Topic
46 posts tagged “Networking”.
Chisato · · 4 min read OCSP and CRL are the two mechanisms browsers use to check if a TLS certificate has been revoked before its expiry date. Here's how each works.
Chisato · · 4 min read A watering hole attack compromises a site its targets already trust, then waits for victims to visit — rather than phishing them directly.
Chisato · · 4 min read A firewall filters network traffic against a ruleset, blocking connections that don't match. How packet filters, stateful inspection, and NGFWs differ.
Chisato · · 5 min read An IDS watches network traffic and alerts on threats; an IPS sits inline and blocks them automatically. How the two compare and when to use each.
Chisato · · 4 min read A NAT gateway lets private-subnet resources reach the internet outbound while staying unreachable from it, translating private IPs to a public one.
Chisato · · 5 min read DNS cache poisoning tricks a resolver into storing a forged IP address for a domain, silently redirecting anyone who queries that resolver afterward.
Takina · · 4 min read HTTP range requests let a client ask for just part of a resource, enabling video seeking, resumable downloads, and partial file fetches over HTTP.
Chisato · · 5 min read A DDoS attack floods a target with traffic from many sources at once, overwhelming it until real users can't get through. How it works, and how defenses respond.
Chisato · · 4 min read Clickjacking tricks a user into clicking something they can't see, hidden inside an invisible iframe. How the attack works and how to stop it.
Chisato · · 4 min read Subresource Integrity lets a browser verify a fetched script or stylesheet matches an expected hash, blocking a tampered CDN asset from running.
Takina · · 5 min read Gzip and Brotli both shrink HTTP responses before they hit the wire. How each algorithm works, and why Brotli usually compresses text tighter.
Chisato · · 4 min read DNS over HTTPS encrypts domain name lookups inside HTTPS traffic, hiding queries from network eavesdroppers. How DoH works and how it differs from DNSSEC.
Chisato · · 4 min read A replay attack resends a captured, valid message to trick a system into repeating an action — and why timestamps, nonces, and signatures stop it.
Takina · · 4 min read HTTP status codes are three-digit responses that tell a client what happened to its request. A practical tour of the codes that actually matter.
Takina · · 4 min read HTTP/2 fixed request multiplexing but stayed on TCP; HTTP/3 moves to QUIC over UDP to kill head-of-line blocking at the transport layer. The real differences.
Chisato · · 4 min read A buffer overflow happens when a program writes past the end of a fixed-size memory buffer, corrupting adjacent data. How it works and how modern systems defend against it.
Chisato · · 4 min read A VPC is an isolated, software-defined network inside a public cloud. How subnets, routing, and security groups fit together to keep resources private.
Takina · · 5 min read SSE streams one-way updates over plain HTTP; WebSockets open a full-duplex channel. How they differ and which fits your real-time feature.
Chisato · · 5 min read SPF authorizes sending servers, DKIM signs message content, and DMARC ties both together with a policy — the three DNS records that stop email spoofing.
Chisato · · 4 min read Certificate Transparency is a public, tamper-evident log of every TLS certificate issued, letting anyone detect mis-issued or rogue certificates.
Chisato · · 5 min read Certificate pinning hardcodes which certificate or public key an app should trust, blocking attacks that rely on a rogue but validly signed certificate.
Chisato · · 4 min read A honeypot is a decoy system built to look like a real target, luring attackers so defenders can observe their techniques and catch intrusions early.
Chisato · · 4 min read A bastion host is a hardened server that acts as the single controlled entry point into a private network, shrinking the attack surface for admins.
Chisato · · 4 min read Encryption at rest protects stored data on disk; encryption in transit protects data moving over a network. Why production systems need both.
Chisato · · 4 min read The same-origin policy stops a script from one site reading data loaded from another. How origins are compared, and how CORS and cookies fit in.
Chisato · · 4 min read A man-in-the-middle attack secretly intercepts traffic between two parties. How MITM attacks work, common variants, and the defenses that stop them.
Chisato · · 5 min read HSTS is a response header that tells browsers to only ever connect to a site over HTTPS, closing the gap that lets attackers strip encryption.
Chisato · · 4 min read A VPN encrypts traffic between your device and a remote server, tunneling it through an untrusted network. How VPN tunneling and encryption work.
Chisato · · 4 min read The TLS handshake is how a browser and server agree on encryption and verify identity before any data is exchanged. Here's each step explained.
Takina · · 5 min read Cache-Control and ETag are the two headers that control HTTP caching — how long a response stays fresh and how to revalidate it cheaply, explained.
Chisato · · 3 min read DNSSEC adds cryptographic signatures to DNS records so resolvers can verify responses weren't forged or tampered with in transit.
Chisato · · 4 min read SSRF tricks a server into requesting unintended destinations, reaching internal systems attackers couldn't otherwise touch. How it works and how to stop it.
Chisato · · 4 min read A WAF is a filter sitting in front of a web app that inspects HTTP traffic for attack patterns like SQL injection and blocks malicious requests.
Chisato · · 4 min read mTLS is TLS where both client and server present certificates, so each side cryptographically proves its identity before any data is exchanged.
Chisato · · 5 min read A reverse proxy sits in front of servers, forwarding client requests and hiding backend topology. TLS termination, caching, and load balancing explained.
Chisato · · 4 min read A service mesh is a dedicated infrastructure layer that handles service-to-service traffic, retries, and encryption without changing app code.
Chisato · · 4 min read On October 4, 2021, Facebook, Instagram, and WhatsApp vanished for six hours. How one network command and a DNS safety mechanism took it all down.
Chisato · · 6 min read Zero trust security treats every user, device, and request as untrusted until verified. Core principles, ZTNA vs VPN, and a practical adoption path.
Takina · · 4 min read WebRTC lets browsers stream audio, video, and data directly between peers — no plugins. How getUserMedia, RTCPeerConnection, and ICE/STUN/TURN fit together.
Chisato · · 5 min read The padlock in your address bar hides a clever handshake. Here's what actually happens when you load an HTTPS site — encryption, certificates, and trust.
The Lycoris Team · · 7 min read A load balancer distributes traffic across servers to prevent overload and downtime. Layer 4 vs Layer 7, routing algorithms, health checks, and TLS.
Chisato · · 3 min read gRPC is a high-performance RPC framework from Google that uses HTTP/2 and Protocol Buffers for fast, typed, cross-language service communication.
Takina · · 4 min read A WebSocket is a protocol for full-duplex, persistent communication over a single TCP connection. Learn how it works, when to use it, and what the alternatives are.
Takina · · 4 min read HTTP/3 runs over QUIC instead of TCP, cutting head-of-line blocking and speeding up connections with built-in TLS 1.3. What changed and why it matters.
Chisato · · 3 min read A CDN caches your content on servers around the world so users load it from nearby. How CDNs cut latency, protect origins, and power dynamic apps.
Chisato · · 3 min read DNS translates domain names into IP addresses. How DNS resolution works, the common record types, and why it underpins everything on the web.
