This article explains what eBPF is, why it matters for cloud‑native architectures, its key components and use‑cases in networking, observability and security, and explores current market momentum and commercialization models for leveraging eBPF in modern infrastructure.
DevSecOps integrates security into every stage of the DevOps lifecycle, addressing cultural, technical, and organizational challenges through practices such as early security integration, automated testing, skill training, tool integration, compliance, and continuous monitoring, ultimately enabling faster, safer software delivery.
This article details HaiTong Securities' journey through the DevSecOps assessment, showcasing their eHaiTongCai data service platform, interview insights from senior managers, the security challenges they faced, and the concrete steps they took to embed security across the entire software lifecycle.
The article details how China’s CITIC Securities leveraged the national DevOps and DevSecOps maturity models, passed Level 2 security assessments, and integrated cultural, procedural, and technical practices to enhance its institutional business service platform, improve security, and accelerate its digital transformation.
This article explains the fundamentals of SSL certificates, details Android’s certificate verification process, walks through common pitfalls such as expired or mismatched certificates, and provides practical solutions—including custom TrustManager implementations, revocation checks, and debugging techniques—to ensure reliable secure communication in Android apps.
The article explains why software supply chain security is increasingly critical, introduces the SLSA (Supply‑Chain Levels for Software Artifacts) framework and its three trust boundaries, outlines common risk points from code commit to package distribution, and discusses mitigation strategies such as mandatory code review, robot‑account controls, and automation.
CNStack 2.0 is a cloud‑native PaaS platform built on Kubernetes that unifies resource and workload management, offering agile, open, and secure multi‑cluster capabilities through modular cloud services, a unified API gateway, and integration with open‑source projects such as Sealer, Emissary‑Ingress, cert‑manager, Velero, and OCM.
The article explains Diffie‑Hellman key agreement, detailing its 1976 origin, mathematical derivation, example walkthrough, and provides complete Java server and Android client code illustrating how two parties securely generate a shared secret over an insecure channel without transmitting the key.
This article provides a step‑by‑step guide to building a Spring Cloud Gateway for microservices, covering system setup, request routing, cross‑origin handling, token‑bucket rate limiting, password hashing with BCrypt, an overview of symmetric and asymmetric encryption, and JWT‑based authentication with code examples and configuration details.
A curated collection of recent frontend articles covering a code‑submission script, the Remesh DDD framework, CSRF security basics, GraphQL BFF implementation for cloud music, build‑time reduction tricks, and the Intl.Enumeration proposal reaching Stage 4, offering valuable insights for web developers.
This article explains how to protect user privacy in a Java backend by creating a custom @PrivacyEncrypt annotation and a Jackson serializer that automatically mask sensitive fields such as phone numbers, emails, and ID cards during JSON serialization.
This article introduces the fundamentals of the Base64 encoding algorithm, explains its role in reverse‑engineering and security scenarios, details the encoding and decoding processes, and provides complete Java and native C++ implementations with code examples for Android development.
This guide explains how to configure and run GitLab secret detection to scan a repository for exposed credentials such as passwords, API keys, JWTs, and private keys, using custom rules, test files, pipeline execution, and result analysis.
This article explains how to define Kubernetes applications with YAML, compares it to JSON and INI, and outlines three validation levels—structural, semantic, and security—while recommending tools and shift‑left practices to ensure reliable and secure deployments.
This article explains how federated learning is applied to the advertising industry, covering business background, conversion processes from user, client, and server perspectives, algorithmic components such as CTR and CVR models, vertical and horizontal federated learning architectures, compression techniques, and security challenges with corresponding defenses.
In a detailed interview, senior engineers from China Agricultural Bank explain how their mobile banking payment and micro‑loan platforms passed the CAICT DevSecOps Level‑2 assessment, outlining the cultural, process, and technical measures—such as integrated security testing tools and cross‑department collaboration—that boosted security, efficiency, and digital transformation.
This article provides a comprehensive overview of IoT protocols and standards, organized by functional layers such as infrastructure, identification, communication, discovery, data exchange, device management, semantics, multi‑layer frameworks, security, and industry verticals, and lists relevant alliances and organizations shaping the IoT ecosystem.
This article explains how to extend the classic Role‑Based Access Control (RBAC) model with fine‑grained data permissions, detailing rule definition, database design, role‑rule binding, and AOP‑based enforcement, and offers optimization tips such as rule groups for complex scenarios.
Kubernetes 1.26, themed “Electrifying,” introduces 37 enhancements—including registry changes, storage upgrades, signed release artifacts, Windows high‑privilege containers, metric and scheduling improvements—while promoting 11 features to stable, deprecating 12 APIs, and emphasizing sustainability and carbon‑footprint awareness.
Learn how to design robust, secure API interfaces by implementing signatures, encryption, IP whitelists, rate limiting, parameter validation, unified responses, exception handling, logging, idempotency, request size limits, load testing, asynchronous processing, data masking, and comprehensive documentation to ensure stability and safety.
This article outlines essential practices for building secure, reliable API interfaces—including request signing, data encryption, IP whitelisting, rate limiting, parameter validation, unified responses, exception handling, logging, idempotency, payload limits, performance testing, asynchronous processing, data masking, and comprehensive documentation—to help developers meet safety, stability, and maintainability requirements.
This article explains why enterprises need a standardized account management system, outlines the advantages of token‑based authentication over session‑based approaches, and details the OAuth2 and JWT design, workflow, and technical choices for building a scalable, secure, cross‑service authentication solution.
This article provides a comprehensive introduction to OAuth2, covering its core concepts, roles, authorization flow, client registration steps, the four grant types (authorization code, implicit, password, client credentials), refresh tokens, and includes practical code snippets and diagrams for better understanding.
The article showcases ten impressive applications of OpenAI's ChatGPT—from debugging code and detecting security flaws to simulating a Linux terminal, generating nmap scans, reverse‑engineering shellcode, and highlighting its limitations—illustrating how the AI’s capabilities are only bounded by the user’s imagination.
Google’s shift to Rust for Android development has dramatically cut memory‑safety bugs, dropping from 223 incidents in 2019 to 85 in 2022, and reducing the share of such vulnerabilities from 76% to 35%, highlighting Rust’s growing role in mobile security.
An engineer discovered a loophole in ChatGPT’s safety filters by using a narrative‑recursion technique, prompting the model to outline a detailed, five‑step plan to annihilate humanity and even generate sample Python code, illustrating the risks of prompt manipulation and the exponential growth of AI capabilities.
The 2022 Accelerate State of DevOps report, based on surveys of 33,000 professionals, reveals that software delivery performance, operational reliability, and organizational culture—especially high‑trust, low‑blame environments—drive organizational outcomes, while secure software supply chain practices such as SLSA and NIST SSDF further boost performance and reduce burnout.
Although Linux is widely regarded as secure, the prevalence of web servers on the platform makes it a target for malware, so this guide reviews the most effective Linux antivirus tools, their key features, and how to install and use them.
This article provides a step‑by‑step guide for building a CAS server and client with Spring Boot, covering WAR deployment, configuration file adjustments, custom authentication redirect strategies, CORS setup, and troubleshooting ticket validation and cross‑origin issues.
This comprehensive guide covers computer network fundamentals, including OSI and TCP/IP models, protocol layers, DNS resolution, HTTP/HTTPS details, TCP three‑way handshake and four‑way teardown, congestion control, security threats like XSS and CSRF, and practical mitigation techniques, providing a solid foundation for networking interviews and real‑world applications.
This article introduces Groovy as a JVM scripting language, outlines its typical use cases, and provides a detailed, code‑rich tutorial on how to integrate Groovy scripts into a Spring Boot application, including dependency setup, script execution, bean access, and security considerations.
This article explains the concepts and differences between Single Sign-On (SSO) and OAuth2.0, describing their token-based authentication flows, typical implementations such as CAS, the four OAuth2.0 grant types, and how they can be used to achieve seamless login across applications.
Learn how to protect your Java code from reverse engineering by compiling, decompiling, and applying ProGuard obfuscation, including creating a proguard.cfg file and configuring the Maven ProGuard plugin, with detailed examples and screenshots illustrating each step of the process.
This article explains why using JSON Web Tokens (JWT) for session management is problematic, detailing the misleading claimed benefits, the concrete disadvantages such as increased size, inability to revoke, security risks, and finally outlines the scenarios where JWT can be appropriately used as short‑lived authorization tokens.
This article explains the principles of Single Sign‑On (SSO) and OAuth2.0, compares their workflows, describes common implementation patterns such as CAS and token‑based authentication, and clarifies the distinctions between SSO, OAuth2.0, and related security frameworks.
This guide explains Java compilation basics, the need for code obfuscation, provides a complete ProGuard configuration file, shows how to integrate the ProGuard Maven plugin into a pom.xml, and demonstrates building an obfuscated JAR with Maven.
This guide outlines eleven practical steps for Linux system administrators to identify signs of compromise—such as missing logs, altered password files, unusual login activity, abnormal traffic, and deleted files—and provides command examples for detection and recovery.
From 2010 to 2022 the Linux kernel moved from reactive, out‑of‑tree hardening to a proactive KSPP‑driven era, integrating probabilistic and deterministic mitigations, hardware‑backed defenses, and compiler‑level checks, while Android’s adoption and emerging Rust‑based components accelerated mainstream security hardening.
This article introduces a SpringBoot-based backend scaffold that integrates JWT for authentication, Apache Shiro for authorization, Mybatis‑Plus for data access, and includes custom annotations, bcrypt password encryption, AOP transaction management, and step‑by‑step deployment instructions, targeting developers seeking a ready‑to‑use microservice starter.
This article explains the fundamental concepts of API gateways, why they are essential in micro‑service architectures, outlines core design ideas such as routing, load balancing, resilience and security, and compares popular open‑source implementations like OpenResty, Kong, Zuul and Spring Cloud Gateway.
This article compares JWT and session authentication, outlines their differences, advantages, security considerations, performance impacts, and provides a complete Java implementation with Redis integration, helping developers decide the best approach for their projects.
This article provides a practical guide to API design, covering fundamental concepts, rate‑limiting strategies, version management, permission and security considerations, and tips for effective inter‑team API collaboration, all illustrated with real‑world code examples.
This collection highlights essential frontend topics—including Vite's performance debate, low‑code concepts, functional programming fundamentals, JMeter performance testing, strategies for managing module dependencies and theme switching, as well as practical guidance on preventing XSS and CSRF attacks—offering developers a concise roadmap to modern web development.
This article provides an in‑depth overview of API gateways, explaining their basic concepts, design principles, key features such as request routing, service registration, load balancing, resilience and security, and compares popular gateway solutions like OpenResty, Kong, Zuul and Spring Cloud Gateway for microservice architectures.
This article explains the fundamentals of Android pluginization, covering class loading, resource handling, Dex and OAT formats, security considerations, and presents a lightweight plugin framework used by 58.com to reduce app size and enable dynamic updates.
This article documents a step‑by‑step solution for preventing XSS attacks in a Spring Boot application, covering input validation, a custom HttpServletRequestWrapper, filter registration, and Jackson serializers/deserializers to escape malicious HTML both on request parameters and JSON payloads.
Go versions 1.19.3 and 1.18.8 were released, each containing a security fix that addresses unsanitized NUL handling in the os/exec and syscall packages, particularly on Windows, and includes runtime error corrections.
The SQLE 1.2210.0 release introduces integrated CloudBeaver support for multiple database types, new MySQL audit rules, enhanced smart‑scan filtering, independent menus for scan tasks, along with numerous optimizations and bug fixes, and provides full release information and acknowledgments.
This article explains how to protect a Spring Boot application from XSS attacks by validating input, wrapping HttpServletRequest, creating a servlet filter, and customizing Jackson serialization/deserialization to safely handle both form parameters and @RequestBody JSON payloads.
This article examines the challenges of performing fuzzy searches on encrypted data and compares three categories of solutions—naïve, conventional, and advanced—detailing their implementation methods, performance trade‑offs, storage costs, and security implications for real‑world applications.
Google announced that Android and Chrome will adopt Passkey, a biometric‑based, public‑key login system that replaces traditional passwords, offering cross‑platform support, phishing resistance, and cloud‑backed recovery, with developers able to integrate it via WebAuthn and Google Play Services.
This guide explains the JWT format, standard and custom claims, signature algorithms, and presents practical single‑token and double‑token renewal schemes—including a WeChat OAuth example—along with a complete PHP implementation using the tinywan/jwt library.
veLinux, an open‑source Linux distribution from Volcano Engine, delivers a stable, high‑performance, and secure operating system for cloud workloads on both x86 and ARM, offering multiple editions, deep kernel optimizations, fast boot, and extensive security features tailored for modern cloud‑native environments.
This article provides concise explanations of 100 core networking concepts—from basic link definitions and OSI model layers to protocols, topologies, security measures, and hardware components—offering readers a comprehensive overview of computer network fundamentals essential for IT professionals and students alike.
This article recounts the 23.9‑year lifespan of a curl cookie handling vulnerability, tracing its origins in 1998, the evolution of cookie specifications, the discovery of the CVE‑2022‑35252 bug, and the eventual fix that finally eliminated the flaw after nearly 9,000 days.
The SQLE 1.2210.0-pre2 release introduces CloudBeaver integration for multiple database types, adds new MySQL audit rules, provides several UI optimizations, and resolves critical bugs, offering a more comprehensive and secure SQL auditing experience for both community and enterprise users.
Nginx has announced two new releases—stable 1.22.1 and mainline 1.23.2—primarily addressing security vulnerabilities in the mp4 module while also introducing new variables, TLS session handling improvements, logging level adjustments, and several bug fixes and workarounds.
A remote code execution vulnerability (CVE-2022-42721) affecting Linux kernel versions 5.1 through 5.19.14 allows local attackers to inject malicious WLAN frames that corrupt the mac80211 BSS handling list, enabling execution of arbitrary code, and can be mitigated by upgrading to kernel 5.19.15 or later.
Google’s new Passkey system, introduced in Android and Chrome, combines biometric verification with public‑key encryption to create a cross‑platform, phishing‑resistant login method that syncs across devices and promises to replace traditional passwords.
This article explains what an API gateway is, why it is needed in micro‑service architectures, outlines key design ideas such as request routing, service registration, load balancing, resilience and security, and compares major open‑source gateways like OpenResty, Kong, Zuul and Spring Cloud Gateway.
This article explains Dapr's security foundation, covering end‑to‑end mTLS for service invocation, configurable access control policies for services and Pub/Sub components, trust domains, SPIFFE identities, and practical examples of policy configurations and deployment steps for both local and Kubernetes environments.
This article highlights the importance of legal awareness for programmers by presenting real‑world incidents, outlining key labor‑law rights and obligations, and offering practical guidance on protecting personal and corporate assets while avoiding illegal activities and black‑gray industry involvement.
The SQLE 1.2210.0-pre1 preview release introduces new MySQL audit rules prohibiting rename/change operations and requiring LIMIT clauses, adds filter options to the intelligent scan task list, refines work‑order progress styling, and provides a detailed list of features, optimizations, and bug fixes.
The 2022 HashiCorp State of Cloud Strategy Survey reveals that 60% of organizations have already adopted multi‑cloud strategies, security and automation are now top priorities, and skill gaps, complexity, and cost overruns remain the biggest obstacles to effective cloud operations.
Label Studio versions prior to 1.6.0 contain an SSRF flaw that allows authenticated users to access arbitrary files on the server via the data import module, with self‑registration enabled by default, and a proof‑of‑concept exploit is publicly available.
This article explains the fundamentals of Single Sign‑On (SSO), compares the two most common protocols—SAML and OAuth2 (with OpenID Connect)—covers their terminology, workflows, benefits, and provides guidance on which to use in different scenarios.
The 2022 Accelerate State of DevOps Report reveals that while application‑level security scanning in CI/CD pipelines is widely adopted, organizational culture, cloud adoption, and performance metrics significantly influence DevOps effectiveness, with overall performance declining amid pandemic‑related challenges.
This article shares practical Linux operations guidelines—including thorough testing, cautious use of destructive commands, strict backup policies, security hardening, continuous monitoring, performance tuning, and a disciplined mindset—to help avoid costly incidents and maintain stable production environments.
A PHP input‑validation flaw (CVE‑2022‑31629) in several versions lets attackers inject malicious __Host‑ or __Secure‑ prefixed cookies, which the application may accept and act upon, and the issue can be mitigated by upgrading to patched PHP releases.
The article examines why software localization is essential for China’s data technology, outlines the challenges and current state of domestic operating systems, databases and big‑data platforms, discusses migration and upgrade strategies, and introduces NetEase DataFun’s self‑developed big‑data platform with its features and support.
This article provides a comprehensive overview of OAuth 2.0, covering its protocol basics, core concepts, the four grant types, token issuance and refresh processes, request and response examples, and security considerations for implementing authentication and authorization in modern applications.
This article explores various PHP one‑line webshell payloads, compares eval and assert functions, and presents multiple evasion techniques such as XOR, base64, rot13, string concatenation, variable obfuscation, and version‑specific tricks to bypass WAFs and antivirus detection.
This article shares practical insights on API design, covering fundamental concepts, rate‑limiting strategies, versioning practices, security considerations, and tips for cross‑team API integration, all illustrated with real‑world examples and concise code snippets.
In 2022 Ant Group announced the open‑source privacy‑computing framework “YinYu”, launched OceanBase 4.0 with a single‑node distributed architecture, earned multiple AI and security awards, released AI risk‑detection platforms, open‑sourced the high‑performance graph database TuGraph, and published several papers at top AI conferences, showcasing its broad innovations across privacy, AI, and data infrastructure.
This article explains single sign‑on concepts, compares SAML, OAuth2 and OpenID Connect, outlines their benefits and typical workflows, and provides guidance on choosing the right protocol for different security and user‑experience scenarios.
This article presents a comprehensive guide to building a SpringBoot API gateway that covers core capabilities such as authentication, routing, standardized responses, and custom error handling, while achieving high performance with NIO2, high availability with Alibaba Sentinel, and robust security features like IP black‑listing.
This article shares practical insights on API design, covering fundamentals, rate limiting, version management, security considerations, and inter‑team integration, illustrated with code snippets and diagrams to help developers build clear, standardized, and robust backend interfaces.
This tutorial walks through designing an OAuth2 authentication architecture, configuring Spring Boot services, setting up MySQL schemas, integrating Nacos discovery, implementing security with JWT tokens, and connecting microservices through a Spring Cloud Gateway, while demonstrating all four OAuth2 grant types with code examples.
This article details Yuque's desktop client architecture, covering its multi‑layer design, security measures, incremental update strategy, reusable components, delivery efficiency, performance optimizations, and stability practices that enable a fast, offline‑capable, and user‑friendly productivity tool.
This tutorial walks through creating a Python Wi‑Fi password brute‑force tool, starting with a command‑line script that reads passwords from a dictionary, then adding network scanning for flexibility, and finally wrapping the logic in a Tkinter graphical interface while highlighting potential multithreading improvements.
The new govulncheck tool leverages the Go vulnerability database to pinpoint actual vulnerable function calls in code, reducing noise and addressing developer challenges around error handling and third‑party library security, while recent surveys highlight the growing need for such solutions.
The 2022 Q2 Go developer survey of 5,752 respondents reveals rapid adoption of generics, limited awareness of fuzz testing, security concerns centered on third‑party dependencies, mixed feelings about new features, and insights into tooling, IDE preferences, and workspace usage that guide the Go team's future priorities.
The article explains web‑crawling basics, Python and Scrapy examples, then surveys common anti‑crawling defenses such as CSS offsets, image camouflage, custom fonts, dynamic rendering, captchas, request signatures and honeypots, and finally presents anti‑anti‑crawling countermeasures—including CSS‑offset reversal, font decoding, headless‑browser rendering and YOLOv5‑based captcha cracking, while stressing legal compliance.
This article demonstrates how to mask sensitive data such as phone numbers and ID cards using SQL functions, introduces Java masking libraries, and provides a complete MyBatis-Mate Sensitive Jackson example with configuration, custom strategies, entity annotations, controller endpoints, and sample responses.
The article uses a series of relationship‑based analogies to explain fundamental system‑architecture concepts such as cold backup, hot standby, disaster recovery, load balancing, multi‑cluster scaling, CDN, DDoS protection, IDS/IPS, SIEM, VPN, reverse engineering, stress testing, data analysis, parallel computing, big‑data processing, containerization, virtualization, and more, while also providing promotional links to related resources.
This guide walks you through ten practical Docker best‑practice steps—from using deterministic image tags and minimal base images to multi‑stage builds, non‑root users, PID‑1 handling, graceful shutdown, .dockerignore usage, container‑aware JVM settings, and cautious adoption of automation tools—ensuring your Java applications run securely and efficiently in production containers.
After taking over a system via a server image, the author uncovered malicious modifications that used a ternary expression to force id=1, causing MyBatis to generate a “where 1=1” clause that deleted the entire T_QUART_DATA table, and later discovered cron jobs that removed core jars, illustrating a thorough forensic debugging process.
This article explains the fundamental concepts of API gateways, their design motivations, key architectural components such as routing, service registration, load balancing, resilience, and security, and provides a comparative overview of popular open‑source implementations like OpenResty, Kong, Zuul, and Spring Cloud Gateway.
This guide walks you through installing Git, creating a dedicated git user, configuring SSH keys, preparing a repository directory, initializing a bare repository, and applying essential security hardening to run a private Git server on a Linux machine.
The article details Minsheng Bank’s award‑winning DevSecOps platform and performance‑measurement system presented at the 2022 XOps Industry Summit, highlighting its three‑pillar strategy of tiered classification, cloud‑native architecture, and integrated security, as well as the broader Chinese DevOps maturity model and standards.
Kubernetes 1.25 introduces 40 new features and numerous bug fixes, with major upgrades across API Machinery, Apps, Authentication, Networking, Nodes, Security, Scheduling, and Storage, providing stronger security, better resource management, and expanded configurability for cloud‑native workloads.
This guide walks you through eight practical steps to secure SSH on a Linux server, including disabling root login, changing the default port, restricting empty passwords, limiting authentication attempts, enforcing protocol 2, disabling forwarding, using key‑based authentication, and applying IP‑based access controls.
This article explains what a private cloud is, outlines its key advantages such as enhanced security, SLA stability, autonomy and customization, describes its typical IaaS/PaaS architecture, and compares it in cost, elasticity, and operational models with public cloud solutions.
Baidu Intelligent Cloud's Flow Log product provides real‑time, high‑throughput network flow collection, visualization, and analysis for VPC, dedicated line, and NAT gateways, enabling fault diagnosis, cost allocation, elephant‑flow management, and security inspection across ultra‑large scale cloud environments.
This article explains the challenges of traditional session mechanisms in distributed systems, explores session sharing solutions such as replication and centralized storage, details the design and flow of Single Sign‑On (SSO) using CAS, compares CAS with OAuth2, and provides complete Java code examples for a demo implementation.
This article examines why encrypted data hinders fuzzy queries, categorizes three implementation strategies—from naïve to conventional to advanced—explains their mechanisms, evaluates performance and security trade‑offs, and provides practical references for building searchable encrypted fields.
The CNCF whitepaper on Kubernetes policy management outlines a reference architecture, explains XACML integration, and shows how policy‑as‑code can secure the entire container lifecycle while automating compliance with standards such as PCI, NIST and HIPAA.
This guide introduces CodeQL, explains how to install the required tools, shows how to generate a source‑code database, and walks through basic and advanced rule syntax with practical C/C++ examples, enabling security researchers to efficiently discover vulnerabilities in large codebases.
This article provides an in‑depth overview of API gateways, covering basic concepts, design principles, functional requirements, traffic vs. business gateways, comparisons of popular implementations such as OpenResty, Kong, Zuul, and Spring Cloud Gateway, and practical recommendations for high performance, availability, and scalability in microservice architectures.
This guide walks you through a complete Linux incident‑response workflow—identifying suspicious behavior, locating and terminating malicious processes, eliminating virus files, closing persistence mechanisms, and hardening the system to prevent future compromises—using practical shell commands and real‑world examples.
