Learn

Network and security concepts, explained clearly.

Practical explanations of the concepts behind the tools. Each article is written to build genuine understanding, not just to define a term.

Read this page as

How do you want to learn?

I want to understand a subjectBrowse by subject explore · 440 articles in 11 subjects
I want to learn something in order, from the startLearning paths follow · 13 reading paths
I am preparing for an examCertification guides prepare · 105 guides, 1,632 objectives mapped
I work with a specific platformVendor hubs learn a platform · 8 hubs
I need a definition, fastThe glossary look up · 1,817 terms
I want a whole course, slides and notesOpen course material take a course · 1 courses, 178 slides

Browse by subject

440 articles in 11 subjects, the same taxonomy as the tools. A subject's page gathers its articles, tools and glossary terms; the arrow jumps to its block in the index below.

New and revised

NewBFD: when a link is up and dead at the same time2026年10月19日
NewBGP: how the internet decides where traffic goes2026年10月19日
NewBGP: the trust fall the whole internet is standing on2026年10月19日
NewCGNAT: what breaks when a thousand subscribers share one address2026年10月19日
NewDijkstra: the twenty-minute algorithm your routers run every day2026年10月19日
NewDNS: A File Maintained During Business Hours2026年10月19日

New here? Four places to start

Take the open TCP/IP courseA complete introductory course, 178 slides with speaker notes, from routing concepts to IPv6, multicast, MPLS and VRRP; present it in your browser.
Start with the networking subjectAddresses, routing, the protocols everything else assumes: the articles of the networking subject, in the index's order.
Preparing for an examThe certification guides: each exam's objectives mapped to the articles that cover them, and where the gaps are stated.
Something is broken right nowThe Practice: triage, incident method and the reading of a change, written for the moment it is needed.

Stories

Most articles here answer a question. A few do something else: they put other articles in an order that argues something none of them says alone. A category list sorts by subject, and these are sorted by argument, so this is the only page where they appear together.

Browse all 9 stories

Around Learn

Article series Subjects told in order, opener first, with the parts still to come already named.70 series
The Practice Learn the work, not only the technology: triage, incident method, the reading of a change.64 published
The Roles Who does what across the value chain, and what each role needs to know.43 positions
People The engineers, founders and authors behind the protocols and the companies.148 people
The industry record How the companies, products and ideas got here: lineage, acquisitions, dates.364 companies
Where the industry learns The companies that teach it, with their programmes and certifications.37 institutions
The tools Every article links the tools that compute what it explains; the tools link back.

The vendor-neutral index

All 440 vendor-neutral articles, grouped by 11 subjects and listed in each subject's reading order; the 311 articles about a single vendor's platform live in the vendor hubs. Jump to a subject, filter, switch to the list, or search Learn above.

跳转到

View

编码与数据 (46)

Article	Topic	Summary
JSON vs YAML: What Converts Cleanly and What Does Not	编码与数据	YAML was designed so that every JSON document is also valid YAML, which is why conversion between them usually just works. The interesting part is the edges: comments, anchors, multiple documents, and YAML-only types that have no JSON equivalent.
The Anatomy of a URL	编码与数据Web & HTTP	Every URL is built from the same handful of parts defined by RFC 3986: scheme, authority (userinfo, host, port), path, query, and fragment. What each part means, how a parser tells them apart, and where the boundaries actually fall.
The JSON Grammar: Six Types and a Few Strict Rules	编码与数据	JSON is smaller than it looks. The whole format is six value types and a handful of structural characters, governed by rules that are stricter than most people remember: no comments, no trailing commas, and keys that must be quoted strings.
What Unix Time Actually Is	编码与数据	Unix time is a single integer: the number of seconds since 1970-01-01T00:00:00Z, the epoch. It is time-zone independent, compact, and sortable, which is why it underpins almost every system clock, log line, and API timestamp. Converting it to a calendar date is pure arithmetic.
字节、码点与 UTF-8	编码与数据	字符与字节的区别、为何存在 Unicode 和 UTF-8，以及这与 Base64 有何关系。
Base64 与 Base64URL，详解	编码与数据	二进制数据如何变成可安全传输的文本、为何存在填充，以及 URL 安全变体中有何不同。
JSON Numbers and the Precision Trap	编码与数据	JSON puts no limit on the size or precision of a number, but most parsers quietly convert every number to a 64-bit float. That mismatch silently corrupts large integers and exact decimals, which is why a formatter should preserve the original digits.
Query Strings: Parameters, Plus Signs, and Repeated Keys	编码与数据Web & HTTP	The part of a URL after the question mark looks simple but hides real ambiguity: how parameters are separated, why a plus sign sometimes means a space, how repeated keys behave, and why there is no single governing standard.
Seconds, Milliseconds, Microseconds, Nanoseconds: Telling Epoch Units Apart	编码与数据	The same instant can be written as 1700000000, 1700000000000, or larger, depending on whether the timestamp counts seconds, milliseconds, microseconds, or nanoseconds. Mixing them up is a classic bug. You can almost always tell which is which from the number's magnitude.
YAML Type Coercion and the Norway Problem	编码与数据	YAML guesses the type of every unquoted scalar, and its guesses are surprising: the country code NO becomes false, a version like 1.0 becomes a number, and a zero-padded code loses its zeros. Knowing the rule is the key to safe conversion.
Base64URL 与 URL 安全字母表	编码与数据	为什么 JWT 和 PKCE 使用不同的 Base64 字母表、改变的两个字符，以及填充会发生什么。
Duplicate Keys in JSON: Legal, Dangerous, and Worth Catching	编码与数据	JSON syntax allows the same key to appear more than once in an object, but the specification does not say what that means. Different parsers resolve it differently, which makes duplicate keys a quiet source of bugs and even security issues.
JSON and YAML in Practice: APIs, Declarations, and Orchestration	编码与数据	The split is not random: APIs and machine-to-machine declarations tend to be JSON, while human-authored orchestration and pipeline files tend to be YAML. Understanding why each domain chose what it did explains when converting between them is useful.
The Year 2038 Problem	编码与数据	A signed 32-bit integer can count seconds only up to 2147483647, which falls on 2038-01-19T03:14:07Z. One second later it overflows and wraps to a negative number, throwing affected systems back to 1901. It is Y2K's quieter successor, and the fix is a wider integer.
URL Encoding and Internationalized Hosts	编码与数据Web & HTTP	URLs are restricted to a small set of ASCII characters, so everything else is encoded. Percent-encoding handles paths and queries; punycode handles non-ASCII host names. How both work, and why internationalized hosts are a phishing concern.
Base64 出现的地方：data URI、MIME、PEM 和 Basic auth	编码与数据	二进制被包入文本的真实场所、这样做的体积代价，以及为何认证头中的 Base64 不是加密。
ISO 8601, RFC 3339, and the HTTP Date	编码与数据	Once a Unix timestamp is turned back into a human date, it gets written in one of a few standard text formats. ISO 8601 is the broad standard, RFC 3339 is its strict internet profile, and the HTTP date is the odd one out. Knowing the difference saves a lot of parsing grief.
JSON String Escapes and Unicode	编码与数据	Inside a JSON string, a few characters must be written as escapes, and any character at all can be written as \uXXXX. The rules are small but strict, and the one that catches people is how characters beyond the basic plane, like emoji, need a surrogate pair.
YAML Anchors, Aliases, and Merge Keys	编码与数据	YAML can define a value once and reuse it with an anchor and alias, and merge one mapping into another with a merge key. None of this exists in JSON, so converting expands and duplicates it. This covers the syntax, what happens on conversion, and the denial-of-service trap they enable.
Base32 详解	编码与数据	为什么 Base32 用大小写不敏感、无歧义的字母表换取体积，它的 5 位分组如何工作，以及它出现在哪里（TOTP 密钥、onion 地址、DNS）。
Trailing Commas, Comments, and the JSON5 Family	编码与数据	Strict JSON has no comments and no trailing commas, which surprises people whose editor accepts both. The reason is that JSON is a minimal interchange format, and the tolerant variants (JSONC, JSON5) are separate things. Knowing which is which avoids config files that break in another tool.
Why Unix Time Ignores Leap Seconds	编码与数据	UTC occasionally inserts a leap second to stay aligned with the Earth's rotation, but Unix time pretends every day is exactly 86,400 seconds long. That deliberate simplification means a Unix timestamp is not a true count of elapsed seconds since the epoch, and it is the right trade-off for civil time.
YAML Block Scalars and Multiline Strings	编码与数据	YAML has two ways to write a multiline string, and they treat newlines differently: literal style keeps them, folded style turns them into spaces. Chomping indicators then decide what happens to the trailing newline. Getting these wrong is why an embedded script or certificate comes out subtly mangled.
Formatting, Minifying, and Canonical JSON	编码与数据	Whitespace does not change what JSON means, so pretty-printed and minified JSON are the same data. But when JSON is signed or hashed, the exact bytes matter, and that is where canonical JSON comes in: a deterministic way to serialize the same data to exactly the same string every time.
Relative URLs and How They Resolve	编码与数据Web & HTTP	A relative URL leaves out the scheme and host and is completed against a base URL. The rules for how a browser fills in the rest, and how ./ and ../ and a leading slash change the result, explain a lot of broken links and a few security surprises.
Roman Numerals: How the System Actually Works	编码与数据	Seven symbols, no zero, and one subtraction rule that arrived a thousand years after Rome. Why IIII is on your watch and IV is in your textbook, what IL breaks, and why the classical system runs out of road at 3999.
十六进制编码（Base16）详解	编码与数据	十六进制如何用两个字符表示每个字节，为什么它是打印原始字节的默认方式，以及它与 Base64 和 Base32 相比如何。
Deceptive URLs: Reading Past the Tricks	编码与数据Web & HTTP	URLs are a favorite tool for phishing because the real destination is easy to disguise. The userinfo trick, redirect parameters, and look-alike characters all make a hostile link look friendly. This shows the common disguises and the one reliable habit for finding the real host.
Time Arithmetic and Time Zones: Exact Durations, Honest Meetings	编码与数据	Why 'plus one month' has no exact answer, what ISO 8601 durations actually promise, and how one UTC instant becomes four different wall clocks. The DST trap, the day-shift trap, and the case for planning meetings with a real date.
百分号编码（URL 编码）详解	编码与数据	为什么 URL 把某些字符转义为 %XX，哪些字符可以安全地保持原样，以及百分号编码与 Base64 有何不同。
Base16、Base32、Base64 与百分号编码的比较	编码与数据	对四种文本编码的并排审视：它们的字母表、体积开销、可读性，以及何时求助于每一种。
How text diff works	编码与数据Text & utilities	A diff finds the smallest set of insertions and deletions that turns one text into another. Underneath is the longest common subsequence: the lines both versions share, in order, form the unchanged backbone, and everything else is an add or a remove.
Reading a diff	编码与数据Text & utilities	How to read a line-by-line diff: unchanged, added, and removed lines, the plus and minus markers, both sides' line numbers, inline word highlighting, and what ignore-whitespace and ignore-case actually change. Plus the things a diff cannot tell you.
Word and Character Level Diffs	编码与数据Text & utilities	A line diff marks a whole line as changed even when a single character moved. Word-level and character-level diffs highlight the exact part of the line that changed, which is far easier to read for prose, long lines, and small edits. This covers the difference and when each is the right lens.
Three-Way Diffs and Merge Conflicts	编码与数据Text & utilities	A normal diff compares two versions and cannot tell which one changed. A three-way diff adds a common ancestor, which is what makes automatic merging possible and what produces the <<<<<<< ======= >>>>>>> conflict markers. This explains the third input and how to read and resolve a conflict.
Minimal Edits: Why a Diff Can Look Wrong	编码与数据Text & utilities	A diff shows the smallest set of insertions and deletions that turns one text into the other. Because the smallest set is not unique and the algorithm has to choose, a diff can align lines in ways that look counterintuitive, blaming the wrong block or splitting a moved section. Knowing this makes odd diffs readable.
Reading XML Structure	编码与数据Security & WAF	XML is a tree of elements built from a handful of parts: an optional declaration, elements with attributes, text, and a few special constructs. Once you can name each part and see how they nest, reading an unfamiliar document top to bottom becomes routine rather than a guessing game.
XML Namespaces Explained	编码与数据Security & WAF	When two XML vocabularies use the same element name for different things, namespaces keep them apart by binding a prefix to a unique URI. The prefix is just a local shorthand; the URI is the real identity. Understanding that split resolves most namespace confusion.
Well-Formed vs Valid XML	编码与数据Security & WAF	Well-formedness is XML's baseline: one root, properly nested and matched tags, quoted attributes, and escaped specials. Validity is a stronger, separate claim that a document also follows a schema. A parser rejects ill-formed XML outright, which is why these rules come first.
CDATA, Comments, and Processing Instructions	编码与数据Security & WAF	Not everything in XML is an element. CDATA sections hold raw text that would otherwise need escaping, comments annotate without affecting content, and processing instructions carry directions for an application. Recognizing these three keeps them from looking like mysterious noise.
The formats in between: why every interchange bug is the same bug	编码与数据	JSON, YAML, XML, timestamps, text encodings, base64, URLs, diffs. They look like separate topics with separate reference pages. They are one topic: each is a convention for putting meaning into a string so that something else can take it out again, and almost every defect in the set is the two ends disagreeing about what came out.
HTML Forms and Request Encoding: How the Web Ships Your Input	编码与数据Web & HTTP	A form is a contract between a page and a server: which fields, which verb, which wire format. GET puts the answers in the URL; POST puts them in the body; and enctype picks the body's dialect - urlencoded's key=value chains, multipart's boundary-delimited parts built for files. What each choice means for logs, caches, size limits, and debugging, plus the fetch-era footnote: FormData kept the formats alive after forms stopped being the only sender.
URI, URL, URN: What's Actually the Difference?	编码与数据Web & HTTP	The three acronyms everyone uses interchangeably encode one clean idea: identify vs locate vs name. URI is the umbrella - any identifier in the standard grammar; URL is the identifier that also tells you where and how to fetch; URN was the scheme for pure, location-free names (urn:isbn:...). Why the W3C itself declared the classical trichotomy obsolete, what 'URI' means in specs vs 'URL' in conversation, and the naming lesson this site keeps collecting.
Unicode: code points, planes, names and properties	编码与数据	What a code point is, how the 1,114,112 of them are organised into planes, why a character on screen can be several code points, how Unicode names and classifies every character, and why the same emoji is 1, 2, 4 or 4 depending on which language counts it.
UTF-8, UTF-16 and UTF-32, byte by byte	编码与数据Web & HTTP	How each Unicode encoding lays a code point out in bytes, how to recognise each one in a hex dump, which byte sequences are ill-formed and exactly what a decoder replaces with U+FFFD, and what a byte order mark does, including the one point where a browser and the Unicode Standard disagree.
Mojibake: why café turns into cafÃ©, and how to get it back	编码与数据Web & HTTP	Text garbles when bytes written in one charset are read in another. How the classic patterns arise (UTF-8 read as windows-1252, DOS and Windows files read as each other, EBCDIC read as Latin-1), why a browser reads Latin-1 as windows-1252, how one invisible character in a charset label garbles a page, how to undo the damage and when you cannot, and what a BIG-IP WAF policy's encoding has to do with it.

标识符 (5)

Article	Topic	Summary
UUID：随机的 v4 与时间有序的 v7	标识符	一个 128 位标识符如何在没有中央权威的情况下保持唯一，以及为何 v7 正成为数据库键的默认选择。
UUID 版本详解：v1 到 v8	标识符	整个 UUID 家族汇于一处，从时间加 MAC 的 v1，到随机的 v4，再到时间有序的 v7，外加基于名称的版本，以及如何读取版本与变体位。
UUID 会碰撞吗？概率与生日界	标识符	一个 UUID 真正拥有多少随机位、一次碰撞的生日数学，以及何时需要确定性的 UUID。
作为数据库键的 UUID：v4、v7 与索引局部性	标识符	UUID 与自增整数之间真正的取舍，以及为何随机的 v4 键会悄然损害数据库性能。
ULID、KSUID、Snowflake 及其他可排序 ID	标识符	用于时间有序标识符、作为 UUID 流行替代品的若干方案，各自如何构建，以及为何 UUIDv7 如今覆盖了它们当初被发明的大部分用途。

哈希与加密 (15)

Article	Topic	Summary
哈希、加密与编码：三种不同的事物	哈希与加密编码与数据	三种被不断混淆的操作，由两个问题干净地区分：它可逆吗？它需要密钥吗？
密码学哈希：SHA-256 与 SHA-2 系列	哈希与加密	哈希函数保证什么、使其成为密码学的那些性质，以及为何摘要不是加密。
选择一个哈希：MD5、SHA-1、SHA-2、SHA-3 与 BLAKE	哈希与加密	哪些哈希函数仍然安全、哪些已被攻破、它们的输出大小，以及如何选择正确的那个。
碰撞、原像抗性与生日界	哈希与加密	密码学哈希必须具备的三个安全性质、碰撞为何重要，以及决定真实强度的生日数学。
存储密码：bcrypt、scrypt 与 Argon2	哈希与加密	为何像 SHA-256 这样的快速哈希是存储密码的错误工具，以及加盐和工作因子究竟做了什么。
HMAC：用于消息认证的带密钥哈希	哈希与加密	为何普通哈希能证明完整性却不能证明真实性、一个秘密密钥如何修补这一点，以及为何 HMAC 的结构至关重要。
为何用 HMAC，而非 hash(密钥 + 消息)	哈希与加密	破坏朴素带密钥哈希的长度扩展攻击，以及 HMAC 用来挫败它的嵌套构造。
用 HMAC 认证 API 请求	哈希与加密	一个共享秘密和一个哈希如何让服务器信任一个它未曾目睹其发出的请求，以及重放保护如何融入其中。
安全地验证 HMAC：恒定时间与重放	哈希与加密	为何用 == 比较签名会泄露一个时间侧信道，以及为何仅有一个有效签名并不能阻止一个被重复的请求。
Why Cryptographic Hashes Are One-Way	哈希与加密	A cryptographic hash maps any input to a fixed-size digest and is designed so that recovering the input from the digest is infeasible. That property, preimage resistance, is why you cannot decrypt a hash. The only ways to reverse one are to look it up or to guess-and-check, both of which are search, not inversion.
Brute Force vs Lookup Tables: Two Ways to Reverse a Hash	哈希与加密	Since a hash cannot be inverted, reversing one means searching, and there are two families. Precompute a giant table of input-to-hash pairs and look the hash up (what CrackStation does), or generate candidates on the fly and hash each until one matches (brute force). They trade storage for compute in opposite directions.
Why Salting Defeats Precomputed Tables	哈希与加密	A salt is a unique random value stored with each password hash and mixed in before hashing. It makes identical passwords hash differently, which destroys the economics of precomputed tables: an attacker would need a separate table for every salt. Salting is the specific defense that neutralizes lookup services and rainbow tables.
Slow KDFs: bcrypt, scrypt, and Argon2	哈希与加密	Salting defeats precomputation but not a targeted guess-and-check attack; a fast hash still lets an attacker try billions of candidates per second. Slow key derivation functions fix that by making each guess deliberately expensive and tunable, cutting an attacker's rate by many orders of magnitude. These are what you should store passwords with.
Keyspace, Entropy, and Crack Time	哈希与加密	Whether brute force can reverse a hash comes down to keyspace size versus the attacker's hashing rate. Keyspace grows exponentially with length and alphabet, so a few extra characters move a secret from cracked in seconds to infeasible for millennia. This is the arithmetic behind why length and randomness matter most.
Choosing a Password Hash	哈希与加密	Storing passwords safely is a solved problem: use a purpose-built, salted, slow password hash, not a raw digest. This is a short decision guide, from the algorithm to pick to the parameters to set and the mistakes to avoid, aligned with OWASP and NIST guidance.

身份与令牌 (34)

Article	Topic	Summary
JSON Web Token 的解剖	身份与令牌	一个 JWT 的三个段、签名如何使其可信，以及为何解码一个令牌与验证它并不相同。
JWKS and Key Rotation: How Providers Publish Their Keys	身份与令牌	A JWKS is the public phone book of signing keys that an identity provider publishes so anyone can verify its tokens. Understanding the keys array, the kid that names each key, and why a provider keeps more than one key at a time is the foundation of token verification.
OpenID Connect: An Identity Layer on OAuth 2.0	身份与令牌	What OpenID Connect adds to OAuth 2.0, the ID token at the center of it, the relying party and provider roles, how the authorization code flow delivers an ID token, and why an ID token is just a JWT you can decode and read.
JWK Key Types: RSA, EC, OKP, and oct	身份与令牌	Every JSON Web Key declares a kty, and that one field decides which parameters the key carries. Four types cover almost everything you will meet: RSA, elliptic curve, the Edwards and Montgomery curves, and the symmetric octet sequence. The crucial split in all of them is public versus private.
JWT 签名算法：HMAC、RSA 与 ECDSA	身份与令牌	为何一个 JWT 的 alg 头要紧、对称与非对称签名的区别，以及如何选择。
The ID Token Claims, and What a Relying Party Checks	身份与令牌	The claims inside an OIDC ID token: the required iss, sub, aud, exp, and iat; the nonce that stops replay; azp when there are multiple audiences; acr and amr for authentication strength; auth_time; and the at_hash and c_hash binding claims, with the validation a relying party performs on each.
JWT 安全陷阱：alg:none、密钥混淆与缺失的检查	身份与令牌	把一个 JWT 验证器变成伪造机器的少数几个错误，以及一个正确的验证器必须执行的验证。
OIDC vs OAuth 2.0: Authentication vs Authorization	身份与令牌	Why OAuth 2.0 is about authorization and OpenID Connect is about authentication, the difference between an access token and an ID token, why using plain OAuth as a login mechanism is a known antipattern, and how to tell which token is which.
Verifying a JWT with a JWKS: From kid to Signature	身份与令牌	Verifying a signed token is a short, strict sequence: read the header, find the key whose kid matches in the provider's JWKS, confirm the algorithm, and check the signature. Each step has a classic pitfall, and skipping the strictness is how verification bypasses happen.
JWK Parameters and Thumbprints	身份与令牌	A JWK is a JSON object describing one key, and its parameters say what the key is for and how to identify it. Beyond the key material, kid names it and an RFC 7638 thumbprint gives it a stable, computed identifier. This covers the common parameters and how a thumbprint is derived and used.
OIDC Discovery: The openid-configuration Document	身份与令牌	How the .well-known/openid-configuration document lets a relying party learn a provider's endpoints and capabilities automatically, what the issuer, jwks_uri, and signing-algorithm fields mean, why advertising the none algorithm is dangerous, and why PKCE S256 support matters.
访问令牌、刷新令牌与 ID 令牌	身份与令牌	三种屡被混淆的 OAuth 与 OpenID Connect 令牌、各自实际的用途，以及为何把错的发往错的地方是一个真实的 bug。
JWT Algorithm Confusion Attacks	身份与令牌	Two classic JWT verification failures come from trusting the token's own algorithm header: accepting alg none, and being tricked into verifying an RS256 token as HS256 using the public key as the secret. Both are defeated by pinning the expected algorithm on the server instead of reading it from the token.
The OIDC Authorization Code Flow	身份与令牌	The authorization code flow is the recommended way an app gets an ID token: the user is redirected to the identity provider to log in, the app receives a short-lived code, and it exchanges that code at a back-channel token endpoint for the tokens. Keeping the token out of the browser is the whole point.
公共客户端与机密客户端，以及 PKCE 的位置	身份与令牌	一个 OAuth 客户端能否保守一个秘密，决定了它的整个安全模型。为何 SPA 与移动应用是公共客户端，以及为何 PKCE 如今被推荐给它们全体。
OAuth 2.0 授权码流	身份与令牌	四个角色、重定向与交换的舞步，以及为何码在后端信道上被换成令牌。
PKCE：保护 OAuth 授权码流	身份与令牌	PKCE 所挫败的拦截攻击、验证者与挑战如何契合，以及为何 S256 是强制的。
OpenID Connect：建于 OAuth 2.0 之上的身份	身份与令牌	OIDC 如何为 OAuth 的授权增添认证、ID 令牌是什么，以及为何采用 PKCE 的授权码流程是推荐路径。
How TOTP and HOTP one-time passwords work	身份与令牌	Both turn a shared secret into a short code that proves possession without sending the secret. HOTP counts events; TOTP counts time. The engine underneath is the same HMAC plus a truncation step.
Validating one-time passwords: drift, windows, and replay	身份与令牌	Generating a code is the easy half. Accepting one means tolerating clock drift, bounding the window, rejecting reuse, and throttling guesses, each a tradeoff between usability and security.
Provisioning Authenticators: otpauth URIs and QR Codes	身份与令牌	Before an authenticator app can generate codes, it needs the shared secret and the parameters that go with it. That is carried in an otpauth URI, usually shown as a QR code to scan. Knowing the URI's fields explains what the QR code actually contains and why the secret is in base32.
LDAP Fundamentals: The Directory Model Behind Identity Systems	身份与令牌	The Lightweight Directory Access Protocol from first principles: the tree of entries and their distinguished names, the bind operation that authenticates, searches with base, scope, and filter, the group memberships access decisions ride on, and the LDAPS transport - the working vocabulary every identity product assumes before its own documentation makes sense.
Kerberos and SPNEGO: How Silent Desktop SSO Actually Works	身份与令牌	The ticket machinery behind login-without-a-prompt: the KDC's two services, the TGT and the service ticket, why SPNs and keytabs exist, how SPNEGO carries a Kerberos ticket inside an HTTP Negotiate header, and the small list of things - clock skew, missing SPNs, browser trust - that break it in practice.
SCIM: The Standard That Provisions the Accounts SSO Signs In	身份与令牌	The System for Cross-domain Identity Management in one sitting: why provisioning needed a standard, the RFC 7643 schemas for Users and Groups, the RFC 7644 REST protocol - create, filter, PATCH, deactivate - and where SCIM sits next to SAML and OIDC in an identity architecture: they authenticate the account, SCIM is how the account got there.
The PingAccess Policy Model: Gateway, Agent, and the Rule Stack	身份与令牌	How PingAccess decides who reaches what: the two deployment shapes (gateway routing to sites, agents speaking PAAP to a policy server), the application-and-resource partition, rules composed into rule sets and rule set groups, the fixed evaluation order, and the token mediation that keeps legacy backends in the game.
The PingDirectory Platform: Store, Aggregate, Sync, Delegate	身份与令牌	The four-piece identity data platform: the PingDirectory server as a high-performance LDAP and native SCIM 2.0 REST store, PingDirectoryProxy as the LDAPv3 gateway and virtual directory, PingDataSync as the real-time bidirectional synchronization engine across heterogeneous stores, and Delegated Admin as the controlled self-service surface - plus the operational grammar of cn=config, server groups, and zero-downtime moves.
PingOne: The Platform Behind the Product Names	身份与令牌	What PingOne actually is - a multi-tenant identity-as-a-service platform organized around environments inside an organization - and how its named services (SSO, MFA, Protect, Verify, Authorize, DaVinci) divide the work, how it relates to the self-managed PingFederate/PingAccess/PingDirectory stack and to Advanced Identity Cloud, and why the same word appears in so many product names.
PingOne DaVinci: Identity Orchestration as a Canvas	身份与令牌	What identity orchestration is and why it became its own product category: DaVinci's drag-and-drop flows, the connector catalog that turns vendors into nodes, server-driven orchestration that lets journeys change without app releases, the Singular Key origin story, and how DaVinci coexists with the ForgeRock-heritage journeys and trees under one SDK family.
From Sun to Ping: The ForgeRock Lineage Decoded	身份与令牌	Why the Ping catalog has two of everything: the family tree from Sun's OpenSSO, OpenDS, and OpenIDM through ForgeRock's OpenAM, OpenDJ, OpenIDM, and OpenIG to today's PingAM, PingDS, PingIDM, PingGateway, and PingOne Advanced Identity Cloud - the 2023 merger that created the parallel stacks, which product answers to which name, and how to read any Ping architecture diagram without ambiguity.
RADIUS end to end: one 802.1X login, packet by packet	身份与令牌	What a switch and a RADIUS server actually say to each other when a laptop plugs in: the packet fields and codes of RFC 2865, the attributes that carry the identity and the policy, the EAP conversation relayed in EAP-Message attributes, the VLAN assignment of RFC 3580, the Start and Stop records of RFC 2866, the server-initiated Change of Authorization of RFC 5176, the proxy chain, and the two things the shared secret does and does not protect. Every number from the RFC it comes from.
TACACS+ for device administration: a login and a command, exchange by exchange	身份与令牌	How a router asks a server whether an engineer may log in, whether the command just typed may run, and how it records that it ran: the three packet types of RFC 8907, the 12-byte header, the START, REPLY and CONTINUE of authentication, the per-command authorization with its name=value arguments, the START, STOP and WATCHDOG of accounting, the obfuscation the RFC refuses to call encryption, the 1993 ancestor of RFC 1492, and the method-list discipline that keeps an estate reachable when the servers are not.
802.1X and the EAP methods: the port, the envelope, and the choice that carries the security	身份与令牌	Port-based network access control from the frame up: the supplicant, authenticator and server, EAPOL and the controlled port, the four EAP codes of RFC 3748, and then the decision that actually matters, which method runs inside the envelope. EAP-TLS, PEAP, EAP-TTLS, EAP-FAST, TEAP, EAP-pwd, EAP-SIM and EAP-AKA compared on what each authenticates with, what it protects, and what it needs on the client, with the one setting that undoes most of them, the VLAN assignment the server returns, and the fallbacks for devices that cannot do any of it.
NTLM explained: three messages, three versions, and why it is still on your network	身份与令牌	What NT LAN Manager actually is, from Microsoft's own specification: a challenge-response carried inside other protocols, in NEGOTIATE, CHALLENGE and AUTHENTICATE messages that begin with the signature NTLMSSP; the connection-oriented and connectionless variants; the LM, NTLMv1 and NTLMv2 versions that share one flow and differ in the response function; how to recognise it in an HTTP header; why it survives wherever Kerberos cannot reach; what pass-the-hash and relay mean for it; and how to find what still depends on it before turning it off.
Web authentication and captive portals: the third door onto an authenticated port	身份与令牌	How a switch or controller logs in a person whose device cannot do 802.1X: the web authentication proxy of Cisco's switch guide, the intercepted HTTP session and the login page, the policy downloaded on success, the fail and expired pages and the watch list, host detection by ARP and DHCP snooping, local against central web authentication, the HTTPS limit that is breaking interception everywhere, and the IETF's replacement for the trick, the captive portal architecture of RFC 8952 and the DHCP and router advertisement options of RFC 8910 that tell a device a portal exists instead of forging answers.

网络 (157)

Article	Topic	Summary
How an Access Point Finds Its Controller	网络编码与数据Operations & Fieldcraft	Dynamic Host Configuration Protocol (DHCP) option 43 carries vendor-specific information whose meaning the vendor named in option 60 defines, so the same option holds binary addresses for one access point and text for another, while a third reads its controller from option 138 instead. After reading, you can build and decode the value each documented vendor expects byte by byte, get the server to return it to the right vendor class, recognise the silent failure and the rogue-server risk, and read the value back from a capture or a DHCP server.
IPv4 地址如何运作	网络	每一个点分四段地址背后的那 32 位，以及私有、回环与特殊地址段意味着什么。
The Syslog PRI: One Number, Two Meanings	网络	Every syslog message starts with a PRI, a number in angle brackets that packs a facility and a severity into a single value. The formula is small and the arithmetic is easy once you have seen it: PRI equals facility times eight plus severity.
Syslog Facilities and Severities, Explained	网络	Syslog defines 24 facilities and 8 severities. The severities are a clean urgency scale from emergency down to debug; the facilities are a mix of genuinely useful categories and historical Unix leftovers, plus eight local slots that network devices lean on heavily.
子网划分基础	网络	如何把一个网络分割为更小的子网，以及为何借用主机位便是全部的诀窍。
CIDR 记法详解	网络	192.168.1.0/24 中的那道斜杠究竟意味着什么，以及一个前缀长度如何界定一个 IP 地址的块。
Syslog on Network Devices: Which Facility Does What	网络	Firewalls, load balancers, and switches almost all log to the local facilities, but each vendor picks a different default. Knowing that FortiGate defaults to local7, Cisco ASA to local4, and F5 BIG-IP to local0 turns a wall of PRI numbers into a map of which box said what.
Syslog Message Formats: RFC 3164 vs RFC 5424	网络	The PRI is the same everywhere, but what follows it is not. Legacy BSD syslog (RFC 3164) has a loose, year-less format, while the modern format (RFC 5424) is precise and structured. Knowing which one you are looking at explains missing timestamps, ambiguous fields, and why parsers disagree.
VLSM：把一个块划分为不等的子网	网络	如何在不浪费空间的情况下把一个地址块切成不同大小的子网，以及让一切井然有序的最大优先规则。
How Syslog Travels: UDP, TCP, and TLS	网络	Syslog can ride over plain UDP, over TCP, or over TLS, and the choice decides whether messages can be silently lost, reordered, or read in transit. This covers the three transports, the ports involved, and why anything you rely on for audit should not be sent over UDP.
一个从头到尾求解的 VLSM 分配	网络	为一个现实网络做的完整可变长度子网分配：为每个网段确定大小、从大到小排序、分配真实地址，并对剩余空间进行记账。
The First Hour: Hypothesis-Driven Fault Isolation	网络Operations & Fieldcraft	The difference between a two-hour incident and a two-day one is usually decided in the first hour, and it is rarely decided by tools. It is decided by method: aligning onset with change, isolating by scope, reading layer signatures, and treating every explanation as a hypothesis that evidence must support or weaken before anyone acts on it.
超网与路由聚合	网络	相邻前缀如何合并为一个更短的前缀，决定两个块能否合并的对齐规则，以及精确聚合与覆盖它们的单一超网之间的区别。
Change Windows That Do Not Become Incidents	网络Operations & Fieldcraft	Most self-inflicted outages are changes that went wrong with no clean way back. The difference between a change and an incident is rarely the change itself; it is the runbook around it - what you verified before, how you sequenced it, what would make you stop, and whether the way back was written down and tested before you needed it.
路由汇总	网络	为什么一条汇总路由可以替代许多具体路由，它所依赖的连续且对齐的分配，以及汇总一个你并不完全拥有的范围时的黑洞风险。
Cloudflare: giving the moat away	网络	Akamai sold acceleration and DDoS protection to the Fortune 500; Cloudflare gave a version of both to anyone with a domain, and turned the free tier itself into the engine: more traffic meant better peering, better peering meant cheaper bandwidth, cheaper bandwidth paid for more free users. The reverse proxy that grew into a network, a resolver, an edge computer, and an uncomfortable amount of power.
Root Cause Is a Verb, Not a Noun	网络Operations & Fieldcraft	The phrase root cause invites a single villain and a tidy ending. Real incidents rarely have one; they have contributing factors, and the honest work is structuring the candidates and the evidence that would confirm or rule out each - not naming a culprit before the evidence is in.
子网重叠与空隙	网络	两个前缀重叠或一个包含另一个意味着什么，为什么最长前缀匹配使某些重叠是有意为之的，以及如何找出地址规划中未分配的空隙。
Akamai: the theorem that carried the web	网络	A math problem set by Tim Berners-Lee, an algorithm called consistent hashing, and the company that turned both into the invisible layer under two decades of streaming, launches and breaking news. The deploy-deep overlay, the IPO that nearly killed it, the co-founder lost on September 11, and the long reinvention from cache to security to cloud.
Blast-Radius Thinking Before You Change Anything	网络Operations & Fieldcraft	Before a change, the question is not only will this work but if it goes wrong, how far does the damage reach. Blast radius is the shape of that reach - target, neighbours, dependents, people - and thinking about it in tiers is how you decide what to contain before you touch anything.
私有 IPv4 地址空间与 RFC 1918	网络	三个私有范围、它们为何在互联网上不可路由，以及 CIDR 工具会标记的其他特殊用途块。
TAC Cases That Get Triaged Fast	网络Operations & Fieldcraft	The slowest support cases are rarely the hardest problems; they are the ones that opened without the diagnostic the vendor needs. A case that arrives complete - clear problem, exact error, the diagnostic bundle, the impact - skips the round trips and starts with an engineer actually working it.
理解 IPv6 编址	网络	一个 128 位的 IPv6 地址如何被构造与书写、把它规范地压缩的规则、那些地址类型与作用域意味着什么，以及接口标识符与反向 DNS 如何运作。
IPv6 主机如何取得地址：SLAAC 与 DHCPv6	网络	一台 IPv6 主机如何自链路本地向上自我配置、路由器通告决定了什么，以及 SLAAC、隐私地址与 DHCPv6 之间的差别。
Capture Points Before Packets	网络Operations & Fieldcraft	The instinct under pressure is to start tcpdump somewhere convenient and stare at the flood. The senior habit is the opposite: decide where to observe, in what order, and what each observation would mean - before a single packet is collected. Evidence is designed, not fished for.
IPv6 子网划分与 /64 边界	网络	为何 IPv6 子网划分关乎结构、而非稀缺，为何单个子网几乎总是一个 /64，以及前缀委派如何发放地址空间。
Public suffixes and the registered domain (eTLD+1)	网络证书与 PKI	What a public suffix (eTLD) and a registered domain (eTLD+1) are, why you cannot compute them by taking the last two labels, how the Public Suffix List algorithm resolves them, and where the boundary matters: certificate rate limits, cookies, and same-site.
Map the Path Before You Troubleshoot	网络Operations & Fieldcraft	The most expensive troubleshooting sessions share one flaw: nobody actually knew the path. The senior habit is refusing to reason about a failure until the chain is modeled - resolution included, return leg separate, every rewrite and TLS boundary named, and every unknown left visibly unknown.
邻居发现：IPv6 如何取代 ARP	网络	IPv6 如何在一条链路上以 ICMPv6 与多播、而非广播式 ARP 来寻得邻居，那五条邻居发现消息，以及广播为何消失。
Baselines Before You Need Them	网络Operations & Fieldcraft	Every comparison is only as honest as its weaker side. The discipline is captured baselines before changes, declared confidence instead of remembered health, observation windows that let convergence speak, churn literacy for the counters that always move - and never calling a change successful on green components alone.
让 IPv6 与 IPv4 共存：双栈与转换	网络	互联网如何在两个互不兼容的地址族之间架桥：双栈、Happy Eyeballs、NAT64，以及那些使之运转的、内嵌 IPv4 的地址。
What Is an OUI, and How MAC Addresses Are Assigned	网络	How a MAC address is structured, what the OUI (the manufacturer prefix) is and who hands it out, the difference between universally and locally administered addresses, and why a randomized Wi-Fi MAC has no vendor at all.
Reading dig Output From Top to Bottom	网络	dig prints every DNS answer in the same fixed shape: the version and options lines, the header line, the flags and counts line, the OPT pseudosection, the sections that have records, and four statistics lines. After reading, you can walk any dig answer block by block, name what each line reports, recognise NODATA, NXDOMAIN, SERVFAIL and a truncated answer from the shape alone, and choose the shorter forms a script needs.
The DNS Header: Opcode, Status, and Flags	网络Operations & Fieldcraft	Every DNS message opens with the same 12-byte header: a 16-bit ID, a flags word that holds the opcode, seven named flags, a reserved bit and the response code, and four section counts, which dig prints as its header and flags lines. After reading, you can decode a header from its hexadecimal bytes, say what each flag, opcode and status tells a diagnosis, recognise a truncated answer and test the TCP retry it needs, and explain why the ID and the source port must be unpredictable.
Reading the Records in a dig Answer	网络证书与 PKI	Every record dig prints is one resource record in five columns: owner name, TTL, class, type and the type-specific data, with the wire's length field left out. After reading, you can name each column, decode the data of A, AAAA, CNAME, NS, SOA, MX, TXT, PTR, SRV and CAA records, tell a counting-down cache TTL from a zone TTL, follow a CNAME chain to the name that owns the status code, and spot the aliases, timers and quoting mistakes that make a correct-looking answer fail.
EDNS and the OPT Pseudo-Section	网络	The OPT pseudo-section is not a record and not something you queried: it is EDNS(0) metadata that dig surfaces near the top of an answer. It carries the UDP payload size, the DO flag that requests DNSSEC, and options like COOKIE, and it quietly explains a whole class of resolution failures.
DNSSEC Records in dig Output	网络	Add +dnssec and a dig answer grows a new family of records: RRSIG, DNSKEY, DS, and the NSEC or NSEC3 denial records. This explains what each one is, how they chain from the root down to a zone, and what the ad flag really certifies.
Reading nslookup Output	网络	nslookup prints a Server / Address header for the resolver it used, an optional Non-authoritative answer marker, and then the answer in a per-type prose format. Knowing that shape lets you read any result quickly and see at a glance whether it succeeded, where it came from, and what it means.
nslookup vs dig: Which to Use	网络	nslookup and dig both query DNS, but nslookup is terser and hides the header flags and TTLs that dig shows in full. This maps one output onto the other and gives a simple rule for which to reach for.
How nslookup Prints Each Record Type	网络	Instead of dig's fixed columns, nslookup labels each record in prose: mail exchanger =, canonical name =, nameserver =, and a multi-line block for SOA. A short guide to reading each type's line.
Authoritative vs Non-Authoritative Answers	网络	An answer is authoritative when the server that sent it holds the zone for the name you asked about, and it says so with one bit of the DNS header, the AA bit, which nslookup reports as the Non-authoritative answer marker and dig as the aa flag. After reading, you can tell a cached answer from a referral, explain why a recursive lookup is non-authoritative by design, ask a zone's own server with recursion turned off and read aa in the reply, and say what the bit still does not prove.
nslookup Errors and What They Mean	网络	When a lookup fails, nslookup prints a line like ** server can't find NAME: CODE. The code is the whole diagnosis. This covers NXDOMAIN, SERVFAIL, REFUSED, and timeouts, what each one tells you, and the first thing to check for each.
Reverse DNS Lookups with nslookup	网络	Reverse DNS maps an IP address back to a name through PTR records that live under in-addr.arpa for IPv4 and ip6.arpa for IPv6. nslookup does this automatically when you hand it an address. This covers how the special reverse name is built, why mail servers care, and why the forward and reverse can legitimately disagree.
nslookup Interactive Mode	网络	Run nslookup with no arguments and it drops into an interactive prompt where you can switch resolvers, change the record type, turn on debug output, and look up many names in one session. This covers the handful of commands worth knowing and when interactive beats a one-shot query.
dig Query Options and Output Control	网络	dig's real power is its options: choosing the server to ask, the record type, and exactly how much of the answer to print. This covers the handful you will actually use every day, from @server and -t to +short and the +noall +answer combination that trims dig down to just the records.
Following Delegation with dig +trace	网络	dig +trace resolves a name the way the internet actually does it: starting at the root, following the delegation to the TLD, and then to the domain's own authoritative servers, printing each hop. It is the single best way to see where resolution breaks and to understand how DNS is stitched together.
Anatomy of a dig command line: how dig reads what you type	网络	dig takes a server after an @, options with a dash, a name, a type, a class and query options with a plus, in almost any order, and fills in a default for everything you leave out. This article walks the line from left to right: which words are positional and how dig tells a name from a type, why the plus options are order sensitive and two of them are global, how the transport is decided (UDP with a TCP retry, TCP for ANY and transfers, TLS and HTTPS on their own ports), which switches change header bits and which travel in the EDNS OPT record, what +trace and +nssearch do to recursion, and why the manual tells you to keep a TSIG secret in a file. Each statement is the BIND 9 manual's or an RFC's, cited.
How Networking Inherited Two Alphabets	网络Text & utilities编码与数据	Every engineer reads Greek letters and Roman numerals without ever being taught them: Ω on a terminator, μs on a latency graph, λ on a wavelength plan, Ethernet II in every packet decoder, a I or a II stamped on a repeater. None of it was chosen for networking. Each symbol arrived from a datable moment, and the dates are the story.
Linux: the hobby kernel that ate the world	网络	A student in Helsinki announced a project that was 'just a hobby, won't be big and professional like gnu', and it now runs the servers, the phones, the routers, the cars and every one of the world's fastest supercomputers. How the kernel actually got built, the licence decision that made it possible, the argument about its architecture that it lost on paper and won in practice, and the two fights that still define it.
The Linux distribution families: what actually separates them	网络	Every distribution ships roughly the same kernel and roughly the same GNU tools, so the differences are not where beginners look. They are in the package manager, the release model, the packaging philosophy and, most consequentially, who gets to decide. A field guide to the families, described by what you feel when you administer them.
What grew out of Linux: phones, routers, containers and the licence question each one answers	网络	Android, ChromeOS, SteamOS, OpenWrt, the Yocto builds inside your car, and the entire container industry are all Linux, but they are Linux in very different ways. The interesting part is not the family tree. It is how each descendant answered the same question: how much do we have to give back, and how did they engineer their answer?
Reading a curl Command	网络Web & HTTP	A curl command is a shell command: the word curl, a set of options, and a URL. Reading it means seeing how the shell splits the line first (quotes, backslashes, line continuations) and then how curl reads short, long, and clustered flags.
curl Data Flags and the Content-Type Trap	网络Web & HTTP	curl has several ways to attach a body, and they differ in encoding and default Content-Type. The big surprise is that -d defaults to form encoding, not JSON, so a JSON body can be mislabeled and rejected.
Translating curl to fetch()	网络Web & HTTP	The browser fetch API and curl describe the same request differently. Method, headers, and body map across cleanly, but a couple of differences (implicit form Content-Type, cookies, and TLS verification) need care.
Headers, Authentication, and Cookies in curl	网络Web & HTTP	Headers, auth, and cookies are how a request identifies and authorizes itself. -H adds headers, -u is HTTP Basic, a bearer token is just a header, and -b/-c handle cookies. All of them are sensitive.
How curl Infers the HTTP Method	网络Web & HTTP	curl does not always need -X to choose a method. Body data implies POST, -I implies HEAD, -G forces GET, and an explicit -X always wins. Knowing the rules tells you at a glance what a request will do.
curl Flags That Change Security Posture	网络Web & HTTP	A few curl flags change how safe a request is: -k disables TLS verification, http sends everything in clear text, and credentials in the URL can leak. None make a request malicious, but each is worth reading before you run or share a command.
The TCP Proxy: What a Layer 4 Middlebox Does and Does Not See	网络Web & HTTP	A TCP proxy terminates the client's TCP connection and opens a separate one to the server, splicing two independent flows together at Layer 4. It rewrites addresses and ports, can pool and reuse connections, and sees nothing of the application payload above the transport header. This explains full-proxy versus packet-forwarding, why the source IP disappears, and how the Proxy Protocol puts it back.
HTTP Proxies: Forward vs Reverse, Explicit vs Transparent	网络Web & HTTP	An HTTP proxy parses requests at Layer 7, so it can route by URL, rewrite headers, and enforce policy on content a TCP proxy cannot see. Two axes describe every deployment: forward vs reverse (which side it works for) and explicit vs transparent (whether the client knows it is there). This covers the CONNECT method, X-Forwarded-For and Via, and where each combination is used.
The 27 Protocols curl Speaks	网络Web & HTTP	curl is known as an HTTP tool, but the current tool speaks 27 URL schemes: file transfer over FTP, SFTP and SMB, mail over SMTP, POP3 and IMAP, MQTT publish-subscribe, LDAP lookups, and relics like Gopher, DICT and Telnet. Knowing the map, and which schemes start in cleartext, changes how you use it.
HTTP/0.9 vs 1.0 vs 1.1 vs 2 vs 3: Five Versions of the Web's Protocol	网络Web & HTTP	From a one-line GET that could only fetch HTML to a multiplexed protocol riding QUIC: what each HTTP version added, why it was needed, and which RFC defines it today - including the 2022 reorganization that split HTTP semantics (RFC 9110) from the per-version wire syntax.
The chokepoints of the internet: a field guide to what could actually break	网络	The internet has no off switch, but it has six places where a small number of people, organisations or objects carry a very large share of everyone else's assumptions. Naming, routing, cable, trust, concentration and authority: what each one is, how fast it fails, who could cause it, and the different kind of answer each one admits.
What happens if the DNS root goes dark, or starts lying	网络	Turn off all thirteen root server identities and the internet keeps working for about two days, then unravels one top-level domain at a time as cached delegations expire. The far more dangerous scenario is a root that stays up and answers differently, because DNSSEC will faithfully sign the new reality. Here is the actual failure timeline, what survives, what you can do about it today, and why every alternative root has failed.
BGP: the trust fall the whole internet is standing on	网络	BGP carries reachability between about 74,000 independently run networks and has no built-in way to check whether an announcement is authorised or a path is real. After reading, you can tell a hijack from a route leak as the standards define them, explain why a more specific route wins and why upstream filtering decides the damage, read the documented incidents in their owners' and regulators' records, and say which defence (filtering, signed route origins, peering roles, path signatures) answers which failure.
Route origin validation, worked by hand: Valid, Invalid, NotFound	网络	Route origin validation compares a BGP route's prefix and origin AS with the Validated ROA Payloads a router holds and gives the route one of three states. After reading, you can work out any route's state by hand from the two tests RFC 6811 defines, say why an Invalid route is Invalid (another AS, or a prefix longer than maxLength), read AS 0 and maxLength the way the RFCs do, and check your answer with the calculator.
Submarine cables: the internet is a rope on the seabed	网络	Virtually all intercontinental traffic runs through a few hundred fibre-optic cables lying on the ocean floor, most no thicker than a garden hose, and the great majority of breaks are caused by fishing gear and ship anchors rather than by anybody's intent. What actually happens when they cut, why some countries shrug and others go dark, how repairs really work, and why redundancy on a map is not redundancy in the ground.
Cloud and CDN monoculture: the chokepoint nobody chose	网络	Nobody decided that a configuration error at one company should take a quarter of the web offline for an hour, and yet that is roughly the arrangement. Concentration in cloud regions, content delivery networks, DNS providers and identity services means unrelated organisations now fail at the same moment for the same reason. Why it happened, what actually fails, and why the obvious answer (multi-cloud) is mostly wrong.
Internet shutdowns: the chokepoint that is a phone call	网络	Every other chokepoint in this series requires an attack, an accident or an act of engineering. This one requires an instruction to a handful of companies that already hold licences. Shutdowns are now routine somewhere in the world most weeks (full blackouts, regional cuts, platform blocking, and the quieter option of throttling) and the technical picture is less interesting than who has to comply and what it costs.
AltaVista: built to break a processor, and lost by becoming a portal	网络	AltaVista started as a benchmark. A researcher wanted a workload chaotic enough to stress DEC's new Alpha chips, so he pointed a crawler at the entire web. The result led search for years and then was dismantled by its own owners, which makes it the clearest case study in the industry of losing a market you already have.
CGNAT: what breaks when a thousand subscribers share one address	网络Security & WAFOperations & Fieldcraft	Carrier-grade NAT (CGN) is a NAT in the provider's network that shares one public IPv4 address among many subscribers, with the shared address space 100.64.0.0/10 numbering the link behind it. After reading, you can state what RFC 6888 requires of a CGN, name what the published tests found broken, explain why an address alone no longer identifies a subscriber, compute the log volume and a deterministic port block, place NAT444 among DS-Lite and the A+P designs, and check whether your own connection sits behind one.
Dijkstra: the twenty-minute algorithm your routers run every day	网络Operations & Fieldcraft	In 1956 Edsger W. Dijkstra designed a shortest-path algorithm on a café terrace in Amsterdam, without pencil and paper, to demonstrate a new computer; every router running Open Shortest Path First (OSPF) or Intermediate System to Intermediate System (IS-IS) computes the tree that algorithm produces. After reading, you can tell the story from his own words, run the algorithm by hand on six routers, explain why link costs must be positive and why equal costs give several next hops, and find the result and the SPF throttle on a router.
Port blocks and port sets: the arithmetic of sharing one IPv4 address	网络Operations & Fieldcraft	When a carrier-grade NAT or a MAP domain shares one public IPv4 address, what it divides is the 16-bit port field, by blocks, by a deterministic formula or by bit fields. After reading, you can work out how many subscribers an address and a pool hold, what block logging saves, which subscriber held a given address, port and time under RFC 7422, and which ports a MAP PSID owns.
Load balancing: what actually decides where a request goes	网络	Every load balancer answers the same four questions: which servers are alive, which one gets this request, does this client have to keep going to the same place, and what happens when the answer changes. The algorithms are the least interesting part. The health check, the persistence decision and the drain behaviour are where outages come from.
Network segmentation: from broadcast domains to identity, and why it keeps failing at the same place	网络	Segmentation began as a performance fix for collision domains, became a security control by accident, and is now sold as microsegmentation. The mechanisms (VLANs, VRFs, VXLAN, firewall zones, host agents, cloud security groups) each solved the previous one's limits and inherited a new failure mode. The history, the standards, the architectures, the vendor landscape, and the thing that defeats every generation: nobody knows what talks to what.
Wi-Fi: a shared medium pretending to be a cable, and everything that follows from that	网络	Ethernet solved contention by giving every device its own wire. Wi-Fi cannot, so it borrows the 1970s radio protocol Ethernet abandoned, and every generation since has been an attempt to buy back the efficiency that sharing costs. The standards, the spectrum, the architectures, the vendor landscape, and why the most common deployment mistake is treating coverage and capacity as the same problem.
GPON: How One Fiber Serves a Whole Neighborhood	网络	A Gigabit Passive Optical Network runs one strand of glass from the exchange, splits it with unpowered prisms, and shares it among dozens of homes. How the light is divided, why upstream needs a schedule, and where the decibel budget goes.
Bridges and Switches: One Idea, Solved Twice	网络	The bridge and the switch are the same idea a few years apart, and the story runs through two people who are rarely mentioned together. Radia Perlman solved the loop problem at Digital in a single night in the mid-1980s and wrote the answer as a twelve-line poem. Kalpana put the same function in silicon per port in 1990 and sold the result to Cisco four years later. Along the way: why Perlman says the whole thing grew out of an industry mistake, why the switch replaced the hub without anyone calling it a security improvement, and what happens to a layer that has been declared finished several times.
Jumbo frames: when 1500 bytes stops being enough	网络	Why Ethernet settled on 1500 bytes, what 9000-byte jumbo frames actually buy, where they shine, and how an MTU mismatch turns into a silent black hole.
Bits, bytes and the two kinds of kilo: why a 56k file takes eight seconds on a 56k modem	网络	The arithmetic every network conversation leans on and most get slightly wrong: a byte is eight bits, link speeds are in bits and file sizes in bytes, kilo means 1000 everywhere except where it means 1024, and the IEC gave the 1024 kind its own prefixes in 1998. Why a 1 TB disk shows 931 and nothing is missing, why a 100 Mbit/s link moves at most 11.87 MB/s of TCP payload (RFC 2544 and the header minima), and the worked example a calculator on this author's 2004 site already carried. With NIST, the GNU ls page, ITU-T V.90 and G.704, IEEE 802.3-2022 and the RFCs.
HTTP QUERY: the read that finally carries a body	网络Web & HTTP	RFC 10008 (June 2026) gave HTTP its first new method since 2010: QUERY is safe, idempotent, and cacheable like GET, but carries a request body like POST. What it fixes, how its caching and discovery work, why 'safe' is not 'harmless', and what every layer of infrastructure must check before QUERY traffic arrives.
The Router: From Gateway to Commodity, and the Names Left Out	网络	The router has been reinvented at least four times and its job has never changed once: read a destination, choose a next hop, forward. This is the family history - the IMPs of 1969, the first true IP router written at BBN by Virginia Strazisar in 1975 and 1976, the multiprotocol router invented twice independently in 1981 at Stanford and MIT, the blue box that became Cisco, and the long slide from specialist hardware to software on a general-purpose machine. Including why the two people who solved the hardest early problems in layers 2 and 3 are both rarely named.
F5 Distributed Cloud: one request, end to end	网络	Sixteen articles on F5 Distributed Cloud, read in the order a request meets them: how a site joins the fabric, where the request lands, which route it takes, where it is sent, how it is encrypted, whether it is allowed, how much of it is tolerated, what it may call, what it leaves behind, and what is silently wrong with the configuration that handled it.
Load Balancers and ADCs: Built Against the Market Sizing	网络	In late 1995 a Netscape webmaster told a Cisco engineer there were probably ten customers in the world with a load balancing problem. They started building anyway, and shipped the industry's first load balancer four months later. This is the family history - LocalDirector in April 1996, F5's BIG/ip in July 1997 on 200,000 dollars of first-year revenue against a five-billion-dollar competitor, the rename to application delivery controller, and what happens to a box whose function has been absorbed into every platform that came after it.
Extreme Fabric Connect: one service, edge to edge	网络	Ten articles on Extreme's fabric, read in the order a service comes into existence: which operating system, what the words mean, what the fabric is, how the nodes know each other, how a service rides the backbone, why multicast needs no configuration, how the edge asks for what it needs, and how the edge is dual-homed without spanning tree. The organising fact is the one the fabric is built on - a service is provisioned at the edge, not trunked hop by hop.
Reading a DNS answer: the line you skipped is the diagnosis	网络	A DNS answer printed by dig or nslookup is the whole reply message: a header with flags and a response code, the question, an OPT pseudo-record and up to three sections of records, of which the address is one line. After reading, you can tell who answered and with what authority, read the flags, the OPT line, the TTLs and the failure codes, ask the authoritative server directly, follow a delegation with +trace, and find the part of this series that goes deeper on each line.
The industry, from inside: six articles on how this business actually works	网络	Who founds the companies, how a product travels from the people who build it to the people who depend on it, what the role in the middle of that path does all day, what a customer is really buying when they buy transformation, and what every appliance on the estate is running underneath. Six articles that are not about any vendor, read in the order a career meets them.
Transceivers: The Ridiculed Paper, and the Part of the Network You Can Hold	网络	In 1966 a 32-year-old engineer at a British lab published a paper arguing that the enormous losses in optical fibre were caused by impurities rather than by physics, and was widely ridiculed for it. Four years later Corning proved him right, and he received the Nobel Prize forty-three years after the paper. This is the family history of the transceiver - from Kao's paper to the multi-source agreement, the industry's most successful act of deliberate self-restraint, and why the smallest replaceable part of a network is the one that determines what the network can become.
Software-Defined Networking: A Protest That Became a Product Category	网络	The early work that became SDN - Ethane, RCP, 4D - arose as a protest against the ossification of networks. Within seven years the protest had a foundation with Cisco and Juniper among its founding members, and its author had sold his company to VMware for 1.26 billion dollars and become a venture capitalist. This is the family history: what the movement actually asked for, what the industry gave it instead, and why the idea succeeded completely while the protocol it was named after mostly did not.
DNS: A File Maintained During Business Hours	网络	Before 1983, getting an address on the network meant telephoning Elizabeth Feinler at SRI, who added you to a file that staff updated a couple of times a week, during business hours, holidays excepted, and that every host then fetched. Jon Postel handed the problem to a graduate student, who read the existing proposals, wrote his own, and single-authored the specification of the system that now resolves trillions of queries a day. This is the family history: the file, the design, the security that was left out, and how a naming system became the internet's most convenient point of control.
Virtualisation: Solved in 1967, Forgotten, Then Proved Impossible, Then Done Anyway	网络	IBM put a working hypervisor into production use in January 1967. The industry then spent fifteen years without one, because cheap personal hardware removed the reason to share a machine - and when the reason came back, a formal analysis said the dominant processor could not be virtualised at all. A Stanford group did it anyway. This is the family history of virtual machines and containers: two separate lineages, one from mainframes and one from a Unix command that was never meant for security, meeting in the infrastructure everything now runs on.
Wireless: The Islands Problem, and the Protocol Given Away	网络	In 1968 a professor in Hawaii needed to connect computers across four islands and could not lay cable across the Pacific. The answer - let stations transmit whenever they have something to send, and deal with the collisions - became operational in June 1971, was placed in the public domain because no office existed to commercialise it, and is now underneath Wi-Fi, mobile networks, cable and Ethernet. This is the family history, including the regulatory decision that mattered more than any protocol and the encryption failure that taught the industry its most expensive lesson.
Obsolescence: What Actually Dies, What Refuses To, and How to Tell	网络	This industry is wrong about obsolescence in both directions. It declares things finished that outlive the declaration by decades, and treats as permanent things that vanish inside a product cycle. Drawing on the family histories and company records in this catalogue, this is an attempt at something more useful than prediction: the specific mechanisms by which a technology actually dies, the specific reasons others cannot be killed, and what both imply for anyone deciding what is worth learning.
Observability: The Temporary Protocol That Outlived Its Replacement	网络	In 1988 a working group published a protocol it had been instructed to keep simple, intended as a stopgap, authenticated by a password sent in the clear. It became the way the world watched its networks and is still running. Its more secure successor collapsed under the complexity of its own security. This is the family history - from SGMP and RFC 1067 through the failure of version 2 to streaming telemetry - and what it says about why bad security survives.
Time: The Dependency Nobody Lists	网络	One man designed both the first modern software router and the protocol that keeps the internet's clocks, and fragments of the code written for it in 1985 are still running. Time appears in no architecture diagram and sits underneath certificates, tickets, logs, one-time codes and half the security controls in this catalogue. This is the family history of NTP - the Fuzzball, RFC 958, leap seconds specified from the very first document, and the debug command that became a weapon.
The OSI Model in Practice: Mapping Real Traffic to Seven Layers	网络	The Open Systems Interconnection model earns its place not as trivia but as a shared address system for problems: a MAC address is Layer 2, an IP address Layer 3, a TCP or UDP port Layer 4, and the application on top. How to map real artifacts to layers, where the model bends against TCP/IP reality, and why troubleshooting conversations go faster when everyone points at the same floor.
Local, Wide and the Words That Stopped Meaning Distance	网络	The distinction between a local and a wide area network was never really about geography. It was about who owned the link and what a byte cost to move, and every protocol written before about 1995 encodes an assumption about which side of that line it would run on. This is the family history of network scope - why the categories were invented, why VLANs and overlays broke them, and why an industry that spent thirty years insisting the perimeter was a place now uses the word local to mean trusted.
Switch, Router, Firewall: Who Does What on the Path	网络	Three device roles carry most of every network diagram: switches forward frames inside a Layer 2 domain, routers move packets between networks, and firewalls decide what is allowed to pass. The function and purpose of each, how an application delivery controller relates to all three, and how to read a network diagram without getting lost.
ARP and MAC Addresses: How IP Finds Ethernet	网络	Every packet on a local network is delivered by MAC address, and ARP is the directory service that maps an IP to one. The one-to-one mapping, reading ARP output to prove resolution worked, gratuitous ARP, and MAC masquerading - the failover trick that makes an address move without the switches noticing.
Routing Tables and the Default Gateway: How a Packet Picks Its Next Hop	网络Operations & Fieldcraft	A routing table answers the one question every host and router asks of a packet: where does it go next. The host decides local or remote by its mask and hands the rest to a default gateway; the router prunes its table to one entry by basic match and longest match, with the default route of prefix length zero as the entry of last resort. After reading, you can run the longest-match decision by hand, read a Linux or Windows table line by line, say how a host learned its default (by hand, by DHCP, by Router Discovery or by an IPv6 Router Advertisement) and recognise a missing, dead or rogue default from its symptoms.
Test and Measurement: The Family That Checks the Others	网络	Every other family in this catalogue builds something. This one exists to find out whether the claims the others make are true - and it began as an internal engineering tool that somebody got the rights to in an acquisition. This is the history: TART at a subsidiary in 1982, the Sniffer selling nine hundred million dollars' worth, a standards document that opens by accusing vendors of smoke and mirrors, and a free analyser written because one company could only afford a single instrument.
Reading ip route, netstat and route print, field by field	网络	A routing table printout is one decision written in three dialects: Linux iproute2 prints keyword and value pairs, net-tools and BSD netstat print columns with flag letters, and Windows route print prints a netmask table per address family. After reading, you can name every field in the three printouts, find the default routes and say which one wins, spot the routes that drop traffic or are never consulted, and work out by hand which line a destination uses.
DHCP: the Lease Lifecycle Behind Automatic Addressing	网络编码与数据Operations & Fieldcraft	A Dynamic Host Configuration Protocol (DHCP) lease is an IPv4 address lent to a host for a fixed time: granted in four messages, extended at T1 by the same server or at T2 by any server, and given up at expiry. After reading, you can say who sends each message to whom, compute T1, T2 and expiry for a real lease, explain DHCPNAK, DHCPDECLINE, DHCPRELEASE and DHCPINFORM, predict what a client does when its server disappears, and recognise a silent server, a 169.254 address, a rogue server and an exhausted pool.
The TCP Connection Lifecycle: Handshake, Teardown, and Why Connections Fail	网络	Every TCP conversation has three acts: the SYN handshake that creates it, the data flow that justifies it, and the FIN or RST that ends it. The difference between polite close and abort, the possible reasons a connection terminates, and the short list of causes when one fails to establish at all - the literacy behind every capture you will ever read.
VPN Fundamentals: What Tunnels Protect, and What They Don't	网络	A virtual private network wraps traffic in an encrypted tunnel so it crosses untrusted networks as if it never left home. The rationale - privacy, encryption, and the limits of anonymity - the valid uses from site-to-site links to remote access, and the honest boundaries: what a tunnel genuinely protects, and the claims it cannot keep.
The Last Mile: From POTS to Always-On	网络	The story of residential connectivity is the story of one stubborn stretch of infrastructure - the last mile - being reinvented four times: the plain old telephone service that carried voices, the ADSL trick that made the same copper pair carry data full-time, the cable plant's DOCSIS second life, and fiber to the home. Why 1999's 256 kbps mattered more than its speed, what always-on actually changed, and how one house can end up served by copper's ghost, coax, glass, and the sky at once.
Pagers and Paging Networks: Reachable Before Real-Time	网络	Before the phone in your pocket, there was the bip on your belt: a one-way radio receiver on a simulcast broadcast network, fed - in its classic form - by a human operator who took your caller's words and typed them into the air. How paging networks actually worked, from two-tone beeps to POCSAG and FLEX, why the operator-relay model meant strangers read your life aloud, and why hospitals kept pagers long after everyone else moved on.
LEO Constellations: Why the New Satellite Internet Is a Different Animal	网络	Geostationary satellites solved coverage and lost latency: parked at 35,786 km, physics alone charges half a second round trip. Low Earth Orbit constellations invert the deal - satellites a few hundred kilometers up, latency in the tens of milliseconds, at the price of needing thousands of moving satellites, phased-array terminals that track them, and constant handoffs. The geometry, the engineering it forces, inter-satellite laser links, and the honest trade-offs.
LoRa and LPWAN: Kilometers of Range on a Coin Cell	网络	There is a corner of networking where the requirements invert everything broadband optimizes for: send a few bytes, a few times an hour, kilometers through a city, from a battery that must last years. LPWAN is that corner; LoRa is its best-known citizen - Semtech's chirp spread spectrum radio trading bitrate for astonishing link budgets, and LoRaWAN, the LoRa Alliance's network layer, organizing gateways, device classes, and the duty-cycle etiquette of shared spectrum.
HTTP Methods: The Verbs of the Web	网络Web & HTTP	GET, HEAD, POST, PUT, DELETE, PATCH, OPTIONS, TRACE, CONNECT - and now QUERY. What each method promises, why 'safe' and 'idempotent' are the two properties that actually matter (to caches, retries, proxies, and crawlers), why HTML forms only ever learned two verbs, and how to read an API's soul from the methods it accepts.
HTTP Status Codes: The Five Families	网络Web & HTTP	Three digits, and the first one does most of the work: 1xx continues, 2xx succeeds, 3xx redirects, 4xx blames the client, 5xx confesses for the server. The family logic, the codes an operator actually meets (200, 204, 301 vs 302 vs 307, 304's cache dance, 401 vs 403, 404 vs 410, 429, 500 vs 502 vs 503 vs 504), the famous curiosities, and why an unknown code's first digit is always enough to act on.
HTTP Headers: The Anatomy of the Metadata	网络Web & HTTPSecurity & WAF	Everything HTTP knows about a message that isn't the message travels in headers: name-colon-value lines with case-insensitive names, folded into four working roles - request context, response context, representation metadata, and negotiation and conditionals. The end-to-end vs hop-by-hop split that proxies live by, the Host header that made virtual hosting possible, content negotiation, conditionals, and why header order became a fingerprint.
HTTP Cookies: State Over a Stateless Protocol	网络Web & HTTPSecurity & WAF	HTTP forgets you after every request - by design. Cookies are the retrofit that lets it remember anyway: the server writes a note with Set-Cookie, the browser returns it with Cookie, and everything else - scope, lifetime, security - is rules about when that note travels. Domain and Path scoping, session vs persistent lifetimes, why the server never sees what the browser knows, and where the security flags article picks up.
AJAX, XHR, and fetch: When Pages Learned to Talk Back	网络Web & HTTP	For its first decade the web had one move: click, blank screen, new page. XMLHttpRequest gave pages a second one - request data in the background, update in place - and 'AJAX' named the revolution (which promptly dropped the X for JSON). How XHR worked, what fetch fixed (promises, streams, a sane API), what stayed the same underneath (it is all still HTTP), and the boundary every background request answers to: same-origin, with CORS as the negotiated exception.
HTML, CSS, and the DOM: The Page as a Living Tree	网络Security & WAF	Three technologies, one division of labor: HTML declares structure, CSS declares presentation, and the DOM is what actually exists at runtime - the tree the browser built from your HTML, the only thing scripts can touch, and the reason 'view source' and 'inspect element' show different worlds. How markup becomes a tree, how selectors address it (the same selectors CSS styles with and scripts query with), and why the DOM is where XSS happens and where CSP stands guard.
What Is an Algorithm? A Working Primer	网络Web & HTTP哈希与加密	An algorithm is a finite, unambiguous recipe that turns input into output - and the engineering questions are always the same three: is it correct, how does its cost grow, and what does it trade away. Big-O as the grammar of growth, why constants and asymptotes both matter, the core families you already operate (search, sort, hash, graph, state machines), and where each one is already running inside this site's own tools.
The IEEE 802 family, group by group	网络	802 is not one standard but a committee of working groups, each owning a slice of the lower two layers. Here is the map: who owns Ethernet, who owns Wi-Fi, what the numbers after the dot mean, and which groups are alive, hibernating, or long dead.
Structured cabling: the system behind the wall jack	网络	TIA-568 turns a building's wiring from improvisation into a system: horizontal runs, telecom rooms, the 100-meter channel, categories, pinouts, and the fire ratings inspectors actually check. The map from wall plate to backbone.
BGP: how the internet decides where traffic goes	网络	The Border Gateway Protocol is the routing protocol between autonomous systems: each network tells its neighbours which prefixes it can reach and through which networks, and each router keeps one best path per prefix, chosen by local policy first and a fixed tie-break order after. After reading, you can place an AS number in its registry, follow a session from TCP to Established, read the path attributes, walk the best-path decision on real router output, and say what an AS path does and does not prove.
OSPF: the map, the math, and area 0	网络Operations & Fieldcraft	OSPF is the Internet Standard link-state interior gateway protocol: each router floods a description of its own links, every router in an area holds the same database, and each one computes its own shortest-path tree from it. After reading, you can work out a route by hand from link costs, say why two routers will not become neighbours, explain the designated router election and the rules for areas, set costs without the reference-bandwidth trap, and read FRRouting's neighbour, database, route and interface output.
IS-IS: the routing protocol hiding under the internet	网络Operations & Fieldcraft	Intermediate System to Intermediate System (IS-IS) is the link-state routing protocol ISO wrote for OSI and RFC 1195 extended to IP: it floods link state as OSPF does, but its packets travel on the link layer, not inside IP. After reading, you can build a NET from a loopback address, tell Level 1 from Level 2 routing, predict which router becomes the DIS on a LAN, read show isis neighbor and show isis database in FRRouting, and say what its authentication protects and what it leaves open.
MPLS: labels, stacks, and the BGP-free core	网络Operations & Fieldcraft	Multiprotocol Label Switching (MPLS) classifies a packet once, at the edge of a network, and from then on routers forward it on a short label they swap, pop or push, without reading the IP header again. After reading, you can decode a label stack entry in hex, name the special-purpose labels, follow one label-switched path through a real Label Distribution Protocol (LDP) binding table, say exactly what a BGP-free core keeps and drops, and explain the two labels of a layer 3 virtual private network (VPN) packet.
Peer-to-peer, from Napster to the swarm: the architectures that outlived the piracy	网络	Napster, Gnutella, Kazaa, eMule, BitTorrent - four years of file-sharing produced five distinct network architectures, each solving the weakness the last one died from. The centralized index, unstructured flooding, the supernode, the distributed hash table, and the swarm - what each actually was, how the courtroom shaped the topology, and why these ideas quietly power Skype, streaming CDNs, and blockchains today.
The Brazilian market reserve, in theory and in practice	网络	For eight years Brazil legally reserved its computer market for domestically-owned companies. The theory was an infant industry that would grow up and compete. The practice was clones, smuggling, a trade war with Washington, and a generation of engineers who learned on machines the policy created. Both halves are true.
Digital transformation: what actually changed, and how to read what comes next	网络Operations & Fieldcraft	Transformation is not the technology arriving. It is the moment a capability stops being remarkable and becomes assumed. A look at what genuinely changed across money, work, health, and the state, and then an honest method for reading predictions, including a deadline that is real and moving at the same time.
How the internet gets shut down, and who can actually do it	网络	There is no off switch, but there are chokepoints: cables, routing, exchanges, and the small number of companies most traffic passes through. A tour of the mechanisms, what each state can genuinely do with them, and the uncomfortable conclusion that watching everything is easier than switching anything off.
Who actually governs the internet in Brazil	网络	Brazil built one of the world's most distinctive internet governance models: multistakeholder before that was a word, with a research foundation running the country's first connection and a committee that is not a ministry. The organs, the laws, the state computing backbone underneath it all, and the 2025 ruling that rewrote platform liability.
Amateur radio: callsigns, modes, and why it still matters	网络	A callsign is an identity issued by treaty, readable anywhere on earth. What the letters and the digit mean, how PY2 says São Paulo, the difference between voice and CW and digital, what a repeater actually does, and why a hobby older than broadcasting is still the fallback when everything else fails.
The data communications window, 1968 to 1972	网络	A regulator opened a market. The Carterfone decision let equipment AT&T had not built attach to the telephone network, and within four years an industry of modem and multiplexer companies existed that could not have existed before. The trigger, the window, the products that defined it, and why it closed.
The networking window, 1979 to 1982	网络	Corporations had bought computers for a decade and now needed them to talk to each other inside a building. The window that opened around 1979 produced local area networks and the data PBX, settled a contest between two answers to the same problem, and closed once the answer was obvious.
The radio spectrum: which frequencies go how far, and why	网络	Why a shortwave signal crosses an ocean on 100 watts while your Wi-Fi struggles through a wall. The bands from VLF to EHF, the three propagation modes that explain nearly everything, and the trade that governs all radio: reach or capacity, never both.
The internetworking window, 1984 to 1988	网络	The previous window's success created this one's problem: buildings full of local area networks that could not reach each other. Bridges and routers answered it, a standards war ran alongside, and two trade shows in 1988 made the outcome visible before the argument was formally over.
The two shows of 1988	网络	One trade show put competing vendors' equipment on a single live network in public, where failure would be seen. The other showed an ecosystem that was largely described rather than shipped. The standards argument was formally undecided and a buyer walking both floors did not need it settled.
The founders who kept founding	网络	Reading this industry as a sequence of companies misses that it is substantially the same population of people, recombining. Ungermann left Intel for Zilog and Zilog for Ungermann-Bass; Metcalfe left Xerox for 3Com. What that pattern explains, and what it does not.
BFD: when a link is up and dead at the same time	网络Operations & Fieldcraft	Bidirectional Forwarding Detection (BFD) is a small Hello protocol between two forwarding engines that notices a path has stopped carrying packets, including when both interfaces stay up, long before a routing protocol's own timers would. After reading, you can compute a detection time from the two timers and the multiplier, read a session in FRRouting field by field, choose which protocol should be its client, and say where BFD itself can be fooled.
Sizing BFD timers: the arithmetic of detection	网络Operations & Fieldcraft	Bidirectional Forwarding Detection (BFD) never sends its detection time: each receiver computes it from the other side's multiplier and the interval the two sides agree, separately in each direction. After reading, you can work backwards from a detection target to intervals and a multiplier, predict both directions of a session from its six configured numbers, and recognise the slow start, jitter, hardware and Echo effects that stretch the result.
First-hop redundancy: VRRP, HSRP, and the gateway that is a fiction	网络Operations & Fieldcraft	First-hop redundancy protocols such as VRRP and HSRP let several routers share one default gateway address and one virtual MAC address, so that hosts keep forwarding when the router behind that address fails. After reading, you can say what a host can and cannot do on its own, compute a VRRPv3 failover time from priority and interval, compare HSRP's defaults, recognise the usual failures and the attack surface, and find both protocols in a capture and in router output.
Multicast: what it costs to not flood	网络Operations & Fieldcraft	IP multicast sends one datagram to a group address and lets the network make the copies, and the price is state in every switch and router that must know where the members are. After reading, you can map a group address to its media access control (MAC) address, compute the Internet Group Management Protocol (IGMP) timeouts, explain why a switch floods multicast and what a missing querier does, read Protocol Independent Multicast (PIM) state in FRRouting, and say what Source-Specific Multicast removes.
Public DNS resolvers: what you are actually choosing	网络Web & HTTPOperations & Fieldcraft	A public resolver is a recursive resolver anyone may use, and switching to one hands the operator every name your device looks up. What separates 1.1.1.1, 8.8.8.8, 9.9.9.9 and 208.67.222.222 is policy, not speed: what is logged and for how long, which addresses filter and how a block answers, whether DNSSEC is validated, whether your subnet is passed to authoritative servers, and which encrypted transports are offered. After reading, you can read an operator's pages against the list RFC 8932 asks it to publish, choose by those criteria, and test each one with dig and curl.
Python as a network engineer's calculator: the standard library already knows your arithmetic	网络Operations & Fieldcraft哈希与加密	Subnet splits, route aggregation, wildcard masks, EUI-64, a DNS header in bytes, an HMAC, a p95 of latency samples, a transfer time at line rate: each is a few lines of Python with nothing installed, because ipaddress, struct, hmac, statistics and re ship with the interpreter. This article walks the twelve examples the Python playground opens with, says which module does the work in each and why it is the right one, points at the pitfalls (hosts() on a /31, round-half-even, the universal/local bit), and shows where the same answers come from by hand on this site's other tools, so you can check one against the other.
HTTP, from the request line: what a message means, and how it travels	网络Web & HTTP	Every HTTP exchange is two messages, a request and a response, and since June 2022 the standard describes them in two layers: what a message means (methods, status codes, header fields), defined once for every version, and how its bytes travel, defined for each version on its own. The map of the HTTP series: which article reads which part of a message, and in what order.
The family histories: twenty-three technologies, each read from its first day	网络	Twenty-three of the technologies a network and its security are built from, from the transceiver to the web application firewall, each told as a family history: the dated moment it began and the people in it, the argument that decided what it became, what it did to jobs and practices, and where it goes. How the histories are told, what to look for in each, and an order to read them in.
The Ethernet frame, field by field: preamble to FCS, the 802.1Q tag, and the sizes that matter	网络	Every Ethernet frame is the same short sequence of fields: a preamble to wake the receiver, two addresses, one field that is either a length or a type, the payload, and a checksum. What each field holds, why the minimum is 64 octets and the maximum 1518, where the 802.1Q tag goes and what it carries, and why jumbo frames are not in the standard.
VLANs and 802.1Q trunking: tagged, untagged, native, and the voice VLAN	网络	A VLAN turns one switched network into several that cannot hear each other's broadcasts, and 802.1Q is how a single cable carries many of them at once. Access and trunk ports in the standard's own terms, the native VLAN and the mismatch that loops a network, the VLAN-hopping attacks and the settings that stop them, the voice VLAN behind every desk phone, and why traffic between VLANs always needs a router.
Spanning tree in one article: why a blocked port is the feature, and how RSTP and MSTP made it fast	网络	Redundant links between switches make loops, and Ethernet has nothing in its header to stop a frame circling forever. The Spanning Tree Protocol solves it by electing a root and blocking every port the tree does not need. The election, the costs and the timers, the 30 to 50 seconds classic STP took to recover, the handshake that made RSTP fast, the regions and instances of MSTP, Cisco's per-VLAN variants and guards, and the engineer who wrote the algorithm's abstract as a poem.
Link aggregation and LACP: several links that act as one, and the protocol that keeps them honest	网络	A link aggregation group bundles parallel Ethernet links into one logical link for more bandwidth and for resilience. Where the standard came from (802.3ad, then 802.1AX), how LACP lets both ends agree before a single frame is sent, the fast and slow timers, why static bundles are risky, why one flow never goes faster than one member link, the rules members must follow, multi-chassis bundles, and the Linux bonding modes.
Ethernet physical layers, from 10BASE-T to 400GBASE: naming, auto-negotiation, duplex, and the mismatch that cripples a link	网络	Ethernet is one frame format over dozens of physical layers, from 10 Mb/s on telephone-grade copper to 400 Gb/s on parallel fibre. How to read a name like 100GBASE-SR4, the amendments that brought each speed, what copper needs to reach 100 metres, how bits become signals, why full duplex ended collisions, what auto-negotiation settles, and how one side fixed at full duplex while the other negotiates produces the classic duplex mismatch.
Fibre basics: multimode and single-mode, the grades and their colours, connectors and polarity, the loss budget, and why dirt is the first suspect	网络	Optical fibre carries Ethernet's longer and faster links. The two kinds of fibre and why a wide core limits reach; the OM and OS grades and the jacket colours that tell them apart; how far one optic reaches on each grade; LC, SC and MPO connectors; flat and angled end faces and why they must never be mated; transmit-to-receive polarity; the loss budget worked through with real numbers; dirt, inspection and cleaning; the light you cannot see; and the readings the optic reports about itself.
Dynamic routing compared: distance vector, link state and path vector	网络	Every dynamic routing protocol answers the same question, where to send a packet next, and the families differ in what each router is told and what it works out for itself. Distance-vector routers trade their tables with their neighbours; link-state routers flood a map and each computes its own tree; path-vector routers carry the list of networks a route has crossed; EIGRP's DUAL refines distance vector until it is loop-free at every instant. What each knows, how each keeps loops out, how fast each recovers, and where RIP, OSPF, IS-IS, BGP and EIGRP sit, read from their RFCs.
Route redistribution and the loops it invites	网络	Redistribution is a router announcing in one routing protocol the routes it learned from another, or from its own static and connected routes. Every network with more than one protocol needs it, and it is the commonest way to build a routing loop by configuration. What the standard requires, why metrics have to be invented on the way in, how administrative distance turns two redistribution points into a feedback loop, and the fixes that work: filters, tags, one-way redistribution and a default route, read from RFC 1812, the OSPF and RIP specifications and Cisco's own examples.
BOOTP and DHCP options: what a client asks for, and what it is told	网络	Name every field of the packet that BOOTP defined in 1985 and that DHCP still sends, and say how DHCP turned its last field into a list of options. Decode an option from the magic cookie to the end marker, say what the common options carry and which side sends them, and use the IANA registry to tell a standard code from a private one when a capture or a server log shows a number you do not recognise.
The DHCP relay agent: one server for many subnets	网络	A DHCP client that has no address yet broadcasts its request, and the server it needs is usually on another network. The relay agent receives that broadcast, marks it with the address of the subnet it came from, sends a new message to the server and carries the reply back. After reading you can follow both messages step by step, explain giaddr, the hops field, the BROADCAST flag and option 82, configure ip helper-address on Cisco IOS, and work through a remote subnet that gets no lease.
PXE and network boot: how a machine with no disk finds what to run	网络	A machine with no operating system, or no disk at all, can still boot by asking the network for an address and for the name of a program to download and run. After reading, you will be able to follow a PXE boot from the first DHCPDISCOVER to the first instruction executed, read the options that identify the client, explain why Proxy DHCP listens on port 4011, choose the right boot file for BIOS and UEFI machines, and place the IPv6 and HTTP successors of the 1999 design.
TFTP: the simplest file transfer, and where it still runs	网络Web & HTTP	The Trivial File Transfer Protocol moves one file over UDP in 512-byte blocks, one block in flight and one acknowledgement each, with no login and no directory listing. After reading, you can follow a transfer packet by packet from port 69 to the last short block, explain the Sorcerer's Apprentice Syndrome and the options that negotiate block size, timeout, file size and window, and say where the protocol still runs and what to check when a transfer stalls.
Zone transfers and NOTIFY: how secondary name servers stay in step	网络	Every DNS zone has to be served by at least two authoritative servers, and their copies have to agree. After reading you will be able to read the timers in a zone's SOA record and predict when a secondary polls, recognise an AXFR, IXFR or NOTIFY exchange in a packet capture, explain why transfers are restricted and encrypted, and check with dig whether a zone's servers carry the same serial.
DNSSEC end to end: from the root's key to a validated answer	网络	After reading, you can follow a DNSSEC validation from the root's trust anchor down to a signed answer, name the record that carries each link, and say why a resolver returned SERVFAIL, an ad flag, or nothing special at all. You will also know which root key is signing today, which algorithms the IANA registry still allows, and how to check a validation yourself with dig and delv.
DoT, DoH and DoQ compared: encrypting the question	网络	Classic DNS sends every question in the clear, and the leg between the stub resolver and the recursive resolver is where an eavesdropper learns the most. DoT, DoH and DoQ encrypt that leg in three different ways. After reading you can say what each one hides and what none of them hides, read their ports and framing, tell a Strict profile from an Opportunistic one, explain how a client discovers an encrypted resolver, and choose a transport for a given network with the standards' own reasons.
Anycast: one address in many places	网络	Anycast announces one service address from many independent places and lets the routing system decide which one each client reaches. After reading you can define it in the words of RFC 1546 and BCP 126, explain why nearest means nearest in the routing table rather than on the map, say why DNS over UDP suits it and TCP strains it, read the root server list on root-servers.org, and run a dig query that reveals which instance answered you.

证书与 PKI (15)

Article	Topic	Summary
X.509 证书的解剖	证书与 PKI	一个 TLS 证书内部活着什么、ASN.1/DER 字节如何构造、v3 扩展实际控制什么，以及为何解码一个证书与信任它并不相同。
PEM、DER 与证书文件格式	证书与 PKI	为何同一份证书以如此多的文件形态出现、PEM 与 DER 实际是什么，以及 .crt、.pem、.pfx 与 .p12 真正持有什么。
证书签名请求与证书如何被颁发	证书与 PKI	一份 CSR 包含什么、为何你的私钥从不离开你的机器、一个 CA 如何验证并颁发，以及 ACME 如何自动化整个交换。
Certificate chains: the order, the anchor, and what breaks them	证书与 PKI	A server certificate is only the last link. How a client builds the path from the leaf to a root it trusts, why the order of the Certificate message matters and what TLS 1.3 relaxed, why the root is normally left out, how key identifiers and names link one certificate to the next, what pathLenConstraint, cA and keyCertSign forbid, why a cross-signed root appears in a chain as if it were an intermediate, and why the same chain works in one browser and fails in another. With RFC 5280, RFC 8446, the Baseline Requirements and a live Let's Encrypt chain.
证书验证实际如何运作	证书与 PKI	一个客户端为判定一份证书可信而运行的步骤：构建链、核查签名与日期、匹配名字，以及强制约束。
证书吊销：CRL、OCSP 与短寿命证书	证书与 PKI	为何一份证书有时需在其过期之前被取消、为何经典的吊销系统运作不佳，以及为何业界转而缩短证书的寿命。
Authority Information Access: The OCSP and CA Issuers URLs	证书与 PKI	The AIA extension carries two kinds of pointer: where to ask whether a certificate is revoked (OCSP) and where to fetch the issuer's own certificate (CA Issuers). What each is for, why they are easy to confuse, and what the inspector shows.
OCSP Must-Staple: Closing the Soft-Fail Gap	证书与 PKI	Real-time OCSP checking has a fatal weakness: when the responder is unreachable, clients usually proceed anyway. OCSP stapling and the Must-Staple flag are the fix. What the TLS Feature extension declares, and the operational risk it carries.
ACME: how certificates issue and renew themselves	证书与 PKI	How the ACME protocol automates certificate issuance end to end: the account, the order, the three challenge types, the dns-01 record you publish, and the finalize-and-download step that produces the certificate.
The 47-day era: how TLS certificate lifetimes are shrinking	证书与 PKI	The CA/Browser Forum's SC-081v3 schedule takes maximum public TLS validity from 398 days down to 47 by 2029, in three steps. What the phases are, why 47, and what it does to renewal volume.
Certificate validity windows: notBefore, notAfter, and renewal lead time	证书与 PKI	How a certificate's lifetime is defined by two timestamps, how that length is measured against the cap, why validity is not the same as time remaining, and how to choose a renewal lead time.
Let's Encrypt: the free CA and its rate limits	证书与 PKI	What Let's Encrypt is, why its certificates are short-lived, and how its rate limits actually work: the per-registered-domain and per-account limits, the exact-set and authorization-failure limits, and why ARI renewals are exempt from all of them.
DCV and SII reuse: the validation cadence behind the renewal cadence	证书与 PKI	Issuing a certificate means proving domain control and, for OV/EV, organization identity. SC-081v3 shrinks how long those proofs can be reused, DCV to 10 days by 2029, which reshapes renewal as much as validity does.
Renewing before expiry: lead time, ACME, and ARI	证书与 PKI	Why late renewal causes outages, how ACME automates issuance and renewal, how the ARI extension lets a CA steer the renewal window, and how to pick a lead time that leaves room to retry.
Public vs private PKI: which certificates SC-081v3 governs	证书与 PKI	The 47-day schedule binds publicly trusted TLS certificates only. What separates public from private PKI, why internal CAs are exempt, and how to read the planner's compliance verdict for an internal certificate.

Operations & Fieldcraft (20)

Article	Topic	Summary
From First Symptom to a TAC Case That Does Not Bounce	Operations & Fieldcraft	Five steps that never name a root cause. The discipline is keeping what you observed separate from what you concluded, because an escalation that mixes them is an escalation that comes back asking for the difference.
Planning a Change, and the Step Everyone Skips	Operations & Fieldcraft	Map the reach, write the runbook with its rollback, then compare health before and after. The third step is the one that gets dropped, and it is the only one that can tell you the change did what you said it would.
Git: the content-addressed database wearing a version-control suit	Operations & Fieldcraft	What Git actually stores (snapshots, not diffs), why a branch is just a 41-byte pointer, how the three areas explain almost every confusing command, and what made a two-week side project the industry's default in fifteen years.
GitHub: the pull request was the product	Operations & Fieldcraft	Git solved copying; GitHub solved coordinating. How a 2008 Rails app turned the emailed patch into a reviewable conversation, made a profile into a résumé, accreted a platform around the repository, and became the largest code host in the world without ever owning the protocol underneath it.
Terminal, shell, TTY, console	Operations & Fieldcraft	Four words used interchangeably by almost everyone, including the documentation. They name four different things, and the distinction explains why Ctrl+C kills your command but not your shell.
What a Channel Systems Engineer Actually Does	Operations & Fieldcraft	Inside a distributor there is a role almost nobody outside the channel can describe: the systems engineer who supports resellers rather than customers. Bill of materials work on every project that passes through, proofs of concept, presentations, enablement, bootcamps, trade shows. Some of the resellers being supported have no technical staff at all, which is the fact that explains the rest of the job.
What a network operating system actually is	Operations & Fieldcraft	IOS, Junos, EOS, TMOS, FortiOS, PAN-OS and the rest, compared on the axes that matter: what they run on, how components share state, where the planes divide, and what happens when one part fails.
The path a product takes, and the jobs along it	Operations & Fieldcraft	Between the company that builds a thing and the person who depends on it, a product passes through many hands. Each pair belongs to a job with its own clients, suppliers, accountability and measurement, and the measurement is rarely the same as the accountability.
cron: five fields that run the world's chores	Operations & FieldcraftText & utilities	Every Unix box carries a scheduler whose entire language is five columns of numbers and stars. How to read them, the OR rule that catches almost everyone, why 0 and 7 are the same day, what the @ macros expand to, and the local-time reality behind every projected run.
Open source, and the two meanings of free	Operations & Fieldcraft	English overloads one small word, and forty years of software history hang on the ambiguity. The four freedoms, the 1998 rebrand that created 'open source', copyleft versus permissive, why gratis is not libre, and why Portuguese speakers never had this problem in the first place.
Decided in advance: the five practices the failures argue for	Operations & Fieldcraft	Two companion pages collect what broke and what got said. This one is the third question: what has to be decided before anything happens, because it cannot be decided during. Five practices, each paired with the case that demonstrates the cost of not having it - a baseline, a blast radius, a change window, a restorable backup, and a boundary.
How to independently review a network architecture before approving it	Operations & Fieldcraft	A design arrives with a diagram, a bill of materials and a date. Approving it is a decision with years of consequences, and the material in front of you was prepared by people who want it approved. A method for reading it on your own terms: what to ask for before you start, the seven questions that find most problems, how to separate what the design says from what it assumes, and what a written review should contain so the approval survives the person who gave it.
How to find the hidden assumptions in an architecture diagram	Operations & Fieldcraft网络	A diagram shows what was decided and hides what was assumed. The boxes are products, the lines are intentions, and the things that will actually fail, the shared dependency, the unmeasured peak, the function nobody owns, the path that only works one way, are not drawn because nobody thought of them as decisions. Eight places assumptions hide in a diagram, the questions that bring each one out, and the register that turns a reading into something the organisation can act on in year three.
What should be in a post-incident technical review	Operations & Fieldcraft	After a serious outage somebody has to write down what happened, and the document that results is usually either a defence or a prosecution. A technical review is neither. It is written for people who were not there, it keeps what was observed apart from what was concluded, it names the conditions that made the failure possible rather than the person who touched the keyboard, and it ends in changes that can be checked. What such a review contains, who should write it, and the three kinds of review that must not be confused.
How to separate product limitations from architecture failures	Operations & Fieldcraft	When something fails, the first explanation on the table is the product, because the product has a vendor and the vendor has a support line. Often the product did exactly what it was built to do, inside a design that asked it to do something else. Telling the two apart matters, because the fix for a product limitation is a case, a patch or a replacement, and the fix for an architecture failure is a change to the design, and buying a new product to fix a design is the most expensive way to keep the problem. A method for making the distinction, with evidence.
What executives should ask before approving a network transformation	Operations & Fieldcraft	A transformation programme arrives at the executive table as a vision, a supplier, a budget and a date, and the technical detail underneath it is exactly what the people at the table were hired not to need. They do not need it. They need twelve questions whose answers tell them whether the detail was done, who is carrying which risk, what the organisation will be unable to undo, and what the first ninety days will cost in attention. The questions, why each one matters, and what a good answer sounds like.
File modes, read the way the kernel reads them: octal, symbolic, and the three bits most people skip	Operations & Fieldcraft编码与数据	A Unix file mode is twelve bits, and almost every permission mistake comes from reading nine of them. Where 755 comes from, why ls prints an s or a T, what set-user-ID, set-group-ID and the restricted deletion flag do on a file and on a directory, how a chmod clause with no class is quietly filtered through the umask, why X is not x, and the GNU rule that keeps a directory's set-group-ID bit when you type chmod 755. From POSIX.1-2024 and coreutils 9.11, with the calculator to try each case.
Reading a syslog message field by field: what a parser checks, and where each rule comes from	Operations & Fieldcraft网络	An RFC 5424 message is seven header fields, a structured-data block and a free-text tail, and every one of them has a rule a parser can test: the leading-zero rule of the PRI, the upper-case T and Z of the timestamp, the 48-character APP-NAME, the escapes inside structured data, the byte order mark that announces UTF-8, the 480 and 2048 octet lines, and the two ways a message is framed on TCP. Read from the RFCs themselves, with the parser that applies each rule as you go.
Log levels across systems: one scale, many ladders	Operations & Fieldcraft网络	Syslog counts down from 0, Python counts up in tens, Log4j gives FATAL the smallest number and TRACE the largest, Windows puts Critical at 1 and java.util.logging puts SEVERE at 1000. Every system has a ladder, no two ladders agree on direction or spacing, and the same word lands in different places. OpenTelemetry's SeverityNumber is the one scale written to hold them all, and this article walks the ten ladders the mapper knows, where each rung lands, and where the mapping is a judgement rather than a fact.
Accounting: who did what, to which device, and when	Operations & Fieldcraft	The third A of AAA as an engineering design rather than a checkbox: the four record streams that together answer the question asked after every outage and every intrusion, RADIUS accounting from RFC 2866, TACACS+ command accounting from RFC 8907, syslog from RFC 5424 and the device's own configuration change log, plus configuration backups that show what the commands did; what each record contains, field by field; the NIST SP 800-53 controls that say what a record must establish; the clocks, retention, correlation keys and separation of duties that make the records usable; and the oldest finding in the field, the device that was never told where to send them.

Security & WAF (126)

Article	Topic	Summary
HTTP Security Headers: The Defense-in-Depth Layer	Security & WAF	What HTTP security headers are, why they form a layer of defense on top of secure code rather than a replacement for it, the headers that carry the most weight, and how to read a response's posture at a glance.
Regex Quantifiers and Character Classes	Security & WAFWeb & HTTP	A regular expression is built from two questions: what character do I want, and how many of them? Character classes answer the first, quantifiers answer the second. Get these two right and most of regex falls into place.
SAML 2.0: How Browser SSO Works	Security & WAF身份与令牌	What a SAML assertion is, the roles of the identity provider and service provider, the SP-initiated Web Browser SSO flow end to end, and the difference between the HTTP-POST and HTTP-Redirect bindings that carry the messages.
The Fingerprint That Broke, and the One Its Author Wrote to Replace It	Security & WAF	Chrome started shuffling its TLS extensions in 2023 and JA3 stopped identifying Chrome. The fix came from the same person who wrote JA3, and the reason it works is one word: sorted.
Content Security Policy, Directive by Directive	Security & WAF	How CSP works as a control against cross-site scripting and injection: the shape of a policy, why default-src matters, what 'unsafe-inline' and 'unsafe-eval' give away, how nonces and hashes allow specific inline code safely, and what report-only mode is for.
Inside a SAML Assertion: Subject, Conditions, and Audience	Security & WAF身份与令牌	The anatomy of a SAML assertion: the Subject and NameID formats, bearer SubjectConfirmation and the NotOnOrAfter / Recipient / InResponseTo checks, the Conditions validity window, the AudienceRestriction, and the AuthnStatement, with the validation a service provider must perform on each.
Regex Groups, Backreferences, and Lookarounds	Security & WAFWeb & HTTP	Parentheses do far more than set precedence in a regex. They capture text for you to reuse, name the pieces you care about, and, with a question mark prefix, let you assert what comes before or after without consuming it.
A Content Security Policy, read the way the browser reads it	Security & WAFWeb & HTTP	A CSP header is a sentence in a small formal language, and the browser reads it with an algorithm the specification spells out: split on semicolons, lower-case the names, ignore a directive that repeats, read every token of a value against a grammar. Most broken policies break at exactly those steps, and quietly: a keyword without quotes becomes a host name, a missing semicolon folds two directives into one, a default-src that looks protective governs nothing once script-src is set, 'unsafe-inline' beside a nonce is silently ignored. Here is CSP Level 3's own reading, step by step, with the fallback chain, the matching rules for wildcards, schemes and IP addresses, what 'strict-dynamic' switches off, and the three-directive policy the specification itself calls Strict CSP.
Catastrophic Backtracking and ReDoS	Security & WAFWeb & HTTP	Some innocent-looking patterns can take seconds, minutes, or effectively forever on a short string. The cause is catastrophic backtracking, and when an attacker controls the input it becomes a denial-of-service bug. Here is why it happens and how to write patterns that cannot.
HSTS and HTTPS Enforcement	Security & WAF	How Strict-Transport-Security closes the HTTP downgrade window, what max-age, includeSubDomains, and preload each do, the trust-on-first-use gap that preloading removes, and the configuration mistakes that quietly disable it.
SAML Signatures and XML-DSig	Security & WAF身份与令牌	How a SAML message is signed with XML Signature: the enveloped ds:Signature, the SignatureMethod and DigestMethod algorithms, why SHA-1 is weak, the difference between signing the Response and signing the Assertion, and how XML signature wrapping attacks work.
Cookie Security Flags	Security & WAF	How Secure, HttpOnly, and SameSite protect session cookies, what each SameSite value means, why SameSite=None requires Secure, and how the __Host- and __Secure- prefixes enforce those guarantees at the browser level.
Regex Anchors and Boundaries	Security & WAFWeb & HTTP	Anchors match a position, not a character: the start or end of the string, or the edge of a word. They are the difference between a pattern that matches anywhere and one that matches only where you mean. This covers ^, $, \b, and their multiline behavior, plus the mistakes they cause.
XXE and Why a SAML Parser Rejects DOCTYPE	Security & WAF身份与令牌	How XML External Entity (XXE) attacks work, the billion-laughs denial-of-service, why both depend on a DTD, and why a hardened SAML decoder rejects any DOCTYPE or entity declaration outright rather than trying to parse it safely.
Clickjacking and Frame Control	Security & WAF	What clickjacking is, how framing makes it possible, the difference between the legacy X-Frame-Options header and the modern CSP frame-ancestors directive, why ALLOW-FROM is obsolete, and how the two controls interact.
Regex Flags and Modes	Security & WAFWeb & HTTP	A flag changes how the whole pattern matches: case sensitivity, whether ^ and $ see lines, whether the dot crosses newlines, and whether whitespace in the pattern is ignored. The same regex can match completely different things depending on its flags, so knowing them prevents a lot of confusion.
SAML Bindings and SP vs IdP Initiation	Security & WAF身份与令牌	A SAML flow can start at the service or at the identity provider, and the messages can travel by two different bindings: an HTTP redirect with the message packed into the URL, or an auto-submitting HTML form that POSTs it. Which binding carries which message, and where the flow begins, explains a lot of SSO behavior.
The SAML Proxy: Inserting an Identity Layer into a Session	Security & WAF身份与令牌	A SAML proxy sits in the SSO flow rather than the packet path: it terminates the user's request, forces authentication against an identity provider, and only then lets the session through, using SAML's browser-redirect model. It can act as a service provider to the IdP and an identity provider to the app at once (a proxy or broker), which is how one login federates many downstream systems. This explains the roles, the flow, and why it is a proxy at all.
Reading OGNL in a WAF Log: What the Payload Was Trying to Do	Security & WAFWeb & HTTP编码与数据	An OGNL payload in a log has two halves worth telling apart: something that tries to switch off the expression sandbox, and something that tries to run a command. A payload with both is an exploitation attempt. A payload with only the second is usually a scanner working through a list. A payload with neither is a probe checking whether input gets evaluated at all - and that answer decides whether anything else in the list could ever work.
XXE and External Entities	Security & WAF	XML lets a document declare entities, and an external entity can point at a file or URL. A parser that resolves one can be tricked into reading local files or making server-side requests, the XXE vulnerability. The fix is blunt and effective: do not process a DOCTYPE at all.
Billion Laughs and Entity Expansion	Security & WAF	Entities can reference other entities, and if each one multiplies the last, a tiny document can expand to gigabytes and exhaust memory. The billion laughs attack weaponizes this into a denial of service. The defense is to cap expansion or refuse the DOCTYPE outright.
How CVSS Scoring Works	Security & WAF	CVSS turns a short vector string into a 0 to 10 severity number using a fixed formula. The Base score is built from two sub-scores: Exploitability (how reachable and easy the flaw is) and Impact (how bad the outcome is). Everything else refines that base. This is arithmetic, not opinion, which is why a calculator can reproduce any published score exactly.
The CVSS Base Metrics, Explained	Security & WAF	The Base score comes from eight metrics in two families. Four exploitability metrics (Attack Vector, Attack Complexity, Privileges Required, User Interaction) describe how hard the attack is, and four impact metrics (Scope, plus Confidentiality, Integrity, Availability) describe the damage. Scope is the subtle one: it is what lets a score exceed the vulnerable component's own boundary.
CVSS Temporal and Environmental Scores	Security & WAF	The Base score is only the starting point. Temporal metrics lower it as facts emerge, such as a patch being released, and can only reduce the score. Environmental metrics let an organization re-score the flaw for its own systems by raising or lowering the importance of confidentiality, integrity, and availability and by overriding base metrics. Both are optional but produce a more honest number.
Reading a CVSS Vector String	Security & WAF	A CVSS vector is a compact, self-describing string: a version prefix followed by slash-separated metric:value pairs. Learning to read it directly, rather than trusting a rendered score, lets you spot transcription errors and understand exactly what a vendor claimed. The Base metrics are mandatory and the rest are optional.
CVSS Severity Bands, and What the Score Does Not Tell You	Security & WAF	The 0 to 10 number maps to five qualitative bands from None to Critical. That mapping is useful for triage, but a CVSS Base score measures severity, not risk. It says nothing about whether a flaw is being exploited, how valuable the asset is, or what controls you have. Treating the base number as a priority queue is the most common way teams misuse CVSS.
CVSS v3.0, v3.1, and v4.0: What Changed	Security & WAF	This decoder computes CVSS v3.0 and v3.1. The two v3 releases share a formula but differ in rounding and one environmental term, so scores can differ by a tenth. CVSS v4.0, released in 2023, is a larger redesign with new metric groups and no Scope metric, and its vectors are not compatible with v3 tooling. CVSS v2 is retired.
Passive TLS Fingerprinting: JA3, GREASE, and the Churn That Led to JA4	Security & WAF	A ClientHello announces the client in the clear, and the combination of versions, ciphers, and extensions is characteristic of the software that sent it. This covers how JA3 turns that into a hash, why GREASE has to be stripped, how extension-order randomization broke JA3 (the churn), how JA3N and JA4 restore stability, and where a TLS fingerprint fits as a signal for secure web gateways and adaptive authentication.
What Is Server-Side Request Forgery (SSRF)	Security & WAF	SSRF is a vulnerability where an attacker makes a server issue an HTTP request to a destination of the attacker's choosing. Because the request originates inside the server's network, it can reach internal services, cloud metadata, and loopback addresses that the attacker could never reach directly. The fix is to validate the destination, not the URL string.
Private, Reserved, and Public IP Ranges	Security & WAF网络Web & HTTP	IANA records every special-purpose IPv4 and IPv6 block, from loopback, link-local and private-use space to shared address space, documentation and the translation prefixes, and two columns of its registries, Destination and Globally Reachable, decide whether an address is a public destination. After reading, you can read those columns, classify an address only after turning its spelling into the number a client connects to, explain how a public destination can still lead inside through a second DNS lookup or a redirect, name the cloud metadata addresses, and test an SSRF filter.
IP Address Obfuscation Tricks	Security & WAF	One IP address can be written in many forms: plain decimal, octal, hexadecimal, short-hand, and IPv4-mapped IPv6. Each form parses back to the same address, which is how attackers slip an internal target past a filter that only blocks the dotted-decimal spelling. This is why SSRF checks must decode, not string-match.
Cloud Metadata Endpoints and SSRF	Security & WAF	Every major cloud gives an instance a metadata service at a fixed link-local address, and it can return temporary credentials for the instance's role. That makes it the single highest-value SSRF target. Knowing the endpoints, and the IMDSv2-style defenses, is essential for both attack understanding and defense.
Defending Against SSRF with Allow-Lists	Security & WAF	The durable SSRF defense is an allow-list of intended destinations, combined with resolving the address before you trust it and re-checking after redirects. Block-lists of internal ranges help, but they lose to obfuscation and DNS rebinding. This is the layered approach that holds up.
Dangerous URL Schemes in SSRF	Security & WAF	SSRF is not limited to http. Schemes like file, gopher, dict, and ftp let an attacker read local files or craft raw bytes to internal services such as Redis and SMTP. A URL fetcher that does not restrict the scheme hands an attacker a far more powerful primitive than a plain web request.
SSL Forward Proxy: How Outbound TLS Interception Works and What Breaks It	Security & WAF证书与 PKITLS 与传输	To inspect encrypted outbound traffic, a forward proxy performs a controlled man-in-the-middle: it terminates the user's TLS session, opens its own to the real server, and forges a certificate for that server signed by a private CA the organization's own devices trust. This explains the mechanics, the trust model that makes it safe (and dangerous), and why pinning, HSTS, and mutual TLS defeat it.
The LGPD for Engineers: The Vocabulary That Matters	Security & WAF	Brazil's data protection law assigns you a role, gives you ten legal bases instead of one, and puts a three-working-day clock on breach notification. What controlador, operador, and encarregado mean when you are the one running the systems.
Hacking in the 20th century: a field guide to the people who took things apart	Security & WAF	From a blind boy whistling into a telephone in the 1960s to seven hackers testifying to the US Senate under their handles in 1998 - the whole arc, in one place. Who the people were, what they actually did, which stories are true, and how a criminalised subculture ended up building the security industry that now employs it.
Passive Fingerprinting: What You Emit Without Being Asked	Security & WAF网络	Every connection announces its stack before a byte of application data flows. How a TCP SYN, a User-Agent string, and the mere order of HTTP headers each identify a client - and why a mismatch between them is the classic proxy and bot tell.
Phreaking: the network that whistled its own passwords	Security & WAF	Before anyone hacked a computer, they hacked the phone company - because the long-distance network carried its control tones on the same wire as the voice, and a toy whistle from a cereal box happened to sing the magic frequency. Joybubbles, Captain Crunch, the Esquire article that lit the fuse, the blue box two kids named Steve sold before they founded Apple, and the architectural lesson the industry paid dearly to learn: never put the control plane in the data plane.
The Morris Worm: the night the internet found out it was fragile	Security & WAF	On 2 November 1988 a Cornell graduate student released 99 lines of C to measure how big the internet was. A single arithmetic decision about reinfection turned the measurement into the first internet-scale disaster, birthed the CERT system, produced the first conviction under the brand-new Computer Fraud and Abuse Act, and taught the network a lesson about monoculture and trust it is still relearning.
The Cuckoo's Egg: 75 cents, ten months, and the invention of incident response	Security & WAF	In 1986 an astronomer was handed a trivial accounting discrepancy and told to find it. He followed it through a Berkeley lab into US military networks and out the other side to a West German hacker selling access to the KGB - improvising, along the way, the logbook, the timeline, the honeypot and nearly every reflex the profession now teaches.
Kevin Mitnick: the myth, the man, and what the case actually decided	Security & WAF	He was called the world's most dangerous hacker, held for years without trial, and forbidden to touch a telephone unsupervised - on the strength of claims that could not survive contact with the record. The real story is smaller and far more useful: a social engineer of extraordinary skill, a press narrative that became a prosecution, and a case that shaped how computer crime is charged and how researchers are treated to this day.
Kevin Poulsen: the man who won a Porsche by owning the phone company	Security & WAF	Dark Dante took over every incoming line at a Los Angeles radio station to guarantee he was caller 102, and drove away in a Porsche. He was also a defence contractor by day, the first American charged with espionage for a computer crime, and - after five years in prison - the editor who broke some of the biggest security stories of the 2000s and co-built a leak system for journalists.
The 414s and the summer of 1983: the year hacking became a crime	Security & WAF	Six Milwaukee teenagers with modems wandered into a cancer hospital, a bank and a nuclear weapons laboratory. WarGames opened the same summer. Newsweek put a hacker on the cover, Congress held hearings with the movie playing on a screen, and within three years the United States had the law under which computer crime is still prosecuted.
The Chaos Computer Club, the Btx heist, and the hack that ended in a forest	Security & WAF	Germany's hacker scene took a different road from America's: organised, political, and arguing in front of cameras. In 1984 the Chaos Computer Club moved 134,000 marks out of a bank overnight and gave it back on television. Four years later, a different Hanover crew sold their intrusions to the KGB, and one of them died in a forest at twenty-three.
LOD, MOD and Operation Sundevil: the Great Hacker War and the raid that created the EFF	Security & WAF	Two crews fought over the American telephone network for pride. Then the Secret Service arrived in fourteen cities, seized a role-playing game manuscript as a hacking manual, and prosecuted a magazine over a document that could be ordered for thirteen dollars. Both cases collapsed, and out of the wreckage came the Electronic Frontier Foundation.
Phrack, 2600 and the underground press: how the scene published itself for fifty years	Security & WAF	A Yippie newsletter about cheating the phone company in 1971. A three-sheet quarterly with a circulation of twenty-five in 1984. A St. Louis bulletin-board zine that shipped its first issue in November 1985 and its seventy-second, in fifteen thousand printed copies, in August 2025. Before conferences, bug bounties or a security industry, the scene had a press - and the press paid, in raids, indictments and injunctions, for what it printed.
L0pht, cDc, and the year the underground walked into the Senate	Security & WAF	In May 1998 seven hackers testified to the United States Senate under their handles and said they could take down the internet in thirty minutes. Two months later the Cult of the Dead Cow released Back Orifice on a DEF CON stage to force Microsoft's hand. Between them, 1998 is the year the scene stopped being a subculture and started becoming an industry.
The Electronic Frontier Foundation: the lawyers who built a codebreaking machine and a certificate authority	Security & WAF	It began with an FBI agent in a Wyoming ranch kitchen in 1990. It established that source code is speech, built the machine that ended DES, put the room on Folsom Street into a courtroom, and then stopped suing long enough to write the software that made HTTPS the default. This is what a civil-liberties organisation did to the network engineer's daily work.
The manifestos: the Mentor, the cypherpunks, the Declaration, and the texts a culture wrote about itself	Security & WAF	Four hundred and fifty words typed by a nineteen-year-old the night after his arrest in 1986. A crypto-anarchist's pastiche of Marx read to a conference in 1988. Seven paragraphs on privacy in 1993, sixteen on independence from a hotel in Davos in 1996, and a page written in Italy in 2008 that a prosecutor would later read aloud. What the hacker culture's founding texts say, why each was written when it was, and where to read them in the original.
The named TLS attacks, 2011-2023: what each one broke, and what the protocol removed because of it	Security & WAF	BEAST, CRIME, Lucky13, Heartbleed, POODLE, FREAK, Logjam, DROWN, SWEET32, SLOTH, ROBOT, ROCA, Raccoon, ALPACA, Terrapin. Fourteen names, twelve years, one pattern: each attack found a feature the protocol should never have kept, and TLS 1.3 is the list of what was taken away. This is the guide to reading a cipher-suite report as history.
The WANK worm and the International Subversives: the Australian chapter	Security & WAF	Days before NASA launched a plutonium-powered probe, its computers greeted operators with an anti-nuclear protest banner. The first hacktivist worm was never definitively attributed, but the trail points to a Melbourne scene that also produced the book Underground - researched by a young hacker called Mendax, who later founded WikiLeaks.
DEF CON: a farewell party that became an institution, and the red shirts who run it	Security & WAF	It started in 1993 as a going-away party for a friend's bulletin board network. Thirty years on it fills Las Vegas with tens of thousands of hackers, runs on cash at the door, and is held together by unpaid volunteers in red shirts who pay their own way to be there. The Goons are the reason it works, and the reason it still feels like a community rather than a trade show.
EternalBlue, WannaCry, NotPetya: the year a stolen exploit went to work for everyone	Security & WAF	In April 2017 an anonymous group published a working NSA exploit for a protocol running on every Windows machine in the world. Microsoft had patched it a month earlier. Within eight weeks it powered the two costliest cyber incidents in history - one stopped by a researcher who registered a ten-dollar domain, the other unstoppable because it was never meant to be stopped.
Stuxnet: the first cyberweapon, and the day code broke machinery	Security & WAF	A worm carrying four unknown Windows exploits crossed an air gap into an Iranian enrichment plant, spun centrifuges to destruction, and played recorded normal readings to the operators watching the screens. It was found only because it escaped. Everything about state cyber operations since - including the leaks that armed the world - starts here.
The RFC series: how the internet writes itself down	Security & WAF	In April 1969 a graduate student wrote up some notes about host software and, worried about sounding presumptuous, called them a Request for Comments. Nine thousand documents later that hedge is still the name of the process by which every protocol you operate was agreed. What an RFC is, what its status actually means, and why the numbering has an April Fools tradition.
Anonymous, LulzSec and the hacktivist decade	Security & WAF	A leaderless collective from imageboard culture became the public face of protest hacking, defended WikiLeaks, joined the Arab Spring, and then splintered into a six-person crew that breached Sony, PBS and an FBI affiliate in fifty days - while its leader was already an informant. The decade that followed defined what a movement with no accountability structure can and cannot do.
The protocol wars: how TCP/IP won against everyone's expectations	Security & WAF	Every government, every telephone company, every major computer manufacturer and the US Department of Defense backed OSI. The specification was more complete, more rigorous, and formally agreed by the world's standards bodies. It lost to a protocol suite designed by graduate students and given away free, and the reason it lost is the most useful lesson in this catalogue for anyone choosing a technology today.
The Crypto Wars: thirty-three years of the same argument	Security & WAF	In 1993 a government proposed a telephone chip whose encryption was strong and whose keys it kept a copy of. The proposal died in three years. The argument did not: it returned as export control, as a standards backdoor, as a court order against a phone manufacturer, and as a secret notice to a cloud provider that is still before a tribunal. Every round asks whether exceptional access can be added to a secure system, and every round gets the same engineering answer.
The Crypto Wars: when encryption was a munition	Security & WAF	For most of the 1990s, exporting strong cryptography from the United States was legally equivalent to exporting a weapon. A programmer gave away an encryption tool and faced three years of criminal investigation; a T-shirt with four lines of code on it was an export-controlled item; and the government proposed a chip that would encrypt your calls while keeping a copy of the key. The fight over that decade decided whether the modern web could exist.
2011: the year the trust anchors broke	Security & WAF	In March a spear-phishing email with an Excel attachment reached the company whose tokens guarded the world's defence contractors. In June a certificate authority trusted by every browser on earth was taken over, and issued 531 fraudulent certificates that were used to read the mail of some 300,000 Iranians. Both were found late, both were disclosed later still, and the second company no longer exists.
The Latin American security conference circuit: an index	Security & WAF	Latin America built its own conference circuit rather than importing one - Ekoparty in Buenos Aires since 2001, H2HC in São Paulo since 2004, DragonJAR in Colombia, 8.8 in Chile, RoadSec touring Brazil's capitals. This is the index: who founded each one, what each is actually for, and how they differ from the northern events they are usually compared to.
Moonlight Maze, Titan Rain, Aurora: the three campaigns that taught the industry a new word	Security & WAF	Between 1996 and 2010 three intrusion campaigns moved the target from government networks, to the contractors that serve them, to the technology companies everyone uses. One was found by accident, one by a man working nights who lost his job over it, and one was announced by the victim on its own blog - a decision that changed how breaches are disclosed and produced the architecture now sold as zero trust.
The Brazilian scene: from Alternex to a conference every month	Security & WAF	Brazil's hacker culture did not start in a dorm room or a phone company - it started in a social-justice NGO that put the country's first public network online, and it grew through BBSs, a world-class fraud underground, an unusually open governance system, and a conference calendar so dense that most weeks of the year have one. What the scene is, how it got here, and what it looks like now.
Brazilian cybercrime: from the boleto to the Pix	Security & WAF	Brazil banked online early, invented payment instruments the rest of the world did not have, and grew a criminal industry precisely shaped to them: barcode manipulation, screen overlays, ATM jackpotting, and now social engineering aimed at instant transfers. The techniques, the crews that exported them, the attacks on the state, and the laws written after each shock.
The worm era, 1999-2008: Melissa to Conficker, and the patch that always existed	Security & WAF	Seven outbreaks in nine years took email, then web servers, then databases, then any reachable Windows machine. In almost every case the fix had shipped weeks or months earlier and had not been installed - and in the last one, Microsoft's bulletin had said in writing that the flaw was wormable. This is the era that produced automatic updates, the on-by-default firewall, and the argument the industry is still having.
There is no perfect code: why security is a clock, not a codebase	Security & WAF	Every vendor of consequence has shipped a flaw that facilitated a breach, and every one of them will again. What separates organisations is not defect density - it is the time between compromise and detection, detection and containment, containment and a definitive fix, and the honesty of what gets said in between. This is the argument, with the evidence, and an open question about what AI does to both sides of the clock.
Why the SSL-VPN is being dismantled, and what is actually replacing it	Security & WAF	FortiOS 7.6.3 removed SSL VPN tunnel mode from every FortiGate, and existing settings are not carried over on upgrade. That is a verified fact with real operational consequences. The claim that every vendor is abandoning SSL-VPN is more complicated, and most of the timelines circulating are published by companies selling the replacement. Here is what is established, what is inference, and what a practitioner should actually do.
WireGuard: the argument that a tunnel should be small enough to read	Security & WAF	About four thousand lines of code, one cipher suite with no negotiation, no user identity, and no way to ask for a weaker option. It was merged into the Linux kernel in 2020 with a public endorsement from Torvalds, and it is the default inside most of the products now sold as zero-trust access. It also cannot do several things an enterprise needs, and knowing which is the point of this article.
Fiddler, Burp, Cain and the rest: the tools that read a conversation they were not part of	Security & WAF	A debugging proxy, a penetration tester's suite, a password recovery program from a one-man Italian site, and a corporate inspection appliance all perform the same operation - terminating a connection the two endpoints believe is theirs. What separates them is not technique but consent and disclosure. Where each one sits, what defeats it, and why the tool everyone learned on has vanished from the web.
Wireshark: the tool that made packets legible, and the stack underneath it	Security & WAF	In July 1998 a network engineer at a small Kansas City provider announced a program he had written because the commercial analysers cost fifteen hundred dollars and did not run on his platforms. Within days strangers were sending patches. It lost its own name to a trademark in 2006, outlived three corporate sponsors, and is now the reason a practitioner can read a protocol they have never met.
KRACK and Dragonblood: what happened after WEP, and why a proven-secure handshake still broke	Security & WAF	WPA2's four-way handshake had been formally analysed and declared secure. In 2017 a researcher at KU Leuven broke it anyway, by making a client reinstall a key it was already using. Its replacement, WPA3, shipped in 2018 and was broken by the same researcher in 2019. Neither failure was in the cipher, and that is the whole lesson.
Reflections on Trusting Trust: the 1984 lecture that predicted every supply chain attack since	Security & WAF	Ken Thompson used his Turing Award lecture to explain how he had put a backdoor in the C compiler that would reinsert itself every time the compiler was rebuilt - and then deleted the evidence from the source. Reading the source would never find it. Forty-two years later there is exactly one method that formally defeats it, and the reason XZ Utils and 3CX worked is that almost nobody uses it.
The Kaminsky flaw: the summer eighty vendors patched the same bug on the same day	Security & WAF	In 2008 a researcher realised that a known weakness in DNS was far worse than anyone had calculated - not a way to poison one record, but a way to take a whole domain in seconds, repeatably. What followed was the largest coordinated patch the internet had ever attempted, a fix that bought entropy rather than certainty, and a reminder that publishing a patch also publishes the vulnerability.
Mirai: the botnet that did not exploit anything	Security & WAF	Three students in their early twenties built it to win at Minecraft server hosting, and it produced the largest attacks the internet had seen. It used no vulnerability. It logged in, with a list of about sixty factory usernames and passwords, to cameras and routers whose owners did not know they had an account. You cannot patch a default, which is why the eventual fix was a law.
Certificate authorities: the padlock is a list of people you have never met	Security & WAF	Your browser trusts a few hundred organisations to vouch for who owns which name, and any one of them can issue a valid certificate for any site on the internet. That design has failed in public at least once badly enough to end a company and expose a country's dissidents. What breaks when a CA is compromised, why revocation barely works, and how the industry replaced trust with surveillance of itself.
Target, 2013: the alerts fired, and nobody moved	Security & WAF	An air-conditioning contractor in Pennsylvania opened a phishing email. Six weeks later, malware on the tills of 1,797 stores was reading payment cards out of memory during the busiest three weeks of the retail year. The security tooling detected it and raised alarms while it was happening. That is the part worth teaching, because nothing about this breach was a failure of technology.
Y2K: what it costs to be right about a disaster that then does not happen	Security & WAF	Somewhere between two hundred and six hundred billion dollars was spent, midnight passed, almost nothing broke, and the people who did the work have been called frauds ever since. The honest account is more interesting than either side's version: some of the fear was well founded, some of it was demonstrably not, and one comparison has never been satisfactorily answered.
Unix: the operating system inside every box on your network	Security & WAF	Log into a load balancer, a firewall or an access point and look underneath the management interface. There is a filesystem, a shell, syslog, cron and tcpdump. The appliance is a Unix with a product on top, and it is that way because of a 1956 antitrust settlement that stopped a telephone company from selling software.
Email authentication: what SPF, DKIM and DMARC each actually do	Security & WAF	Mail was designed with no way to check who sent it, and the three records everyone publishes fix different halves of that problem: badly explained, frequently misconfigured, and routinely credited with protection they do not provide. What each one checks, why alignment is the idea that matters, why forwarding breaks things, and the deployment order that actually reaches enforcement.
Shellshock and Log4Shell: when the vulnerability is a feature	Security & WAF	Neither was a memory bug. In both cases a widely used component did exactly what its documentation said, to a string that had come from a stranger. One sat undiscovered in bash for about twenty-two years; the other made logging - the single thing every application does with untrusted input - into remote code execution. This is the class of flaw that testing for crashes will never find.
Diffie-Hellman explained without the mathematics	Security & WAF	Two people who have never met, shouting across a crowded room where everyone can hear, end the conversation knowing a secret number that nobody else in the room knows. It sounds like a trick. It is the single idea that makes it possible to buy something online, and this is how it works, with one equation and no prior knowledge.
Passkeys: why this MFA is different from the MFA that keeps failing	Security & WAF	Most multi-factor authentication stops password reuse and does nothing about phishing, because anything a user can read out or type in can be relayed by an attacker in real time. Passkeys close that by binding the credential to the site's origin in the browser. What WebAuthn actually does, why origin binding is the whole trick, and the recovery and account-lifecycle problems nobody solved yet.
Backups: the control that has to work when every other one has failed	Security & WAF	Ransomware turned backups from an availability concern into the last line of defence, and then went after the backups themselves. What changed, why the old 3-2-1 rule needs a fourth clause, why an untested restore is a rumour, and the uncomfortable fact that backups solve the encryption half of a modern extortion attack and nothing of the disclosure half.
Therac-25: the machine whose predecessor had the same bugs and hurt nobody	Security & WAF	Between 1985 and 1987 a radiation therapy machine delivered massive overdoses to at least six patients. The software defect was serious. The finding that made it the most-taught case in software engineering is different and worse: the previous model ran comparable faulty code for years without injuring anyone, because it had hardware that would not let it.
DDoS: why the defence is capacity, and why amplification is everyone else's fault	Security & WAF	Denial of service is not one attack but three problems with different answers: a pipe that fills, a state table that exhausts, and an expensive request repeated cheaply. The largest attacks are only possible because other people's networks let forged traffic out, which makes the most effective mitigation something you deploy for strangers, not for yourself.
The STJ attack, 2020: the fortnight Brazil's second-highest court stopped	Security & WAF	On 3 November 2020 ransomware encrypted the case files of the Superior Court of Justice. Hearings were cancelled, procedural deadlines were suspended by resolution, and the systems came back fifteen days later. It was part of a wave against the Brazilian judiciary, and the accounts of what happened to the backups have never been reconciled.
SATAN, 1995: the scanner that got its author fired	Security & WAF	Two researchers built a program that found security holes across a network, explained each one in plain language, and told you how to fix it. Before it was released the press predicted disaster, a national laboratory braced for invasion, and Silicon Graphics fired one of the authors. The industry then spent thirty years agreeing with him, and the argument has just started again.
Zero trust, ZTNA and SASE: what the terms mean when you remove the marketing	Security & WAF	Zero trust is an architectural principle, ZTNA (zero trust network access) is a way of publishing applications, and SASE (secure access service edge) is a purchasing arrangement. Vendors blur all three because the confusion sells. Here is what each actually is, what genuinely changes when you adopt them, and the honest list of things they do not fix.
Ariane 5: the code was correct, and the world had changed	Security & WAF	Forty seconds into its first flight the rocket destroyed itself. The software that killed it was working exactly as written and had flown successfully many times on the previous model. It was calculating something that was not needed after lift-off, from a routine nobody had thought to switch off, using an assumption that had been true of a different rocket.
Knight Capital: forty-five minutes, and a rollback that spread the fault	Security & WAF	A trading firm handling a tenth of American equity volume deployed new code to seven of its eight servers. The eighth still held a feature that had been dead since 2005, wired to a flag the new code had reused. Ninety-seven warning emails went out before the market opened. And when engineers understood what was happening, they rolled back - putting the defective code on all eight.
SIEM: why it costs so much and detects so little	Security & WAF	A SIEM is a database with a search box and a scheduler. It detects nothing by itself, and most deployments fail the same way: bought as a product, funded as a project, fed everything, tuned by nobody. What makes the difference is treating detections as engineered artefacts with owners, tests and a documented response.
Schrems II: the day a court read the surveillance record and drew a conclusion	Security & WAF	In 2020 Europe's highest court struck down the legal basis five thousand American companies used to move personal data across the Atlantic. Its reasoning was not about contracts. It was about what United States intelligence law actually permits, and whether a European whose data was collected under it had anywhere to complain. The engineering consequence is the part practitioners keep getting wrong.
The 500-mile email: the best debugging story in the profession	Security & WAF	A statistics department reported that it could not send email more than about 520 miles. The sysadmin's first reaction was that email does not work that way. The department had a map. The cause was a configuration file, an upgrade, a timeout set to zero, and the speed of light - and every element of it can still happen to you this afternoon.
The Silk Road: the anonymity network held, and the operator did not	Security & WAF	Tor was never broken. The site's founder was identified because in 2011 he had advertised the marketplace on public forums under a nickname, and one of those posts carried his real email address. How investigators found the server itself is a different question, and one a court declined to answer - because answering would have required the defendant to admit the server was his.
You Sh0t the Sheriff: the podcast that turned into Brazil's most exclusive security conference	Security & WAF	Three people in three cities started a security podcast in 2006. The event came afterwards, and it inherited the podcast's shape: small on purpose, invitation-only, venue kept secret until you are confirmed. Two decades on, the podcast is still recording and the conference has put Jeff Moss and Space Rogue on the same stage as the people who wrote Brazil's own tools.
Security versus availability: the trade nobody writes down	Security & WAF	Every security control is also a new way for the system to stop working. The triad puts confidentiality, integrity and availability on the same footing and then organisations staff them separately, measure them separately, and discover the conflict during an incident. The history of the trade-off, where it is decided in practice, the failure modes on both sides, and how mature teams price it before the outage rather than after.
The Pentium FDIV bug: a small defect and a $475 million answer	Security & WAF	Five missing entries in a lookup table made certain divisions slightly wrong. Intel had found it internally, decided it did not qualify as an erratum, fixed it quietly and said nothing. When a mathematics professor found it independently, the company offered replacements only to customers who could prove they were affected - and turned a rare arithmetic flaw into the most famous recall in computing.
Mars Climate Orbiter: both sides were correct, and the spacecraft was lost	Security & WAF	One program produced impulse figures in pound-force-seconds. The program that consumed them expected newton-seconds. Neither was wrong internally, the specification said which was required, and nothing checked. The famous version of this story is a unit conversion; the useful version is what happens at a boundary between two organisations, and what the team did with four months of warning.
Security through obscurity: what Kerckhoffs actually said	Security & WAF	The maxim is quoted as a prohibition on hiding anything, which is not what it says and not what the field practises. Kerckhoffs in 1883 and Saltzer and Schroeder in 1975 were making a narrower and sharper claim about which secret a system may depend on. The history, the difference between a secret and an obscurity, where each is legitimate, and the systems that proved the point by being broken the moment somebody looked.
How systems fail: a reader's map to the cases in this catalogue	Security & WAF	Nine failures, sorted not by industry or decade but by where the failure actually lived - in a safeguard someone removed, an assumption that expired, a rollback, a boundary between two organisations, a decision about what to say. Read as a set they stop being anecdotes and start being a checklist of the places to look.
The disclosure record: what happened between finding it and saying it	Security & WAF	Every case in this catalogue has an interval in it - between the moment someone knew and the moment anyone else did. Sometimes it was six hours and sometimes it was a decade. This page collects the cases where that interval decided the outcome, and what each one settled about coordinating, withholding, publishing and being believed.
The Firewall: Birth, Generations, and What Comes After the Perimeter	Security & WAF	Nobody invented the firewall. It was argued into existence over roughly six years by people at Digital Equipment Corporation, Bell Labs and Trusted Information Systems who disagreed about almost everything except that a network needed a place to say no. This is the family history: the 1988 paper, the first product delivered on 13 June 1991, the stateful inspection patent that decided the market, the proxy camp that lost on performance and was right about inspection, the appliance, the next-generation label, and what happens to a boundary device in an estate that no longer has a boundary.
The Brazil thread: six articles that only make sense together	Security & WAF	A market reserve that produced clones and smuggling, a governance model that was multistakeholder before the word existed, a hacker culture that began in a social-justice NGO, a criminal industry shaped to payment instruments no other country had, a data protection law with ten legal bases and a three-day clock, and the fortnight a supreme court stopped. Read separately they are country facts. Read in order they are one argument about what happens when a large country builds its own internet.
Intrusion Detection: The Discipline Built on Reading the Logs	Security & WAF	Intrusion detection began as a filing problem. James Anderson's 1980 report proposed auditing a computer's records to find abnormal usage; Dorothy Denning and Peter Neumann turned that into a real-time model between 1984 and 1986; Todd Heberlein moved it onto the wire in 1990; and Marty Roesch gave it away in 1998. This is the family history, including the split into detection and prevention that was a business decision as much as a technical one, and why the hardest problem in the field has always been the person who has to read the output.
The Web Application Firewall: Bought by Auditors, Blamed by Engineers	Security & WAF	The first web application firewall and the first web application scanner were built by the same company, which is the structural fact this family is usually explained without. AppShield shipped in the summer of 1999; ModSecurity opened the category in 2002; the OWASP Top 10 gave it a vocabulary in 2003; and PCI DSS made it a purchase in 2004. This is the family history, including why a technology with twenty-five years of development is still described by its own professional bodies as a magic black box that does security.
SAST and DAST: Two Lineages, One Budget Line	Security & WAF	Static and dynamic application security testing are sold as a pair and descend from completely different places. SAST comes from lint, written at Bell Labs in 1978 to solve a portability problem and only later pointed at security. DAST comes from the attack tooling of the late 1990s, built by the same company that built the first web application firewall. This is the family history, including why the founding tool's own name became a term of abuse, and why the two approaches disagree by construction rather than by quality.
Encryption: The Standard, the Suspicion, and What the Suspicion Got Wrong	Security & WAF	Civilian cryptography has a founding document and a founding argument. The document is the Data Encryption Standard, issued in January 1977 from a cipher IBM built on Horst Feistel's Lucifer. The argument is what the National Security Agency did to it - and the answer, which took seventeen years to emerge, is that the agency made the algorithm stronger against an attack nobody outside knew existed while shortening the key. This is the family history: from a filename too long for an operating system, through the crypto wars, to a standards process that now runs in the open because of what that suspicion cost.
The Hardware Security Module: The Man Who Invented Both Halves	Security & WAF	Mohamed Atalla invented the MOSFET at Bell Labs, watched it be overlooked, resigned, and twelve years later invented the hardware security module. The transistor technology that made modern computing possible and the box that protects its most valuable secrets came from the same person - and he had to leave the world's foremost research laboratory to build the second one. This is the family history: the Atalla Box of 1973, a standard created out of fear that one company would dominate, an assurance level almost nobody reaches, and what happens when the answer to key management moves into somebody else's cloud.
Identity: The L in LDAP Is an Argument	Security & WAF	X.500 was a good data model wrapped in a protocol nobody could deploy. In July 1993 three engineers published a specification whose entire premise was throwing most of it away, and called the result Lightweight. This is the family history of identity - from per-machine password files to NIS, X.500, LDAP, Kerberos, SAML and OpenID Connect - and the argument that runs through all of it: whether identity is something a network asserts, something a directory stores, or something a third party vouches for.
PKI: An Undergraduate Thesis, and a Trust Model Nobody Would Design Today	Security & WAF	In May 1978 an MIT undergraduate wrote a thesis that named the certificate, named the revocation list, and laid out the structure the web still runs on. What grew around it is a trust model that no one would propose from scratch: roughly a hundred trusted issuers, any of which can vouch for any name on the internet, with the weakest setting the strength for everyone. This is the family history - Kohnfelder in 1978, X.509 in 1988, the compromises of 2011, Certificate Transparency as the fix, and a price that fell from hundreds of dollars to nothing.
Denial of Service: The Keynote Interrupted by Its Own Subject	Security & WAF	In February 2000 Steven Bellovin was five minutes into a conference keynote on denial-of-service attacks when pagers started going off and the room emptied. The attack under way was launched by a fifteen-year-old using tools he had not written. This is the family history - Trinoo in 1999, the week that took down Yahoo, Amazon, eBay and CNN, the amplification pattern this catalogue has now documented three times, and why the only real defence is capacity nobody can afford alone.
Email: A Side Project That Became the Identity Layer	Security & WAF	Ray Tomlinson's employer did not ask him to build email. He was, in a colleague's words, just fooling around, looking for something to do with the ARPANET - and he assembled it from a local messaging tool and a file transfer program. The specification written eleven years later allowed the sender shown to a human to differ from the sender declared to the server, which is the design decision that created phishing. This is the family history, and it ends with the clearest exception yet to a rule this catalogue thought it had established.
Network Access Control: The Idea That Was Right Too Early, Twice	Security & WAF	Network access control was not invented for the local area network. It was invented in 1984, at BBN, for the device you dialled into - and it was built to make people authenticate less, not more. This is the family history: from the terminal access controller through dial-up authentication and 802.1X to Cabletron's connection-oriented fabric, the Enterasys loop that detected, located, contained and remediated automatically, the decade in which the whole idea was declared a failure, and its return under a name with better marketing.
How a Proxy Knows Who You Are: User Authentication Methods Inline	Security & WAF	Policy per user is the whole promise of an inline proxy - which means the proxy must attach an identity to every flow, including the ones that cannot log in. The four working patterns: explicit 407 challenges, cookie-based web authentication, agent-asserted identity, and the surrogate-IP compromise - plus where each one breaks, because every one of them breaks somewhere.
Data Loss Prevention: How Machines Recognize Secrets	Security & WAF	Every DLP product answers the same question - is this outbound content sensitive? - with the same four instruments: patterns, dictionaries, exact data matching against fingerprinted records, and indexed document matching against fingerprinted files. What each instrument can and cannot recognize, why confidence scores and proximity exist, and why the hard part of DLP was never the matching.
Sandbox Detonation: Judging a File by What It Does	Security & WAF	Signatures recognize malware that has been seen; a sandbox convicts malware that has not - by running the file in an instrumented cage and watching its behavior. What detonation actually observes, why verdicts take minutes, the patient-zero window that timing creates, how hash sharing turns one verdict into everyone's protection, and the evasion arms race that keeps cage-builders employed.
Browser Isolation: When You Cannot Trust the Page, Move the Browser	Security & WAF	Remote Browser Isolation stops asking whether a page is safe and removes the question: the real browser runs in a disposable cloud container, and the endpoint receives only a rendered projection - pixels or a reconstructed DOM. What each rendering mode trades, why isolation is the answer for the uncategorizable middle, what it costs, and where its honest limits sit.
CORS Explained: The Border Control of the Browser	Security & WAFWeb & HTTP	CORS is the most misunderstood error message in web development, because it punishes the wrong mental model. It is not a wall - the same-origin policy is the wall; CORS is the door: a header protocol by which a server volunteers 'that other origin may read my responses.' Simple requests vs preflights, what OPTIONS is doing in your network tab, why credentials tighten every rule, why '*' is not the fix, and why CORS never protected the server in the first place.
LDAP search filters: reading the parentheses	Security & WAF身份与令牌	Every directory query - PingDirectory, Active Directory, any LDAP server - comes down to one filter string in prefix notation. How to read it: the operators, the six match types, the escapes, the famous AD bit-filter OIDs, and why an unindexed filter can take down a directory.
OAuth flows: choosing the grant in 2026	Security & WAF身份与令牌	One decision starts every integration: which flow. The modern answer is short - authorization code + PKCE for humans, client credentials for machines, the device grant for TVs - and the reasons implicit and ROPC died are worth knowing by heart. RFC 9700 finally wrote it all down.
Memory safety: the bug classes and the defenses that answer them	Security & WAF	Buffer overflow, use-after-free, null dereference, integer overflow - four names for two failures, staying inside an object and only touching it while it is alive. How each one works, why roughly seventy percent of serious vulnerabilities in large C and C++ codebases belong to this family, and what each defensive layer actually buys.
Tor: how onion routing actually works, and what it does not protect	Security & WAF	Onion routing was invented at a US Navy lab, and that paradox is the key to understanding it: anonymity only works if the crowd is diverse. How a three-hop circuit is built, what onion services really are, the threat model Tor openly admits it loses to, and why most Tor traffic never touches the dark web at all.
DNS blocklists: RPZ, ratings, and what a refused answer costs	Security & WAF	Blocking a domain at the resolver is the cheapest security control there is, which is why every vendor sells one. How RPZ feeds work, what a vendor DNS rating actually rates, the two failure modes nobody plans for, and why the block you cannot see is worse than the one you can.
The SolarWinds compromise: how a signed update became the largest supply chain attack on record	Security & WAF	From September 2019 an intruder sat inside SolarWinds' build system, tested in October, and from February 2020 inserted a backdoor into the Orion monitoring platform that SolarWinds itself signed and shipped. Fewer than 18,000 customers installed it; a handful were walked through. Found in December 2020 by a victim investigating its own breach, named to Russia's SVR in April 2021, and still in court in 2024 over what the company had said about its security.
Traffic diversion and the man in the middle: the family, and the one move they share	Security & WAF	A map of the ways traffic is steered through somewhere it was not meant to go, and the defence that answers each. Every method, from ARP poisoning on a LAN to a BGP hijack across the internet, is a variation on one move: become the path. This opener explains the shared principle, sorts the methods by the layer they work at, and links to the detailed walkthrough for each, with the standard mitigation named beside every one, because the reason to understand an attack on a training site is to recognise and stop it.

Text & utilities (1)

The Greek Alphabet: Engineering's Second Alphabet
Why Ω means ohms, μ means micro, and λ runs both wavelengths and serverless functions. The 24 letters, the final-sigma rule, and the transliteration gotchas between modern and classical Greek that quietly rename beta and eta.
Text & utilitiesTools: Greek alphabet explainerRead

Article	Topic	Summary
The Greek Alphabet: Engineering's Second Alphabet	Text & utilities	Why Ω means ohms, μ means micro, and λ runs both wavelengths and serverless functions. The 24 letters, the final-sigma rule, and the transliteration gotchas between modern and classical Greek that quietly rename beta and eta.

TLS 与传输 (12)

Article	Topic	Summary
TLS 密码套件的结构	TLS 与传输	TLS 密码套件实际命名了什么，如何逐部分阅读像 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 这样的套件，以及同一个两字节代码点如何以三种不同的命名约定出现。
读懂密码套件名称：IANA、OpenSSL 和 GnuTLS	TLS 与传输	为什么同一个密码套件有三个不同的名称和一个两字节代码点，如何在 IANA、OpenSSL 和 GnuTLS 的约定之间互译，以及 IANA 那含 Y、N 和 D 的 Recommended 列究竟意味着什么。
AEAD 对比 CBC：模式为何重要	TLS 与传输	像 AES-GCM 这样的 AEAD 密码与带单独 HMAC 的较旧 CBC 密码之间的实际差别，终结了 MAC-then-encrypt 的填充预言机攻击，以及 AEAD 至今仍提出的那一个取舍。
前向保密与密钥交换	TLS 与传输	前向保密保证了什么，为什么静态 RSA 密钥传输不提供它，ECDHE 和 DHE 又如何提供它，以及为什么身份验证和密钥交换是套件名称分开保持的两项不同任务。
TLS 1.3 密码套件：变了什么	TLS 与传输	为什么一个 TLS 1.3 套件只命名一个密码和一个哈希，密钥交换和身份验证去了哪里，以及为什么套件列表从数百个缩减到寥寥几个。
What a Quantum Computer Would Break, and What It Would Not	TLS 与传输	A large quantum computer would not weaken all cryptography equally. Shor's algorithm breaks the public-key math behind RSA, Diffie-Hellman, and elliptic curves outright; Grover's algorithm only halves the strength of symmetric ciphers and hashes, which AES-256 and SHA-384 already survive. This explains the split, why 'harvest now, decrypt later' makes it a today problem, and why a broken candidate like SIKE is a reminder to stay humble.
The NIST Post-Quantum Standards: ML-KEM, ML-DSA, and SLH-DSA	TLS 与传输	In August 2024 NIST finalized the first three post-quantum standards: FIPS 203 (ML-KEM, from Kyber) for key establishment, and FIPS 204 (ML-DSA, from Dilithium) and FIPS 205 (SLH-DSA, from SPHINCS+) for signatures. This explains what each one is for, why there are two signature standards on different math, and where HQC and FN-DSA fit as the backups still coming down the pipeline.
Hybrid Key Exchange in TLS 1.3: What X25519MLKEM768 Does on the Wire	TLS 与传输	The web did not swap classical key exchange for post-quantum; it runs both at once. X25519MLKEM768 combines a 1990s elliptic curve with lattice-based ML-KEM-768 in a single TLS 1.3 group, so a break of either still leaves the session secure. This covers why hybrid rather than replacement, the wire format and its size problem, and where deployment stands across browsers, servers, and the middleboxes it breaks.
Inbound TLS: Offload, Bridging, and Passthrough at the Reverse Proxy	TLS 与传输证书与 PKI	A reverse proxy handling inbound HTTPS has three choices for the TLS session: terminate it and send plaintext to the backend (offload), terminate and re-encrypt to the backend (bridging), or forward the encrypted bytes untouched (passthrough). Each trades visibility against confidentiality and cost differently. This explains all three, why the proxy holds the server's certificate, and what SNI and mutual TLS change.
TLS 1.2 vs TLS 1.3 vs DTLS vs QUIC: One Handshake Family, Four Shapes	TLS 与传输	TLS 1.2 and TLS 1.3 secure a TCP stream, DTLS carries the same guarantees over datagrams, and QUIC absorbs the TLS 1.3 handshake into the transport itself. What each one is, which RFC defines it today, what actually changed between them, and where each one runs.
What Is a JA4 TLS Fingerprint?	TLS 与传输Security & WAF	How a TLS ClientHello becomes a stable fingerprint of the client software, why JA3 faded once browsers began randomizing extension order, how JA4 fixes that by sorting before hashing, and what JA4 can and cannot tell you.
Why Do We Say SSL When We Mean TLS?	TLS 与传输	SSL has been prohibited, deprecated, and dead for years - and the industry still sells 'SSL certificates,' configures 'SSL inspection,' and links openssl. The history explains the habit: Netscape's SSL, the political rename to TLS in 1999 (the wire version field still said 3.1), and a quarter century of marketing inertia. Plus the musing the question deserves: what would a protocol-independent name even look like, and do any exist?

Web & HTTP (9)

Article	Topic	Summary
Reading a raw HTTP request, and turning it back into something you can run	Web & HTTP	A capture, a proxy log and an RFC example all hand you the same thing: a request line, some headers and maybe a body. Turning that back into a command you can run looks mechanical and has three traps - the URL is not in the message, some headers must not be copied, and the paste is usually a live credential.
How a WebAssembly tool works: what runs, where it comes from, and what leaves the page	Web & HTTPOperations & Fieldcraft	Most tools on this site are small pure functions written here and tested with golden vectors. A Python playground cannot be that: the thing you want is a real interpreter, and the honest way to give you one on a static site is CPython compiled to WebAssembly, downloaded by your browser and run in its sandbox. This article explains what changes when a tool runs third-party code: the download and why it waits for your consent, the Worker and why Stop is a termination, the Content Security Policy and what was measured against it, the pinned files and their digests, the wall clock, and which checks are the site's and which are the engine's. With the engine's own documentation cited for each claim.
Hidden messages in HTTP headers: tributes, jokes and job offers in the overhead	Web & HTTPSecurity & WAF	HTTP lets a server add any header it likes, and for twenty years operators have used that freedom for things that are not protocol. After Terry Pratchett died in 2015, thousands of sites began sending X-Clacks-Overhead: GNU Terry Pratchett, a memorial built from a plot device in his own novel. Slashdot answered every request with a Futurama quote. Automattic and Airbnb hid job offers where only people reading headers would see them. A page cache announces itself with the Batman theme. Two status codes carry literary jokes into the standard itself. This article walks each case, cites the artefact, and says what the good ones have in common: they cost the reader nothing, they are true, and they are addressed to the people who look. It ends with how to read them yourself, and with this site's own.
Colour contrast: the WCAG arithmetic, and the ten ways CSS spells a colour	Web & HTTP编码与数据	Whether text can be read against its background is, in WCAG, a single number computed from two colours, and the computation is short enough to do by hand once. Here is the arithmetic (relative luminance, the ratio, the 4.5:1 and 3:1 thresholds and where they come from), followed by the notations CSS Color Level 4 lets you write a colour in, from #hex to oklch(), and why the newer ones make a failing pair easier to fix.
Specificity, counted by the specification, and the five things the cascade checks first	Web & HTTP	Every stylesheet war ends in the same place: two rules want the same property on the same element and one of them wins. CSS decides with a short, exact procedure, and specificity is only its fifth step. Here is how Selectors Level 4 counts a selector into three numbers, what :is(), :where(), :not() and :nth-child(of) do to the count, the ten examples the specification itself gives, and the five criteria the cascade settles before it ever looks at specificity.
Where an HTTP/1.1 message ends: Content-Length, chunked, and the eight rules	Web & HTTP网络	An HTTP/1.1 connection is a stream of bytes with messages laid end to end, and nothing marks where one stops except the rules both ends agree on. RFC 9112 gives eight of them, in order of precedence, and every request-smuggling attack of the last twenty years is two implementations applying a different one to the same bytes. Here are the rules, the chunked coding decoded by hand, what Content-Length promises, and what goes wrong when the promise and the bytes disagree.
How the HTML parser repairs your markup, and why the repairs are the same in every browser	Web & HTTPSecurity & WAF	A browser never rejects HTML. Whatever you paste, a tree comes out, and the HTML Standard says exactly which tree: the elements the parser creates for you, the end tags it supplies, the formatting elements it splits, the content it lifts out of tables, the comments it makes of your typos, and the quirks mode it falls into without a DOCTYPE. The 52 named parse errors, the five repairs worth knowing by name, what view source and inspect element disagree about, and why WCAG 2.2 could drop its parsing criterion without lowering the bar.
How a selector finds its elements: Selectors Level 4 read as a matching algorithm	Web & HTTP	A CSS selector is a question asked of a tree, and the specification says exactly how the question is answered: compound by compound, right to left, with the document language deciding what counts as the same name. Where case matters and where it does not, the seven attribute operators and the empty string that matches nothing, how siblings are counted, what :is(), :not(), :where() and :has() do to validity and specificity, which pseudo-classes a static document can never answer, and what browsers do with a selector that ends inside a bracket.
What a page head declares, and who reads each line	Web & HTTPSecurity & WAF	The head of an HTML page is written for machines, and each line is read by a different one under different rules: the browser reads the title, the encoding and the pragma directives by the HTML Standard; a search crawler reads description, robots and canonical by its own published documentation and by RFC 6596; a social platform reads Open Graph by ogp.me and twitter:* by a registry entry from 2023; a structured-data consumer reads JSON-LD by the W3C Recommendation. What each party requires, what it merely prefers, what is quietly ignored, and the handful of rules (one title, one description, UTF-8 once and early, exactly one identifying attribute per meta) that are errors rather than advice.

Network and security concepts, explained clearly.

How do you want to learn?

Browse by subject

New and revised

New here? Four places to start

Stories

Around Learn

The vendor-neutral index

编码与数据 (46)

JSON vs YAML: What Converts Cleanly and What Does Not

The Anatomy of a URL

The JSON Grammar: Six Types and a Few Strict Rules

What Unix Time Actually Is

字节、码点与 UTF-8

Base64 与 Base64URL，详解

JSON Numbers and the Precision Trap

Query Strings: Parameters, Plus Signs, and Repeated Keys

Seconds, Milliseconds, Microseconds, Nanoseconds: Telling Epoch Units Apart

YAML Type Coercion and the Norway Problem

Base64URL 与 URL 安全字母表

Duplicate Keys in JSON: Legal, Dangerous, and Worth Catching

JSON and YAML in Practice: APIs, Declarations, and Orchestration

The Year 2038 Problem

URL Encoding and Internationalized Hosts

Base64 出现的地方：data URI、MIME、PEM 和 Basic auth

ISO 8601, RFC 3339, and the HTTP Date

JSON String Escapes and Unicode

YAML Anchors, Aliases, and Merge Keys

Base32 详解

Trailing Commas, Comments, and the JSON5 Family

Why Unix Time Ignores Leap Seconds

YAML Block Scalars and Multiline Strings

Formatting, Minifying, and Canonical JSON

Relative URLs and How They Resolve

Roman Numerals: How the System Actually Works

十六进制编码（Base16）详解

Deceptive URLs: Reading Past the Tricks

Time Arithmetic and Time Zones: Exact Durations, Honest Meetings

百分号编码（URL 编码）详解

Base16、Base32、Base64 与百分号编码的比较

How text diff works

Reading a diff

Word and Character Level Diffs

Three-Way Diffs and Merge Conflicts

Minimal Edits: Why a Diff Can Look Wrong

Reading XML Structure

XML Namespaces Explained

Well-Formed vs Valid XML

CDATA, Comments, and Processing Instructions

The formats in between: why every interchange bug is the same bug

HTML Forms and Request Encoding: How the Web Ships Your Input

URI, URL, URN: What's Actually the Difference?

Unicode: code points, planes, names and properties

UTF-8, UTF-16 and UTF-32, byte by byte

Mojibake: why café turns into cafÃ©, and how to get it back

标识符 (5)

UUID：随机的 v4 与时间有序的 v7

UUID 版本详解：v1 到 v8

UUID 会碰撞吗？概率与生日界

作为数据库键的 UUID：v4、v7 与索引局部性

ULID、KSUID、Snowflake 及其他可排序 ID

哈希与加密 (15)

哈希、加密与编码：三种不同的事物

密码学哈希：SHA-256 与 SHA-2 系列

选择一个哈希：MD5、SHA-1、SHA-2、SHA-3 与 BLAKE

碰撞、原像抗性与生日界

存储密码：bcrypt、scrypt 与 Argon2

HMAC：用于消息认证的带密钥哈希

为何用 HMAC，而非 hash(密钥 + 消息)

用 HMAC 认证 API 请求

安全地验证 HMAC：恒定时间与重放

Why Cryptographic Hashes Are One-Way

Brute Force vs Lookup Tables: Two Ways to Reverse a Hash

Why Salting Defeats Precomputed Tables

Slow KDFs: bcrypt, scrypt, and Argon2

Keyspace, Entropy, and Crack Time

Choosing a Password Hash

身份与令牌 (34)

JSON Web Token 的解剖

JWKS and Key Rotation: How Providers Publish Their Keys