 1992.
responsible disclosuretermReporting a vulnerability privately to the vendor and giving them time to fix it before going public.
RESTacronymAn architectural style for web APIs built on HTTP methods and resources.
retentiontermHow long records are kept before deletion - a decision with legal, financial and investigative consequences that usually gets made on storage cost alone.
reverse proxytermA server that receives client requests and forwards them to back-end servers on their behalf.
RFCtermThe numbered document series in which internet protocols are specified - named a request for comments because the first author had no authority to declare a standard.
RFC 1149 (IP over Avian Carriers)loreAn April Fools' RFC from 1990 that specifies carrying IP datagrams by homing pigeon.
RFC 1918 addressestermThe private IPv4 ranges - 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 - routable inside, never on the public internet, and the reason NAT exists.
RFC 2544acronymThe 1999 benchmarking methodology that defined how a network device's throughput, latency, frame loss and burst tolerance are to be measured.
RFC 2549 (IP over Avian Carriers with QoS)loreAn April Fools' RFC from 1999 that adds quality of service to the pigeon-based IP transport of RFC 1149.
RFC 6214 (IP over Avian Carriers for IPv6)loreA 2011 April Fools' RFC that formally adapts RFC 1149's avian carrier transport to IPv6.
Richard Stallman (rms)termThe MIT AI Lab hacker who, watching the lab's culture dissolve into proprietary software in the early 1980s, launched the GNU Project in 1983, founded the Free Software Foundation in 1985, and wrote the four freedoms and the GPL.
right to erasuretermThe right to have personal data deleted when there is no longer a lawful reason to keep it - popularly, the right to be forgotten.
ring topologytermEach node connects to exactly two neighbors, forming a closed loop that traffic travels around.
RIPacronymRouting Information Protocol - the internet's first common routing protocol: hop count as the metric, 15 hops as the horizon, and 'routing by rumor' as the method.
risktermThe combination of how likely something bad is and how much it would cost - the number a decision is supposed to be made against.
RJ45acronymThe eight-position modular connector on the end of nearly every Ethernet patch cord - properly the 8P8C plug.
RMAacronymReturn Merchandise Authorization: the vendor's blessing to send hardware back - the number without which the box comes home unopened.
RNGacronymA source of random values, ideally unpredictable.
RNP (Rede Nacional de Ensino e Pesquisa)acronymBrazil's national education and research network: the academic backbone created in 1989, and the infrastructure the Brazilian internet was actually built on.
RoadsecloreLatin America's largest hacker festival - a full-day carnival of talks, CTF, drones, and lockpicks that has toured Brazil's state capitals since 2014.
Robert TaylorloreThe research director who started the ARPANET in 1966 and then used his agency's budget leverage to conscript the man who built it.
ROBOTloreA 2017 return of a classic RSA padding oracle affecting many TLS stacks.
ROCAloreA 2017 flaw in RSA key generation in certain chips that made keys factorable.
Rodrigo Montoro (Sp0oKeR)termBrazilian researcher known as Sp0oKeR, long associated with intrusion detection and detection engineering, and the author of one of the two 2010 lists - his own roster of Brazilian security people on Twitter - that first mapped the community.
Rodrigo Rubira Branco (BSDaemon)termThe Brazilian vulnerability researcher who has led malware and vulnerability research at Qualys, headed research at Check Point in Israel, worked on IBM's Advanced Linux Response Team, and has published dozens of flaws in widely used products - one of the country's most visible names on the international conference circuit.
rollbacktermReturning a system to its previous working state - which is only a plan if it has been tried.
Ron RivestloreThe R in RSA: co-author of the 1977 paper that turned public-key cryptography from a proposal into something implementable, and joint recipient of the 2002 Turing Award.
Room 641AloreThe San Francisco AT&T facility where a technician revealed fiber splitters copying Internet traffic for the NSA.
root causetermThe underlying reason a failure happened, beneath its visible symptoms.
rough consensus and running codeexpressionThe IETF's working philosophy: standards emerge from broad agreement plus implementations that actually work.
Route leaktermRe-announcing routes beyond their intended scope - typically passing routes learned from one transit provider or peer to another - so a network briefly claims to be a path to far more of the internet than it can carry.
route reflectortermAn iBGP speaker allowed to pass routes learned from one internal peer on to others, so the AS needs no full mesh.
route table (cloud)termThe per-subnet routing decisions of a VPC: which destinations go to the internet gateway, the NAT, the peering, or the tunnel.
routertermA device that forwards packets between networks by choosing a next hop from a routing table.
router advertisementtermThe ICMPv6 message, type 134, in which an IPv6 router announces itself, its prefixes and how hosts should configure.
RowhammerloreA hardware attack that flips memory bits by rapidly accessing neighboring rows.
RPKIacronymA system of signed records that lets routers check whether a network is allowed to announce a given address block.
RPMacronymA package format and manager used by Red Hat-family Linux systems.
RPO and RTO (recovery objectives)acronymRecovery point objective is how much data you accept losing, measured backwards from the incident; recovery time objective is how long you accept being down. Together they define what a recovery plan must achieve.
RPZacronymA DNS mechanism for rewriting or blocking answers by policy.
RS256acronymA JWT signing algorithm: RSA with SHA-256.
RSAacronymThe classic public-key algorithm for signatures and, historically, key transport.
RSA ConferencetermThe industry's biggest stage: born in 1991 as a small gathering of cryptographers, now the annual San Francisco mega-show where the security business shows what it is selling this year.
RSTPacronymThe rapid version of spanning tree, IEEE 802.1w, which converges in moments by handshake instead of waiting out timers.
RTFMacronymThe support-culture retort telling an asker the answer is already in the documentation.
RTMPacronymA protocol for streaming audio and video, historically Flash-based.
RTO and RPOtermHow long recovery may take, and how much recent data may be lost - the two numbers that turn continuity from an aspiration into a design.
RTSPacronymA control protocol for streaming media - play, pause, seek.
rubber duck debuggingloreDebugging by explaining your code, line by line, to an inanimate object.
runbooktermA documented procedure for carrying out a specific operational task or handling a known situation.

192

safe methodtermAn HTTP method whose defined semantics request no state change on the server - reading, not writing.
safe modetermBooting with minimal drivers and services: if the problem vanishes here, something loaded at startup is the suspect.
salttermRandom data added to a password before hashing, unique per user.
same-origin policytermThe browser rule that script from one site cannot read responses from another, where a site means scheme, host and port together.
SAMLacronymAn XML standard for exchanging authentication between identity providers and services.
SampaSecloreSao Paulo's CitySec - the informal monthly bar meetup of the city's security professionals and enthusiasts, third Wednesday of the month.
Samuel MorseloreThe portrait painter whose code turned electricity into a message, sent from Washington to Baltimore on 24 May 1844.
SANacronymThe certificate field listing all hostnames the certificate is valid for.
Sandro SüfferttermOne of the earliest Brazilian security bloggers - his SSegurança blog compiled the first substantial index of Portuguese-language security blogs in 2008 - and a long-running figure in digital forensics and threat intelligence in Brazil.
SANS InstitutetermThe best-known commercial training institute in security operations, and home of the GIAC certifications and the Internet Storm Center.
SAP (Novell)acronymNetWare's Service Advertising Protocol - how servers announced 'here I am, and here's what I offer' across an IPX network.
Sarbanes-Oxley (SOX)acronymThe 2002 United States law on corporate financial reporting that made internal controls, including access control, a matter of legal liability for company officers.
SASEacronymGartner's 2019 model that converges the WAN and its security stack into a single cloud-delivered service at the edge, as close to the user as possible.
SATAN (the 1995 scanner panic)loreThe free network vulnerability scanner released in April 1995 by Dan Farmer and Wietse Venema - and the first time the industry had a full public argument about whether giving defenders an attacker's tool is responsible.
SBOMacronymSoftware Bill of Materials: the ingredient list of a piece of software - every component and version, so 'are we affected?' has an answer.
SBSeg (Simpósio Brasileiro de Segurança)acronymThe Brazilian Symposium on Information and Computer System Security, run annually by the Brazilian Computer Society - the academic counterpart to the country's practitioner conferences, now past its twenty-fifth edition.
Schneier's lawexpression'Anyone can invent a security system so clever that he can't think of how to break it.'
Schrems IIloreThe 2020 EU court ruling that struck down the EU-US Privacy Shield: one Austrian law student's complaints, twice, reshaped transatlantic data law.
schroedinbugjargonA bug that only manifests after someone reads the code and realizes it should never have worked.
Schroedinger's backupexpressionThe state of any backup that has never been restored: simultaneously good and bad until someone opens the box.
SCIMtermSystem for Cross-domain Identity Management: the open standard for provisioning - creating, updating, grouping, and deactivating user accounts across systems over a JSON REST API, with schemas from RFC 7643 and the protocol from RFC 7644.
Scooter (AltaVista's crawler)loreAltaVista's web crawler, written by Louis Monier at DEC.
scope creepexpressionThe uncontrolled expansion of a project's scope after it is already underway.
SCPacronymA simple command for copying files over an SSH connection.
script kiddiejargonAn attacker who runs other people's exploit tools without understanding how they work.
SD-WANacronymSoftware-Defined WAN: branch connectivity steered by central policy over any mix of links - MPLS, broadband, LTE - chosen per application in real time.
SDLCacronymIBM's Synchronous Data Link Control - the link-layer protocol of SNA, and the ancestor of HDLC.
SDNacronymSoftware-Defined Networking: separating the control plane from the forwarding plane, so the network is programmed centrally instead of configured box by box.
SEC1acronymA standard format for encoding elliptic-curve private keys.
secrets managementtermCentralizing passwords, tokens, and keys in a vault with access control, audit, and rotation - instead of scattering them through code and config.
secure boottermChecking each stage of startup against a signature before running it, so code that loads before the operating system cannot be replaced silently.
Security BSidesloreThe worldwide series of loosely affiliated community security conferences begun in 2009 by Mike Dahn, Jack Daniel and Chris Nickerson - named after the B-side of a vinyl record, and started from talks that Black Hat had rejected.
Security BSides PerútermThe Peruvian edition of the global Security BSides circuit, running since 2018 - community-organised, free of commercial pitches, and built around technical talks on real problems.
Security BSides São Paulo (BSidesSP)termThe Sao Paulo edition of the global Security BSides circuit - a free, community-organised conference on information security and hacker culture, run by working professionals, with talk tracks, villages, a capture-the-flag contest and a pre-event day of mini-trainings.
security grouptermThe cloud's stateful per-instance firewall: allow rules attached to workloads, return traffic implied, default deny inbound.
security is a process, not a productexpressionBruce Schneier's reminder that security is a process, not a product - nothing you buy makes you done.
Security LeadersloreThe executive end of the Brazilian security calendar - where the people who sign things meet, rather than the people who configure them.
security questionstermKnowledge-based authentication - mother's maiden name, first pet - identity proofs from an era before social media published the answers.
security theaterexpressionBruce Schneier's term for measures that perform protection visibly while providing little of it.
Segal's lawexpressionA man with a watch knows what time it is; a man with two watches is never sure.
Segment grouptermA ZPA collection of application segments used as the policy axis: access rules commonly target segment groups, so grouping strategy is policy strategy.
semantic versioningtermThe MAJOR.MINOR.PATCH convention, where each number carries a promise about compatibility.
separation of dutiestermThe control that no single person should hold enough privilege to misuse a system alone, so that completing a sensitive action requires two people, or two roles that the same person cannot hold.
serverlesstermA model where you run code without managing servers, and pay only while it runs.
service accounttermAn identity for software rather than a person: the credentials under which pipelines, jobs, and applications act.
service control policytermOrganization-level guardrails that bound what any account may ever do - ceilings on permissions that even administrators cannot exceed.
service desktermThe single point of contact between users and IT: intake, triage, resolution or escalation, and the record of it all.
service meshtermA dedicated layer that manages service-to-service communication inside a cluster.
service providertermThe application side of a federation: the party that consumes assertions or tokens and grants access based on them - SAML's SP, OIDC's relying party.
Services companytermA company that sells people and process rather than product: consulting, outsourcing, managed operations.
sessiontermThe server's memory that a particular client has already been authenticated, usually represented by a token the client returns.
Session persistence (stickiness)termSending a returning client back to the same backend server, because that server holds state the others do not have.
SEV1jargonThe highest incident severity: the service is down, customers feel it, and everything else can wait.
severitytermHow bad a fault is, judged by its effect on the business rather than by how loudly it is reported.
severity levels (P1-P4)termThe impact-and-urgency ladder for incidents: P1 is everyone-down-drop-everything, P4 is a papercut with a queue.
SFP transceiveracronymSmall Form-factor Pluggable: the swappable module that gives a switch port its physical medium - copper or fiber, short reach or long haul.
SFTPacronymA file-transfer protocol that runs securely over SSH.
SHAacronymThe standard family of cryptographic hash functions.
shadow ITexpressionTechnology and services used inside an organization without the knowledge or approval of central IT.
shardingtermSplitting a dataset across machines by some key, so each holds part of it rather than all of it.
Shared address space (100.64.0.0/10)termThe IPv4 range reserved for the middle layer of carrier-grade NAT, between the subscriber's own private network and the provider's public addresses.
shared responsibilitytermThe division of security duties between a cloud provider and its customer - the provider secures the platform, the customer secures what they put on it.
shared responsibility modeltermThe cloud's division of labor: the provider secures the infrastructure, the customer secures what they build and configure on it.
shared VPCtermOne centrally administered network shared into many projects or accounts - the platform team owns the plumbing, product teams deploy into it.
shelfwarejargonSoftware an organization bought, licensed, and never actually deployed - value sitting on a shelf.
shelltermThe program that reads commands and runs them, and the interface through which most infrastructure work is still done.
shellcodetermA small, self-contained piece of machine code an exploit runs, classically to open a shell.
ShellshockloreA 2014 family of Bash vulnerabilities that let attackers run commands through crafted environment variables.
Shielded twisted pairtermTwisted-pair cabling with foil or braid shielding - for the environments where twist geometry alone can't fight the noise.
shift-leftexpressionMoving testing, security, and quality checks earlier in the development process.
ShmooConloreThe Washington, D.C. hacker convention that stayed small, cheap, and beloved on purpose - held every winter from 2005 until its farewell edition in 2025.
shoulder surfingjargonStealing information the analog way: reading someone's screen or keyboard over their shoulder.
SIacronymThe modern metric system of measurement units.
SID (I-SID)acronymAn identifier that maps a service to a fabric-wide virtual network.
sidecartermA helper container that runs alongside a main application to add capabilities without changing it.
SIEMacronymSecurity Information and Event Management: logs from everywhere, correlated into alerts - the security team's central nervous system.
SIIacronymReusable subscriber-identity data in the certificate issuance process.
SIKEacronymA post-quantum candidate that was dramatically broken in 2022.
silent failuretermA fault that produces no error anywhere: the system completes its work, reports success, and does the wrong thing.
SIMtermThe module holding a subscriber's identity and the key that authenticates them to a mobile network.
single pane of glassexpressionThe perennial vendor promise of one dashboard that shows everything - and the engineer's shorthand for doubting it.
single point of failuretermA component whose loss stops the service - regardless of how much redundancy surrounds it.
single source of truthexpressionThe principle that each fact should have exactly one authoritative home, with everything else derived from it.
Single-mode fibertermThe long-haul fiber: a core so narrow light travels one path - distance measured in tens of kilometers, not hundreds of meters.
SIPacronymThe signaling protocol that sets up voice and video calls.
SIPRNetacronymThe US Department of Defense network for information classified up to secret, physically separate from both the unclassified network and the public internet.
SIRTacronymF5's team that handles security incidents and advisories.
SISBIN (Sistema Brasileiro de Inteligência)acronymThe Brazilian Intelligence System, established in 1999, coordinating intelligence activity across federal bodies with ABIN as its central organ.
SISCOMIS (Sistema de Comunicações Militares por Satélite)acronymBrazil's military satellite communications system, providing the armed forces with sovereign links independent of commercial or foreign infrastructure.
six degrees of separationloreThe idea that any two people are connected by a chain of about six acquaintances - and the name of the first social network.
SLAacronymService Level Agreement: the contract's measurable promises - availability, repair time, throughput - and the penalties when they slip.
SLAACacronymStateless Address Autoconfiguration: IPv6 hosts build their own addresses from router advertisements - no DHCP server required, no lease table kept.
SLIPacronymThe Serial Line Internet Protocol - the minimal, pre-PPP way to put IP packets on a serial line.
SLOacronymA concrete target for how reliable a service should be, like 99.9% of requests succeeding.
SLOTHloreA 2016 set of attacks abusing obsolete hashes like MD5 in TLS negotiation.
slow is smooth, smooth is fastexpressionThe special-operations cadence rule: hurrying breeds errors, and errors cost more time than care ever did.
Slow start and connection drainingtermTwo behaviours for changing a pool safely: ramping a newly added member's share of traffic upward over time, and letting an outgoing member finish existing connections before removal.
SMBacronymThe Windows protocol for sharing files, printers, and named pipes.
smishingtermPhishing carried out over SMS text messages.
SMTPacronymThe protocol that moves email between mail servers.
smurf attacktermThe classic amplification DDoS: ICMP echo requests sent to a broadcast address with the victim forged as the source.
SNAacronymIBM's mainframe networking architecture - the hierarchical world that predated and long coexisted with TCP/IP in the enterprise.
SNAFUloreWartime slang for a situation that is a mess, yet routinely so.
SNATacronymRewriting the client source address as traffic passes through a device.
sneakernetjargonMoving data by physically carrying storage media instead of using a network.
Sneakers (1992)loreThe caper film about a team of physical and technical penetration testers hired to steal a black box that breaks all cryptography - written with real cryptographers consulting, and beloved by the field for getting the work right.
SNIacronymThe field in a TLS handshake that names which site the client wants.
SNMPacronymSimple Network Management Protocol: the decades-old standard for polling device health and counters, and for receiving traps when something breaks.
Snow Crash (Stephenson, 1992)loreNeal Stephenson's 1992 novel, which coined metaverse and popularised avatar in their current senses, and whose plot turns on a virus that infects both computers and human brains through a deep linguistic substrate.
snowflake serverjargonA server so hand-crafted and unique that nobody could rebuild it from scratch.
SNRacronymSignal-to-Noise Ratio: how far the signal stands above the noise floor, in dB - the single number that decides whether a link can run its rated speed.
SNTP (Simple Network Time Protocol)acronymSimple Network Time Protocol: a reduced subset of NTP that speaks the same wire protocol with far less of the algorithm behind it.
SOAacronymThe DNS record holding a zone's authoritative metadata.
SOAPacronymAn older, XML-based protocol for structured web-service messages.
SOARacronymSecurity Orchestration, Automation, and Response: playbooks that act on alerts automatically - enrich, contain, ticket - before a human arrives.
SOCacronymThe team and facility responsible for continuously monitoring and defending an organization's security.
SOC 2acronymAn auditing standard that reports on how well a service organization protects customer data.
social engineeringtermManipulating people, rather than technology, to gain access or information.
sockettermThe operating system's handle for one end of a network conversation, identified by address, port and protocol.
Solar Designer (Alexander Peslyak)termThe Russian researcher behind John the Ripper, the password cracker that has been the standard auditing tool since 1996, and behind Openwall - along with early defensive work on non-executable stacks and the return-to-libc attack that showed why that defence alone is not enough.
SolaristermSun Microsystems' Unix from 1992 onwards, built on System V Release 4 and marketed under a new name when Sun left its BSD-based SunOS behind; now Oracle Solaris, with OpenSolaris's open source fork living on as Illumos.
SolarWinds OriontermSolarWinds' self-hosted monitoring platform, the base for Network Performance Monitor and its sibling modules, and the software whose signed updates carried the SUNBURST backdoor in 2020; its modules now run on the renamed SolarWinds Platform.
solicited-node multicast addresstermThe IPv6 multicast group, ff02::1:ff00:0/104 plus an address's last 24 bits, that Neighbor Discovery asks instead of broadcasting.
SOLIDacronymThe five object-oriented design principles assembled by Robert C. Martin, arranged into an acronym by Michael Feathers.
somebody set up us the bombloreAnother garbled line from the same 1991 game's opening as "all your base", now shorthand for a system suddenly and catastrophically compromised.
SONETacronymSynchronous Optical Network - the telco standard that made optical transport a synchronized hierarchy with 50-millisecond healing rings. SDH is its international twin.
Source-port loggingtermRecording the remote source port and an accurate timestamp alongside the remote address, so that a report about an event remains attributable when the address is shared by many subscribers.
Space Rogue (Cris Thomas)termThe L0pht member who founded the Hacker News Network, testified alongside the rest of the crew before the US Senate in 1998, and has spent the decades since as one of the field's most consistent public voices on research ethics and vendor behaviour.
spaghetti codeexpressionCode whose control flow is so tangled it is nearly impossible to follow.
spam filtertermThe system deciding which incoming mail reaches a person - the most consequential automated judgement most organisations run.
Spanning Tree ProtocoltermThe Layer 2 protocol that blocks redundant switch links to prevent loops, keeping exactly one active path between any two points.
SPBMacronymAn Ethernet fabric technology that builds shortest-path forwarding using IS-IS.
special category datatermThe data whose misuse cuts deepest - health, biometrics, beliefs, orientation, genetics - locked behind stricter conditions than ordinary personal data.
SpectreloreA 2018 class of attacks abusing CPU speculative execution to leak memory.
spectrumtermThe range of radio frequencies available for transmission, divided by regulators into licensed and unlicensed bands.
SPFacronymAn email-authentication method in which a domain publishes in DNS the hosts allowed to use its name in SMTP.
split horizontermA distance-vector routing rule: never advertise a route back out the interface you learned it from.
split tunnellingtermSending only the traffic destined for corporate resources through the tunnel, and letting everything else go straight out to the internet.
split-brainjargonThe cluster failure where partitioned nodes each believe they are the survivor, and both keep writing.
SPNacronymThe name a Kerberos client uses to request a service ticket.
SPNEGOtermSimple and Protected GSS-API Negotiation Mechanism: the wrapper that carries a Kerberos service ticket inside HTTP's Negotiate authentication scheme, letting a browser authenticate to a website silently from the user's existing domain session.
spot instancetermSpare cloud capacity sold cheaply on the condition that it can be taken back with little warning.
Spring4ShellloreA 2022 remote code execution flaw in the Spring Framework for Java.
SQLacronymThe standard language for querying and manipulating relational databases.
SQL injectiontermInjecting database commands through an input that gets concatenated into a query.
SQL SlammerloreThe 376-byte worm that fit in a single UDP packet and infected most of its 75,000 victims within ten minutes on January 25, 2003.
SRVacronymA DNS record that advertises the host and port for a specific service.
SS7acronymSignaling System 7: the signaling network that sets up phone calls and SMS worldwide - designed for a closed club of trusted carriers.
SSEacronymGartner's 2021 name for the security half of SASE: secure web gateway, CASB, and zero trust network access delivered as one cloud service, with the networking left out.
SSHacronymThe standard encrypted protocol for remote shell access and secure tunneling.
SSIDtermThe name a wireless network advertises - a label, not an identity, and trivially copied.
SSL strippingtermKeeping a victim on plain HTTP by rewriting the links that would have taken them to HTTPS, while the attacker speaks HTTPS to the real server.
SSL VPNtermRemote access carried inside a TLS session on port 443, either through a browser portal or an agent, so that it crosses networks that permit little else.
SSL/TLS inspectiontermAn organisation terminating and re-encrypting its own users' encrypted sessions in order to inspect the contents, using a certificate authority it installs on every managed device.
SSMAacronymSingle Scan, Multi-Action: the ZIA Service Edge design where content is scanned once and every enabled engine acts on that single pass, instead of daisy-chaining separate inspection devices.
SSOacronymSingle Sign-On: authenticate once, reach many applications - identity centralized, passwords decimated, and one very important basket for the eggs.
SSRFacronymServer-Side Request Forgery: tricking a server into making requests on the attacker's behalf - reaching internal addresses the attacker never could directly.
stack canarytermA known value placed between local buffers and the saved return address, checked before a function returns.
stack overflowtermExhausting the call stack, usually through recursion that never reaches its base case.
standard contractual clausestermThe EU's pre-approved contract terms that make personal data transfers to other countries lawful - protection by contract where law alone does not reach.
standard user vs. adminexpressionDaily work in an unprivileged account, elevation only when needed: the desktop version of least privilege, and malware's least favorite policy.
Standards bodytermThe laboratories, foundations and specification bodies the commercial entries are built on top of - not companies selling anything, or not only that.
star topologytermEvery node connects to a central device, and nothing connects directly to anything else.
stateful firewalltermA firewall that tracks connections, allowing return traffic automatically for sessions it saw begin - judging flows, not lone packets.
stateful inspectiontermFiltering that remembers connections, so a packet is judged by whether it belongs to a flow the policy already allowed.
static routetermA route entered by hand rather than learned from a protocol: absolute, silent, and exactly as correct as the person who typed it.
Statistical multiplexertermA multiplexer that allocates line capacity on demand rather than by fixed time slot.
Stephen WolffloreThe programme director who built the American research backbone and, from the start, planned for it to stop needing him.
Steve CrockerloreThe author of RFC 1, published 7 April 1969, and the person who chose to call the series Requests for Comments rather than standards.
Steven BellovinloreCo-author of the 1994 firewall book, an IETF Security Area director, a member of the National Academy of Engineering, and one of the creators of Usenet years earlier.
storm controltermA per-port ceiling on broadcast, multicast, or unknown-unicast traffic that throttles or shuts the port when a storm begins.
STPacronymSTP stands for two different things: Spanning Tree Protocol, and Shielded Twisted Pair.
StratatermPalo Alto Networks' name for its founding network-security family: the next-generation firewalls and everything that manages and subscribes to them.
stream ciphertermA cipher that generates a keystream and XORs it over the data - any length, no blocks, no padding.
STUNacronymA protocol that lets a host behind NAT ask a server which public address and port its packets arrived from.
Sturgeon's lawexpression'Ninety percent of everything is crap.'
StuxnetloreThe 2010 worm that sabotaged Iranian nuclear centrifuges, the first known cyberweapon to cause physical damage.
Submarine cabletermThe fibre-optic cable laid on the seabed that carries essentially all intercontinental internet traffic - fibre pairs at the core, wrapped in steel and copper, roughly garden-hose thick in deep water and heavily armoured near shore.
subnettermA slice of a larger network, defined by how many address bits are fixed.
SunOStermSun Microsystems' original Unix, BSD-based, shipped from 1982 to version 4.1.4 of September 1994; the name is used for releases 1.0 to 4.1.4, after which the System V Release 4 line was sold as Solaris.
supernettermA single route that summarizes several smaller networks.
supply-chain attacktermCompromising a product or system through something it depends on - a supplier, a standard, a shipment, a maintainer - rather than attacking it directly. The payload can be code, or it can be physical.
support tiers (L1/L2/L3)termThe layered support model: L1 handles volume with scripts and known fixes, L2 brings expertise, L3 is the people who built or own the thing.
Surrogate IPtermZIA mechanism mapping a known internal IP to an authenticated user for a period, so traffic that cannot carry credentials still gets user-level policy.
surveillance capitalismjargonThe business model of predicting and steering behavior from harvested personal data - attention in, predictions out, advertisers billed.
Susan Headley (Susy Thunder)termThe Los Angeles phone phreak of the late 1970s and early 1980s who was among the first true masters of social engineering - talking her way into telephone company systems and military networks by voice alone, at a time the technique had no name.
Sweet32loreA 2016 attack exploiting birthday bounds on 64-bit block ciphers like 3DES.
switchtermA device that forwards frames within a network by learning which addresses live on which port.
swivel-chair integrationjargonIntegrating two systems with a human who swivels between screens, reading from one and retyping into the other.
SYN floodtermA denial-of-service that opens many half-finished TCP connections to exhaust a server's resources.
syslogtermThe universal log-shipping protocol: devices stream timestamped severity-tagged events to a central collector, from debug chatter to emergencies.
systemdtermThe init system and service manager adopted by most major Linux distributions, replacing collections of shell scripts with declarative unit files, parallel startup, dependency resolution, and integrated logging, device and network management.

181

"the padlock means the site is safe"loreDisputed / commonly mistoldThe padlock proves the connection is encrypted to whoever holds that domain - it says nothing about who they are. Phishing sites get certificates in minutes, for free.
"there is no cloud, it's just someone else's computer"loreDisputed / commonly mistoldThe sticker-slogan half-truth: physically accurate, architecturally misleading. The cloud's substance is elasticity, APIs, managed services, and global footprint - properties no single computer has.
"Tor is only for criminals"loreDisputed / commonly mistoldTor's daily users are overwhelmingly ordinary: people evading censorship, journalists protecting sources, researchers, and the privacy-minded - the network was funded to protect exactly them.
T1acronymThe North American 1.544 Mb/s digital carrier - 24 channels of 64 kb/s, the DS1, the leased line a generation of WANs was built from.
T568A / T568BtermThe two TIA-568 pinouts for terminating twisted pair on RJ45 - identical performance, different wire-to-pin order.
tabletop exercisetermWalking a team through a hypothetical incident in a room, to find the gaps before a real one does.
TACacronymThe vendor's technical assistance centre: the engineers you reach when a product itself, rather than your configuration of it, may be at fault.
TACACS and XTACACSacronymThe original Terminal Access Controller Access-Control System of the ARPANET, documented in RFC 1492, and Cisco's extended XTACACS: the clear-text, port-49 ancestors of TACACS+, which shares their name and almost nothing else.
TACACS+termA protocol for centralising administrative access to network devices, separating authentication, authorization and accounting into distinct exchanges.
Tadao TakahashitermThe founder of Brazil's National Education and Research Network (RNP) and the coordinator who turned scattered academic links into a national backbone - inducted into the Internet Hall of Fame in 2017. He died in April 2022.
TAIacronymA continuous atomic timescale with no leap seconds.
Takedown (Shimomura and Markoff, 1996)loreThe account of Kevin Mitnick's 1995 capture written by Tsutomu Shimomura, whose systems Mitnick had broken into, with New York Times reporter John Markoff - later filmed as Track Down.
TamoGraph Site SurveytermTamoSoft's Wi-Fi planning and site survey software, which performs passive, active and predictive surveys on Windows and macOS, from a privately held Christchurch company founded in 1998.
Tarek KamelloreEgyptian engineer who established his country's first internet connection in the 1990s, built the regional gateway through which neighbouring countries first reached the network, and served as minister when the state switched it off.
tarpitjargonA defensive trick that answers attackers extremely slowly, wasting their time instead of refusing them.
TcltermTool Command Language: a scripting language designed in 1988 to be embedded inside other people's programs, so that each tool would not invent a command language of its own.
TCPtermThe transport that turns a stream of packets into an ordered, reliable byte stream, by numbering what it sends and retransmitting what is not acknowledged.
TCP three-way handshaketermThe three-message exchange that opens a TCP connection: SYN, SYN-ACK, ACK.
TCP/IPloreThe two-protocol architecture, split from a single design in the late 1970s, that became the common language of the internet.
TEAPacronymThe Tunnel Extensible Authentication Protocol of RFC 7170, EAP Type 55: the standards-track tunnel method that runs zero or more inner EAP methods inside a mutually authenticated TLS tunnel, binds them cryptographically to it, and can provision credentials along the way.
technical debtexpressionThe future cost of choosing a quick solution now over a better one later.
TELEBRÁSloreTelecomunicações Brasileiras S.A.: the state holding that organized Brazil's telecom operators from 1972; the whole system - three fixed holdings, Embratel, and eight cellular holdings - was privatized in twelve auctions on 29 July 1998, the largest privatization in Brazilian history.
telemetrytermThe measurements a system emits about itself, sent somewhere else to be stored and read.
Telemetry selection (log sources)termDeciding what to collect by asking which questions must be answerable, rather than collecting whatever is available until the licence bill forces cuts.
TELESPloreTelecomunicações de São Paulo: the Telebrás system's São Paulo fixed-line operator (1973-1998), successor to the CTB's São Paulo operations; acquired by Spain's Telefónica in the 1998 privatization, becoming Telefônica Brasil (the Vivo brand from 2012). Under Telefónica it launched São Paulo's ADSL broadband, Speedy, in 1999.
TELNETacronymAn old, unencrypted remote-terminal protocol, superseded by SSH.
TeredotermA last-resort IPv6 transition method that tunnels IPv6 in UDP so hosts behind IPv4 NATs can still reach IPv6.
TerrapinloreA 2023 attack that can weaken or truncate the SSH handshake.
test automationtermLetting machines execute tests, so they run on every change instead of when someone has time.
testing in productionexpressionThe practice - reckless or disciplined, depending entirely on tooling - of validating changes on the live system.
Teus HagenloreDutch computer scientist who ran the networking team at Amsterdam's Mathematical Centre and in 1982 started EUnet, the first public wide-area network in Europe, as a dial-up service of the Unix user group he chaired.
TFTPacronymA minimal file-transfer protocol with no authentication, used for booting devices.
the 'room 404' mythloreDisputed / commonly mistoldThe popular but false claim that HTTP 404 is named after a specific room at CERN where the web's first server lived.
the 3-2-1 backup ruleexpressionThe backup rule of thumb: three copies of the data, on two different media, with one copy off-site.
the 414sloreA group of Milwaukee teenagers who broke into dozens of computer systems in 1983 and put hacking on front pages.
the 500-mile emailloreA classic sysadmin tale of an email system that mysteriously could not send mail farther than about 500 miles.
the 640K quoteloreDisputed / commonly mistoldThe famous line '640K ought to be enough for anybody', attributed to Bill Gates, who has repeatedly denied ever saying it.
the Anchises security events calendarloreThe annual calendar of Brazilian and international security events that Anchises Moraes publishes on his blog - typically two posts a year with short descriptions, plus a December preview. The 2026 edition mapped more than forty events he considers relevant.
The Art of Deception (Mitnick, 2002)loreKevin Mitnick's first book after prison: a collection of social-engineering stories, each dissected into the technique that made it work and the control that would have stopped it. The thesis is one line - the human is the vulnerability no patch reaches.
the Blaster wormloreThe August 2003 Windows worm that rebooted PCs worldwide and carried a taunt addressed to Bill Gates.
the Brazilian BSides circuittermThe constellation of Security BSides conferences held across Brazil - São Paulo, Rio de Janeiro, Recife, Florianópolis, Vitória, João Pessoa, Brasília, Fortaleza, Porto Alegre and Curitiba among them - each free, locally organised, and part of the global BSides circuit.
the CAP theoremtermA distributed system facing a network partition must choose between consistency and availability; it cannot keep both.
The Cathedral and the BazaarloreEric Raymond's 1997 essay contrasting closed, top-down development with open, community-driven development.
the CentOS Stream change (2020)loreThe 2020 decision to redirect CentOS - until then a free, bug-for-bug rebuild of Red Hat Enterprise Linux - into CentOS Stream, positioned ahead of the enterprise release rather than behind it, and the founding of Rocky Linux and AlmaLinux in response.
the Clipper chiploreThe US government's 1993 proposal for encrypted telephony in which the encryption was strong but a copy of every key was held in escrow, so authorities could decrypt with legal authorisation.
the cobra effectexpressionAn incentive that worsens the problem it was meant to solve, named for a colonial bounty on cobras that created cobra farms.
the Crypto WarsloreThe 1990s battle over whether strong cryptography could be exported, escrowed, or used freely at all.
the Cuckoo's EggloreCliff Stoll's 1986 hunt for a hacker that began with a 75-cent accounting error.
the cyber kill chaintermThe staged model of an intrusion published by Lockheed Martin analysts in 2011 - reconnaissance, weaponisation, delivery, exploitation, installation, command and control, actions on objectives - borrowed from military targeting doctrine.
the CypherpunkstermThe movement and mailing list founded in 1992 around a single conviction: that widely deployed strong cryptography, not legislation, is what protects privacy from states and corporations. Eric Hughes's manifesto supplied the creed - 'Cypherpunks write code.'
the DAO hackloreThe 2016 drain of the largest crowdfunded smart contract, answered by the hard fork that split Ethereum in two.
the DEF CON badgeloreDEF CON's conference badge, which since 2006 has usually been a working piece of electronics carrying a multi-stage puzzle - designed for years by Joe Grand, known as Kingpin - and the seed of the wider badgelife culture of independent hardware badges.
the demo godsexpressionThe capricious deities who decide whether a live demo works - having behaved perfectly in every rehearsal.
the DNC hack (2016)loreThe 2016 compromise of the Democratic National Committee and campaign staff by two separate Russian intelligence groups - designated Cozy Bear and Fancy Bear - whose stolen email was then published through fronts including Guccifer 2.0 and WikiLeaks during a US presidential election.
the ENIAC programmersloreThe six women who programmed the ENIAC in the 1940s, largely uncredited for decades.
the ether / aetherloreThe imaginary medium light was once thought to travel through, and the wink in the name Ethernet.
the evil bitloreThe April Fools' RFC proposing that malicious packets simply set a header bit to declare themselves evil.
the Fail WhaleloreTwitter's overload mascot, a whale lifted by birds, that turned chronic downtime into a beloved brand from 2007 to 2013.
the fallacies of distributed computingexpressionThe eight assumptions every distributed-systems novice makes, starting with 'the network is reliable', catalogued at Sun in the 1990s.
the first .com domainloresymbolics.com, registered on March 15, 1985 by a Lisp machine maker, was the Internet's first .com.
the first banner adloreAT&T's 'Have you ever clicked your mouse right here? You will.' on HotWired, October 27, 1994 - the ad that founded the web's business model.
the first emailloreRay Tomlinson sent the first networked electronic mail between two ARPANET machines in 1971, choosing @ to separate user from host.
the first spam emailloreA 1978 DEC marketing message blasted to hundreds of ARPANET users, generally cited as the first spam.
the first tweetloreJack Dorsey's 2006 message 'just setting up my twttr', the first post on Twitter.
the first web pageloreThe plain page Tim Berners-Lee published at CERN in 1991 to explain the World Wide Web itself.
the GNU ManifestoloreRichard Stallman's 1985 call to build a free Unix-compatible operating system that anyone could share and change.
the golden hammerexpressionOver-relying on one familiar tool for every problem, whether or not it fits.
the Great Split (IRC, 1996)loreThe 1996 schism that divided the original IRC network into EFnet and IRCnet, largely along an American and European line, after long-running disagreement over server linking policy, nickname handling and who decides.
the Green Card spamloreThe April 1994 Usenet mass-posting by two immigration lawyers that made commercial spam a household problem.
the Hacker ManifestoloreA short 1986 essay, written after its author's arrest, that became the defining statement of hacker curiosity.
the happy pathexpressionThe default scenario where everything is valid and nothing goes wrong.
the Homebrew Computer ClubloreThe 1975 Menlo Park hobbyist club where the personal computer industry, and its first fight over software, began.
the ILOVEYOU virusloreThe 2000 email worm whose 'ILOVEYOU' subject line tricked millions into infecting their own machines.
the IOCCCloreThe contest, running since 1984, that celebrates the most gloriously unreadable working C programs on Earth.
the Jargon FileloreThe long-running community dictionary of hacker slang and culture, maintained since the 1970s.
the Jeep hackloreThe 2015 demonstration by Charlie Miller and Chris Valasek that a Jeep Cherokee could be taken over remotely over the cellular network - through the entertainment head unit and onto the vehicle's internal bus - reaching the transmission, brakes and steering while a journalist drove it on a public highway.
the Kaminsky DNS flawloreThe 2008 discovery by Dan Kaminsky of a fundamental weakness in DNS resolution that made cache poisoning practical at internet scale - an attacker could plant a forged answer and redirect a whole domain's traffic, undermining every trust decision layered on top of names.
the KGB hack (Karl Koch)loreThe late-1980s West German intrusion ring that sold access to US military and research systems to the Soviet KGB for cash and drugs - the far end of the trail Cliff Stoll followed from a 75-cent accounting error.
the Knight Capital glitchloreThe 2012 trading firm that lost about 440 million dollars in 45 minutes from a botched software deployment.
the Konami CodeloreThe button sequence up up down down left right left right B A, a cheat that became a cultural in-joke.
the L0pht testimonyloreThe 1998 Senate hearing where seven hackers testified they could take down the Internet in thirty minutes.
the lawsuit that created ZIPloreThe 1988 lawsuit that was meant to protect the ARC format, and instead produced ZIP.
the leap secondloreThe extra second occasionally inserted to keep atomic time aligned with Earth's rotation, and the outages it caused.
the Linux kerneltermThe operating-system kernel Linus Torvalds began in 1991 and which is now developed by thousands of contributors from competing companies - monolithic in architecture, released on a fixed cadence, with selected versions carrying years of long-term support.
the map is not the territoryexpressionKorzybski's warning that representations are not the reality they describe - and confusing them has consequences.
the Mars Climate OrbiterloreThe 1999 Mars probe lost because one team's software spoke pound-force seconds and the other expected newton seconds.
The Matrix (1999)loreThe Wachowskis' 1999 film about a programmer who discovers reality is a simulation - the most culturally saturating hacker film ever made, and the source of the red pill, bullet time, and an entire visual grammar for cyberspace.
the Max Headroom incidentloreThe 1987 Chicago broadcast hijacking by someone in a Max Headroom mask, still unsolved.
the Melissa virusloreThe March 1999 Word-macro virus that mailed itself to the first 50 Outlook contacts and buried corporate email worldwide.
The Mentor (Loyd Blankenship)termThe Legion of Doom member who, hours after his 1986 arrest, wrote the short essay published in Phrack as The Conscience of a Hacker - universally known as the Hacker Manifesto - and who later, by coincidence of employment, wrote the cyberpunk game manual the Secret Service seized in the Steve Jackson Games raid.
the Morris WormloreThe 1988 self-replicating program that became the first worm to disrupt the early internet at scale.
the Mother of All DemosloreDouglas Engelbart's 1968 demonstration that unveiled the mouse, hypertext, and live collaboration at once.
the Net routes around damageexpressionJohn Gilmore's line that the Net treats blockage as a fault to route around - resilience as a design temperament.
the ninety-ninety ruleexpression'The first 90 percent of the code accounts for the first 90 percent of the development time. The remaining 10 percent accounts for the other 90 percent.'
the north star metricexpressionThe single measure a team agrees best captures the value it delivers, used to align everyone's work.
the only secure computer is powered offexpressionGene Spafford's reductio: the only truly secure computer is off, encased in concrete, guarded - and useless.
the Pentium FDIV bugloreA 1994 flaw in the Intel Pentium that returned slightly wrong answers for certain floating-point divisions.
the Peter principleexpressionIn a hierarchy, people rise to their level of incompetence.
the principle of least astonishmentexpressionA component should behave the way most users will expect it to behave; surprise is a defect.
the Pwnie AwardsloreThe security industry's annual awards, handed out at Black Hat since 2007 as a gold-painted toy pony - honouring the year's best server-side and client-side bugs alongside categories no one wants to win, chiefly Lamest Vendor Response and Most Epic Fail.
the r-commands (rsh, rlogin, rcp, rexec)termThe Berkeley remote-access family - rlogin for a shell, rsh to run one command, rcp to copy files, rexec to execute with a password - that ran the Unix world before SSH, authenticating on trust files (.rhosts, hosts.equiv) that said, in effect, this machine vouches for that machine.
the RSA SecurID breach (2011)loreThe March 2011 intrusion at RSA Security in which attackers stole material relating to the SecurID two-factor tokens used by tens of thousands of organisations - reaching the company through a phishing email carrying a spreadsheet with a Flash exploit, opened from a junk folder.
the S in IoT stands for securityexpressionThe joke that the S in IoT stands for security - there is no S, and too often no security either.
the ScenejargonThe underground release culture - crews competing to be first to crack and distribute software, games, music and film, on invitation-only servers, for reputation and nothing else. Related to but distinct from the demoscene, which competes on making art in tiny amounts of code.
the second-system effectexpressionFred Brooks's warning that the successor to a successful system tends to be overengineered with every idea saved up from the first.
the Shadow BrokersloreThe unidentified group that in 2016 and 2017 published stolen offensive tooling attributed to the NSA's elite operations unit, including the EternalBlue exploit against Windows file sharing.
The Shockwave Rider (Brunner, 1975)loreJohn Brunner's 1975 novel, which describes a self-replicating program moving through a continent-wide computer network and calls it a tapeworm - the origin of the word worm as a category of malicious software.
the Silk RoadloreThe Tor-hidden marketplace, 2011 to 2013, whose rise and takedown defined the public's picture of the dark web.
the Slashdot effectloreThe crash of a small website under the traffic of a sudden front-page link, named for the site that did it nightly.
the Sony Pictures hack (2014)loreThe November 2014 breach in which attackers calling themselves Guardians of Peace destroyed much of Sony Pictures Entertainment's infrastructure with wiper malware and published executives' email, unreleased films, salaries and employee medical records - alongside threats tied to the studio's comedy about assassinating North Korea's leader.
the STJ ransomware attack (2020)loreThe November 2020 ransomware incident at Brazil's Superior Court of Justice, attributed to RansomExx, which encrypted the court's case files, suspended proceedings and deadlines, and took roughly two weeks to restore.
the Story of MelloreA 1983 Usenet poem about Mel Kaye, a programmer who wrote code so close to the machine it defied the idea of ever rewriting it.
the street finds its own uses for thingsexpressionWilliam Gibson's observation that technology's real uses are invented by its users, not its designers.
the Streisand effectloreWhen an attempt to hide or suppress information ends up drawing far more attention to it.
the Swiss cheese modelexpressionJames Reason's accident model: every defense layer has holes, and disasters happen when the holes line up.
the Target breach (2013)loreThe 2013 holiday-season compromise of about 40 million payment cards and 70 million customer records at the US retailer Target, entered through credentials stolen from a heating and air-conditioning contractor with remote access to the corporate network.
the Tetrade (Brazilian banking trojans)loreThe collective name given by Kaspersky researchers in 2020 to four Brazilian banking trojan families - Guildma, Javali, Melcoz and Grandoreiro - that matured locally and then went international, reaching Latin America, Spain, Portugal and beyond.
the Trojan Room coffee potloreThe Cambridge coffee machine whose monitoring camera became the world's first webcam.
the Turing testloreAlan Turing's 1950 proposal to judge machine intelligence by whether it can converse indistinguishably from a human.
the Two Generals problemtermThe proof that two parties on an unreliable channel can never be certain they agree to act together.
the two hard thingsexpression'There are only two hard things in Computer Science: cache invalidation and naming things.'
the two-pizza teamexpressionThe rule that a team should be small enough to feed with two pizzas.
the wall of confusionexpressionThe dysfunction where developers and operations hand work back and forth without shared ownership.
the Wall of SheeploreThe DEF CON installation that sniffs the conference network for credentials sent in the clear and projects the partially masked usernames on a giant screen, for everyone to see and laugh at.
the WANK wormloreWorms Against Nuclear Killers: the anti-nuclear worm that hit NASA and US Department of Energy DECnet systems in October 1989, days before the Galileo probe launched with a plutonium power source. Infected terminals greeted operators with a banner announcing WANK and the line 'You talk of times of peace for all, and then prepare for war.'
the weakest linkexpressionThe chain proverb applied to security: the system's real strength is its most neglected component, not its best one.
the WinRAR licenceloreWinRAR's forty-day trial has never stopped working, on any version, for about thirty years - which turns out to be a business model rather than an oversight.
the XY problemexpressionAsking for help with your attempted solution (Y) instead of your actual problem (X) - and burning everyone's time on the wrong question.
the Year 2038 problemtermSigned 32-bit Unix time overflows at 03:14:07 UTC on 19 January 2038, wrapping the clock to December 1901. Unlike Y2K it is a hard representational limit, not a formatting convention, and it cannot be patched around without widening the field.
the zero-one-infinity ruleexpressionAllow none of a thing, one of a thing, or any number of a thing; every other limit is arbitrary.
Therac-25loreThe radiation-therapy machine whose software race conditions delivered massive overdoses in the 1980s, the founding case study of software safety.
there are no solutions, only trade-offsexpressionThomas Sowell's economics dictum, adopted whole by engineering: every choice purchases its benefits with costs elsewhere.
threat modeltermA structured look at what could go wrong, who might attack, and what is worth defending.
Throttling (as censorship)termDeliberately reducing available bandwidth until services degrade - video first, then images, then messaging - while the connection technically continues to work.
throughputtermHow much data actually gets through per unit of time - as opposed to the link's rated capacity, which is a ceiling and not a promise.
thundering herdjargonWhat happens when a crowd of clients all wake up, retry, or reconnect at exactly the same moment.
tickettermThe unit of support work: one tracked record per issue, with status, owner, history, and priority - if it is not in the ticket, it did not happen.
ticket ping-pongjargonA ticket bounced between teams, each reassigning it as not-mine - the organizational failure mode where routing replaces resolving.
tiger teamjargonA small, hand-picked group pulled out of normal structure to attack one hard problem until it yields.
Tim Berners-LeeloreThe author of the 1989 CERN proposal that became the World Wide Web, and of the first browser, server and page - and the 2016 Turing Award recipient for it.
Titan RainloreThe US government's code name for a series of coordinated intrusions from 2003 onward into defence contractors, army installations and NASA - Lockheed Martin, Sandia, Redstone Arsenal - widely attributed in reporting to Chinese state-linked operators.
TL;DRacronymToo long; didn't read: the complaint that became the standard label for a summary.
TLDacronymThe last label of a domain name, like com or org.
TLSacronymThe protocol that encrypts and authenticates most internet traffic, the S in HTTPS.
toiljargonRepetitive, manual operational work that scales with the service but adds no lasting value.
Token RingtermThe deterministic LAN technology (IEEE 802.5) where a circulating token grants the right to transmit, championed by IBM against Ethernet.
tokenizationtermReplacing sensitive values with meaningless stand-ins, keeping the real data in one guarded vault - the token is useless anywhere else.
top talkersjargonThe hosts, flows, or applications consuming the most bandwidth on a link - the first list every traffic tool shows.
TortermAn anonymity network that routes traffic through three volunteer relays, each peeling one layer of encryption, so no single relay knows both ends.
Tor relaytermOne of the volunteer-run servers that forward Tor traffic.
TosconfloreThe self-described 'shoddy conference' run by the Laboratório Hacker de Campinas - a deliberately unpolished, free, community event whose name is a joke at the expense of conference production values.
TOTPacronymA one-time code that changes every 30 seconds, used for two-factor auth.
TPMtermA chip that stores keys and measurements in hardware, so secrets are usable by the machine without being extractable from it.
TPSacronymA throughput measure counting transactions handled each second.
TR-069termThe Broadband Forum's remote-management protocol: the ISP's ACS can configure, update, and diagnose the CPE fleet without a single site visit.
traceroutetermA tool that maps the routers on a path by sending probes with rising TTLs and reading the Time Exceeded errors they provoke.
tracingtermFollowing one request through every service it touches, with each step recorded and linked by a shared identifier.
tracking pixeltermAn invisible one-pixel image or beacon whose loading reports that you opened the page or email - presence-tracking disguised as content.
traffic generationtermProducing synthetic traffic with known properties in order to measure what a device or network does with it.
Training organisationtermThe companies and bodies that decide what competence looks like in a technology and who may claim it.
transactiontermA group of operations that either all take effect or none do, leaving no visible half-finished state.
Transceiver (pluggable optics)termThe pluggable module that gives a switch port its personality - copper or fiber, short reach or long, one lineage from GBIC to OSFP.
transformertermThe 2017 neural-network design that made modern language models practical, built on self-attention.
transit gatewaytermThe cloud's central router: VPCs, VPNs, and interconnects attach to one hub instead of meshing with each other.
tree topologytermA hierarchy of stars: a root branching into layers, with no loops in the intended design.
triagetermSorting incoming problems by severity and routing them, so that the queue reflects impact rather than arrival order.
tribal knowledgejargonThe critical operational knowledge that lives only in certain people's heads, never in the documentation.
TROOPERSloreERNW's Heidelberg conference - the one experienced European practitioners name when they can only pick one: trainings, three tracks, and roundtables where speakers and attendees argue as equals.
truck rollexpressionDispatching a technician to the premises - the most expensive way to close a ticket, and sometimes the only one.
trunktermA link that carries several VLANs at once, tagging each frame so the far end knows which network it belongs to.
trunk porttermA switch port carrying multiple VLANs at once, each frame tagged with its VLAN ID so the far end can sort them back out.
trust, but verifyexpressionThe old proverb of cooperative suspicion - accept the claim, then check it anyway.
Trusted networktermA ZCC-detected network condition defined by admin criteria - preferably the static DNS servers and search domains over dynamic hostname resolution.
TSIGacronymA shared-key method for authenticating DNS transactions like zone transfers.
Tsutomu ShimomuratermThe San Diego Supercomputer Center researcher whose own machines were broken into on Christmas Day 1994 using TCP sequence-number prediction and IP spoofing - and who then led the technical hunt that ended with Kevin Mitnick's arrest in February 1995.
TTLacronymA counter that limits how long data lives or how far a packet may travel before being discarded.
TTPacronymTactics, techniques, and procedures: the layered description of how a threat actor operates.
Turbo PascaltermBorland's software development system of 20 November 1983, a Pascal compiler with an integrated editor for CP/M, CP/M-86 and MS-DOS, written by Anders Hejlsberg, famous for compiling very fast and for selling by mail order at $49.95 when professional tools cost hundreds.
turtles all the way downexpressionThe recursion joke applied to trust: every layer rests on another layer, and eventually you must simply stand somewhere.
two is one, one is noneexpressionThe redundancy proverb: with two you can lose one; with one, a single failure leaves you with nothing.
TXTacronymA general-purpose DNS record holding free-form text.

18

UDPtermThe minimal transport that wraps a packet with just ports and a checksum and sends it with no handshake, no ordering, and no retransmission: fire and forget.
ULIDacronymA sortable, unique identifier alternative to UUID.
Underground (Dreyfus and Assange, 1997)loreSuelette Dreyfus's narrative history of the Australian computer underground of the late 1980s and early 1990s, researched by a young hacker known as Mendax - later the world's most recognisable name in leaking, Julian Assange.
underlay / overlayexpressionThe two-layer view of modern networks: the underlay is the physical routed plumbing; the overlay is the virtual topology tunneled on top of it.
UNICAMPloreUniversidade Estadual de Campinas: the Campinas state research university, a founding ANSP participant alongside USP and UNESP in the pre-internet academic networking that became Brazil's on-ramp.
unicasttermCommunication addressed to exactly one recipient.
UnicodetermThe standard that gives every character of every writing system a number, a name and a set of properties; version 18.0 counts 172,808 characters.
unique local addresstermAn IPv6 address in fc00::/7, meant for use inside a site or between cooperating sites and not routed on the internet.
UnixtermThe operating system built at Bell Labs from 1969, whose design - files, small composable tools, processes forked from processes - became the shape almost everything since has copied.
upstream / downstreamexpressionThe two directions of an access link: downstream toward the subscriber, upstream toward the internet - historically sized very unequally.
use-after-freetermUsing a pointer to memory that has already been released, back when it still meant something.
UsenettermThe distributed discussion system built in 1979-1980 by Duke and UNC graduate students on top of UUCP, later carried by NNTP: articles posted to hierarchical newsgroups flood from server to server, with no central host and no owner.
user agenttermThe client identifying itself in a header - a claim, not a fact, and one of the oldest lies on the web.
USPloreUniversidade de São Paulo: Brazil's largest research university and a founding participant of the ANSP academic network - Brazilian internet history runs through its physics and engineering departments' need to reach colleagues abroad.
UTCacronymThe primary civil time standard the world sets clocks by.
UTF-8acronymThe encoding that writes each Unicode code point as one to four bytes and keeps ASCII as single bytes; the encoding the web requires.
UTPacronymUnshielded twisted pair - the copper cabling that carries almost every wired office connection.
UUCP (Unix-to-Unix Copy)acronymThe 1970s Bell Labs suite that let one Unix machine dial another over a modem to exchange files, mail and commands - store-and-forward networking for people with no network, only telephones.

20

Van JacobsonloreThe author of Congestion Avoidance and Control, the 1988 work that gave TCP the algorithms - slow start, congestion avoidance, fast retransmit - that stopped the internet collapsing under its own load.
vaporwarejargonA product announced with fanfare that never ships - or ships so late and so diminished that the announcement was the product.
VendortermThe company that makes the product, as distinct from anybody who sells, installs or operates it.
VHF / UHFacronymVery high frequency (30 to 300 MHz) and ultra high frequency (300 MHz to 3 GHz): the line-of-sight bands.
vi / VimtermThe modal terminal editor that is on essentially every Unix-like system, and its dominant modern successor Vim.
Vint CerfloreThe co-designer, with Bob Kahn, of TCP/IP - the protocols that turned separate networks into one internet - and joint recipient of the 2004 Turing Award for the work.
VIPacronymThe address clients connect to on a load balancer.
virtual appliancetermA vendor's network function shipped as a VM image - the firewall or load balancer you rack by launching instead of lifting.
virtual machinetermA complete simulated computer with its own kernel, isolated from its neighbours by the hypervisor rather than by the operating system.
VLANacronymVirtual LAN: a logical Layer 2 broadcast domain carved out of a physical switch network, isolating traffic without separate hardware.
VLC (VideoLAN Client)termThe VideoLAN Client: a free, open-source media player that began in 1996 as a student project to stream video across a French university's campus network, and became one of the most widely installed pieces of software ever written.
VLSMacronymUsing different subnet sizes within the same network, sized to each segment's need.
VMS (OpenVMS)termVirtual Memory System: the operating system DEC announced with the VAX-11/780 in 1977 as VAX/VMS, renamed OpenVMS in 1992, ported to Alpha, Itanium and now x86-64, and developed since 2014 by VMS Software Inc.
VPCacronymVirtual Private Cloud: your own logically isolated network inside a public cloud - address space, subnets, routing, and gateways, defined in software.
VPC peeringtermA private one-to-one link between two VPCs, routing their address spaces to each other - non-transitive by design.
VPNacronymAn encrypted tunnel that carries your traffic as if you were on another network.
VRFacronymVirtual Routing and Forwarding: multiple independent routing tables on one router, so overlapping or unrelated networks never mix.
VRRP / HSRPacronymVRRP and Cisco's HSRP: routers on a LAN share one virtual gateway address and MAC, so the default gateway outlives a router.
vulnerabilitytermA defect that allows someone to do something the system was meant to prevent.
VXLANacronymVirtual Extensible LAN: stretches Layer 2 segments over a routed Layer 3 network by encapsulating frames in UDP, with 16 million segment IDs.

43

WADacronymThe FortiGate process that handles proxy-based inspection.
WAFacronymA filter that inspects web traffic and blocks application-layer attacks.
walled gardenexpressionA restricted network state where the subscriber can reach only the provider's portal - used for unpaid bills, activation, or infected hosts.
WANacronymWide area network: a network spanning sites, built on circuits somebody else owns and bills you for.
WannaCryloreThe 2017 ransomware worm that spread through a leaked Windows exploit and crippled systems worldwide.
War dialingjargonDialing whole ranges of telephone numbers automatically to find the ones answered by a modem - the reconnaissance technique of the dial-up era, and the direct ancestor of the port scan.
War drivingjargonDriving around with a wireless card, an antenna and a GPS, logging every access point you pass - mapping the radio landscape of a city. Named after war dialing by Peter Shipley, who did the first systematic survey around 1999 to 2000.
war roomjargonThe room, physical or virtual, where an incident's responders gather until the thing is fixed.
WarGames (1983)loreThe film in which a Seattle teenager dials into what he thinks is a games company and reaches a NORAD war-planning computer, nearly starting a nuclear exchange before teaching the machine that some games cannot be won.
warm boot / cold bootexpressionRestarting without cutting power versus from full power-off - the cold boot clears states the warm one preserves.
Wau HollandtermThe co-founder of the Chaos Computer Club in 1981 and the author of its ethic - Levy's hacker principles extended with two German additions: do not litter in other people's data, and use public data, protect private data.
WCCPacronymA protocol for transparently redirecting traffic to a cache or proxy.
WebAuth (web authentication)termWeb authentication: the switch or controller feature that intercepts a new client's first browser request, serves a login page, checks the credentials against a RADIUS server and only then opens the port or session, for people on devices that cannot do 802.1X.
WebAuthn (and FIDO2, CTAP)acronymThe browser interface websites call to create and use public-key credentials. CTAP is the protocol between browser and external authenticator; FIDO2 is the umbrella term covering both.
webhooktermAn arrangement where one system calls a URL you provide when something happens, instead of you polling to ask.
WebSockettermA connection that starts as HTTP and then upgrades into a two-way channel that stays open.
Werner ZornloreThe Karlsruhe professor who connected Germany to the internet in 1984, and China three years later.
wetwarejargonThe humans in the system, named as if they were another component alongside hardware and software.
Wheeler's aphorismexpression'All problems in computer science can be solved by another level of indirection', with the folk corollary: except too many levels of indirection.
white / black / grey hatjargonA shorthand for a hacker's intent: white hat (authorized/defensive), black hat (malicious), grey hat (in between).
Whitfield DiffieloreCo-author, with Martin Hellman, of the 1976 paper New Directions in Cryptography, which proposed public-key cryptography and digital signatures; joint recipient of the 2015 Turing Award.
WHOIStermThe query service that answers who registered a domain or an address block - the first query-based host name and address server, defined in Feinler's group in 1982.
Wi-FitermThe consumer name for wireless LAN built on IEEE 802.11 - and a certification mark from the Wi-Fi Alliance.
Wi-Fi generations (802.11 a/b/g/n/ac/ax/be)termThe successive amendments to IEEE 802.11, given retroactive marketing numbers in 2018 - from 2 Mbps in 1997 through MIMO, multi-user transmission, OFDMA, the 6 GHz band, and multi-link operation.
Wi-Fi site surveytermMeasuring actual coverage, interference, and neighbor networks on site before or after placing access points - the map versus the guess.
Wietse VenemaloreThe author of Postfix and TCP Wrapper, and, with Dan Farmer, of SATAN - the scanner that made the argument for testing your own systems the way an attacker would.
William CrookesloreThe chemist whose partially evacuated tube let cathode rays be seen and studied, and which every later display and vacuum device descends from.
Willian CaprinotermOne of the three organisers who created You Sh0t the Sheriff, and the person who has most often explained the event's history and its unusual format in public - a career of more than twenty years in Brazilian information technology and security.
wire speedexpressionForwarding at the full rate of the medium with no queueing loss - the benchmark claim every datasheet makes and every RFC 2544 test verifies.
WireGuardtermA VPN protocol built around a deliberately small codebase and a fixed set of modern cryptographic choices, with no negotiation.
Wiring closettermThe telecom room where a floor's cabling terminates - patch panels, switches, and the boundary between horizontal and backbone cabling.
Wirth's lawexpressionSoftware is getting slower more rapidly than hardware is getting faster.
wizardjargonA person with deep, almost intuitive mastery of a system.
WLANacronymWireless local area network: a local area network whose medium is shared air rather than dedicated cable.
workaroundtermA change that restores function without addressing why it broke, and which therefore continues until somebody actively ends it.
workload identitytermWorkloads proving who they are through the platform itself - short-lived, automatically issued credentials instead of long-lived secrets in files.
works on my machineexpressionThe developer's classic defense when code fails everywhere except their own laptop.
worse is betterexpressionThe observation that a simpler, less complete design often wins over a more correct but complex one.
WPAacronymThe Wi-Fi Alliance's security scheme for wireless LANs - WPA2 and WPA3 today, replacing the broken WEP.
WPA3termThe current generation of wireless security, replacing the shared-key handshake that allowed offline password guessing.
WPADacronymA method for browsers to find a PAC file automatically.
WSacronymA protocol for full-duplex, persistent connections between a browser and server.
WSSacronymWebSocket encrypted with TLS.

14

X-Clacks-OverheadloreThe HTTP header thousands of sites send in Terry Pratchett's memory: X-Clacks-Overhead: GNU Terry Pratchett.
X-Fry / X-BenderloreSlashdot's response headers carrying a random Futurama quote, named for the characters who said it.
X-hackerloreAutomattic's recruiting header on WordPress.com and its VIP-hosted sites: an invitation to apply, for whoever is reading the headers.
X-Hi-HumanloreAirbnb's response header greeting whoever reads it, with a hiring address from the Production Infrastructure team.
x-nananana: BatcacheloreThe header Batcache, Automattic's WordPress page cache, uses to say a page came from the cache, named with the Batman theme.
X.21acronymITU-T's interface for circuit-switched data networks - the serial physical-layer standard that often sat beneath X.25.
X.25acronymThe first widely deployed packet-switching standard - ITU-T's 1976 protocol that ran WANs, ATMs, and card networks for decades.
X.509termThe certificate format published by the ITU in 1988 and profiled for the internet in RFC 5280, binding a name to a public key with an issuer's signature.
xauth and X11 forwardingtermThe authorisation layer of the X Window System: xauth manages the MIT-MAGIC-COOKIE tokens that let a client open a window on your display, and X11 forwarding tunnels that protocol over SSH so a remote program can draw on your local screen.
XDRacronymExtended Detection and Response: EDR's scope widened - endpoint, identity, email, network, and cloud signals correlated in one detection fabric.
Xerox PARCloreThe Palo Alto research lab that invented the modern computer's furniture, and famously let others sell it.
XNSacronymXerox's late-1970s protocol architecture - the ancestral design that Novell IPX, and much else, copied.
XSSacronymAn attack that injects malicious script into a web page so it runs in other users' browsers.
XXEacronymAn attack that abuses XML external entities to read files or reach internal systems.

8

Y2KloreThe two-digit-year defect that threatened date logic worldwide at the 1999 to 2000 rollover, and the remediation effort that largely defused it.
YAGNIexpressionThe principle that you should not build functionality until it is actually required.
yak shavingloreThe chain of unrelated sub-tasks you must finish before you can do the thing you actually set out to do.
YAMLacronymA human-readable data format often used for configuration.
you build it, you run itexpressionThe DevOps principle that the team that writes a service also operates it in production.
you can't secure what you can't seeexpressionThe visibility maxim: security begins with an accurate inventory of what exists, because unknown assets get no controls.
YSTSloreYou Shot the Sheriff: Brazil's curated, single-day security conference - invitation-flavored, bar-hosted, and famously well-connected.
Yvonne Marie AndrésloreCalifornia schoolteacher who, given a computer with no software in 1984, wrote her own and built a store-and-forward network that connected twelve thousand schools before the web existed.

13

Z-TunneltermClient Connector's transport to a Service Edge: 1.0 is an HTTP CONNECT tunnel shaped for web; 2.0 speaks TLS/DTLS and carries all ports and protocols.
ZabbixtermAn open source monitoring platform created by Alexei Vladishev in 2001, released as 1.0 in 2004 and backed since 2005 by a company in Riga; it collects over SNMP, IPMI, JMX and its own agents into a relational database and has been under the AGPLv3 since 7.0.
Zawinski's lawexpressionEvery program attempts to expand until it can read mail; those which cannot are replaced by ones which can.
ZCCacronymZscaler Client Connector: the endpoint agent that authenticates the user, classifies the network state, and forwards traffic per its forwarding profile.
ZDXacronymZscaler Digital Experience: endpoint-to-application experience monitoring riding the same vantage points as the brokered data path.
zero trusttermA security model that trusts nothing by default and verifies every request, wherever it comes from.
Zero Trust ExchangetermZscaler's globally distributed proxy platform: every connection terminates at a Service Edge, is identified and inspected, then completed onward - sources connect to the Exchange, the Exchange connects to destinations.
zero-daytermA vulnerability unknown to the vendor, with zero days available to have patched it.
ZerologonloreA 2020 flaw letting attackers take over a Windows domain controller.
ZIAacronymZscaler Internet Access: the Exchange's outbound seat - secure web gateway, cloud firewall, and data protection applied between users and the internet/SaaS.
ZIdentitytermZscaler's unified identity layer for the Zero Trust Exchange: one place to integrate identity providers and manage admin and user identity across the platform's services.
ZPAacronymZscaler Private Access: per-application, per-session brokered access to private apps - user and App Connector both dial out, a Service Edge stitches the Microtunnels.
ZTNAacronymZero Trust Network Access: per-application access granted after verifying user, device, and context - no network-wide tunnel, no flat inside.

19

:-) (the first emoticon)loreThe sideways smiley proposed on a CMU bulletin board in 1982 to mark jokes in plain text.
"5 GHz Wi-Fi is always better"loreDisputed / commonly mistoldHigher bands carry more data but die faster through walls and distance. 5 GHz wins next to the router; 2.4 GHz often wins two rooms away - it is physics, not quality tiers.
@ (the at sign in email)loreRay Tomlinson's 1971 choice of @ to separate a user from their host in networked email.
2600 MagazineloreThe Hacker Quarterly: the printed voice of hacker culture since 1984, and the origin of the HOPE conference and the Friday 2600 meetings.
307 Temporary Security Conference (307c)termA São Paulo security conference whose name declares its own impermanence - 307 is the HTTP status code for a temporary redirect - held in December with villages and a community programme.
418 I'm a teapotloreAn April Fools' HTTP status code, defined in 1998, returned by a teapot asked to brew coffee.
42 (the Answer)loreThe number a supercomputer gives, after 7.5 million years, as the Answer to Life, the Universe, and Everything.
420 Enhance Your CalmloreA non-standard HTTP status code once returned by Twitter's API for rate limiting, named Enhance Your Calm.
451 Unavailable For Legal ReasonstermThe HTTP status code for a resource withheld because of a legal demand, numbered after Fahrenheit 451.
464XLATtermIPv4 access across an IPv6-only network by translating twice: statelessly on the device, statefully at the provider.
5GtermThe fifth generation of mobile networking, defined as much by network architecture as by radio speed.
6 GHz Wi-FitermThe 5.925-7.125 GHz band opened to unlicensed Wi-Fi, roughly tripling the spectrum available to wireless LANs.
6to4termA 2001 IPv6 transition method that builds a site's IPv6 prefix from its public IPv4 address and tunnels across IPv4.
8.8loreChile's technical hacking conference - '100% técnico y académico', wrapped every year in a different pop-culture theme, from The Matrix to Unreal.
802.11termThe IEEE standard family that defines wireless LAN operation - what almost everyone means by Wi-Fi.
802.1DtermThe IEEE standard for MAC bridges, which introduced the Spanning Tree Protocol.
802.1QacronymThe IEEE standard that adds a VLAN tag to an Ethernet frame - the reason one physical link can carry many virtual LANs.
802.1XacronymPort-based network access control - the IEEE standard that makes a switch port or access point authenticate before it forwards traffic.
802.3acronymThe IEEE working group and standard for Ethernet - every wired speed and medium, plus Power over Ethernet.

Glossary

Commonly mistold

A109

B84

C158

D118

E69

F58

G48

H55

I72

J30

K28

L73

M88

N56

O41

P120

Q7

R95

S192

T181

U18

V20

W43

X14

Y8

Z13

#19

109

84

158

118

69

58

48

55

72

30

28

73

88

56

41

120

7

95

192

181

18

20

43

14

8

13

19