This article compares Nacos and Apollo configuration centers, examining their security models, environment isolation mechanisms, and architectural complexity, and concludes that Nacos offers a simpler and potentially safer solution for microservice deployments.
This article analyses the rapid evolution of cloud‑native networking, identifies key challenges across traditional, data‑center, edge, multi‑cluster, financial, and telecom scenarios, and presents open‑source and commercial solutions such as Kube‑OVN, Underlay networks, flexible IPAM, and hardware‑software acceleration.
This roundup presents a curated list of recent frontend development articles covering Babel 7.18 upgrade issues, TypeScript migration strategies, monitoring system design, JavaScript security techniques, ES2022 features, React Native Skia integration, GraphQL BFF practices, and thoughts on software complexity.
This article explains the classic HttpBasic authentication mode in Spring Security, its limited use cases, how to integrate it with a Spring Boot project by adding Maven dependencies and configuration code, and details the underlying Base64‑based mechanism with step‑by‑step illustrations.
This tutorial explains the fundamentals of service mesh, details Istio’s architecture and core components, demonstrates how to install and configure Istio on Kubernetes, and explores common use cases such as traffic management, security, observability, and alternatives.
This guide demonstrates how to use Frida for Android reverse engineering, covering essential commands, stack tracing, and practical hook scripts for common methods such as HashMap.put, Base64.encodeToString, and UI event listeners, enabling developers to locate and analyze encryption logic within apps.
This article explains what DevSecOps is, why traditional security approaches no longer suffice in fast‑paced software delivery, outlines its key advantages such as risk control and cost reduction, and provides detailed guidance on organizational, process, and technology practices—including tool recommendations and CI/CD pipeline integration—to embed security throughout the software lifecycle.
This article presents ten practical methods for hardening Kubernetes application manifests, covering securityContext settings such as runAsUser, privileged mode, capabilities, read‑only root filesystem, privilege escalation, Seccomp, resource limits, image tagging, and optional AppArmor/SELinux policies, to reduce attack surface during development and deployment.
Git 2.37 introduces a built‑in file‑system monitor for faster status checks, supports sparse checkout to avoid downloading whole repositories, adds performance‑enhancing stash improvements, and tightens credential‑in‑URL security, offering developers a more efficient and safer version‑control experience.
An exposed Docker security flaw allows services bound to 127.0.0.1 via the -p flag to be accessed externally through iptables rules, as demonstrated by a PostgreSQL container proof‑of‑concept, and the article proposes stricter iptables configurations and default localhost binding to mitigate the risk.
This article provides a comprehensive introduction to the OAuth 2.0 protocol, covering its core concepts, authorization flow, four grant types (authorization code, implicit, resource owner password credentials, client credentials), request and response parameters, token handling, and practical examples with code snippets.
This article examines the complexity of the Bluetooth protocol stack, focusing on Android’s Host layer vulnerabilities, and provides detailed analyses of three critical CVEs—CVE‑2020‑27024 (SMP), CVE‑2021‑0918 (GATT), and CVE‑2021‑39805 (L2CAP)—including protocol overviews, code excerpts, and exploitation paths.
Drawing from three and a half years of DevOps experience, this guide compiles critical operational practices—ranging from cautious command execution and strict change control to robust backup, security hardening, continuous monitoring, performance tuning, and a disciplined mindset—to help engineers avoid costly outages and data loss.
The article explains what a SmartNIC (intelligent network interface card) is, how it differs from traditional NICs, its computing off‑load capabilities for networking, storage, and security, the problems it solves, various types, limitations, and its growing role in modern data‑center architectures.
NanoID, a modern alternative to UUID, offers significantly smaller IDs, up to 60% faster generation, stronger security via crypto APIs, customizable alphabets, and broad language support, making it a compelling choice for developers seeking efficient, compact, and secure unique identifiers across various platforms.
This article provides an in‑depth overview of JSON Web Tokens (JWT), explaining their structure, authentication workflow, advantages such as statelessness and CSRF protection, drawbacks like revocation difficulty, and presents practical solutions including blacklist, secret rotation, short‑lived tokens and refresh‑token strategies.
This guide introduces thirteen practical Linux operations tools—from network bandwidth monitors like Nethogs to security scanners such as NMap—providing concise descriptions, installation commands, and usage tips to help system administrators efficiently manage and secure their servers.
This tutorial demonstrates how to use Frida to hook Java-level encryption functions on Android, covering MD5, SHA1, MAC, DES/AES/RSA ciphers, and signature algorithms by intercepting update, digest, init, and doFinal methods and logging their inputs and outputs in various formats.
A concise cheat‑sheet of frequently used Linux commands covering file searching, bulk moving, log cleanup, directory checks, text substitution with sed, network packet capture, firewall rules, and log analysis to boost sysadmin productivity.
This article provides a comprehensive overview of DevSecOps, explaining its definition, pipeline stages, framework components, and the top five best practices for 2022 to help organizations integrate security throughout the software development lifecycle.
This article provides a comprehensive introduction to the OAuth 2.0 protocol, explaining its core concepts, the roles of resource owner, client, authorization server and resource server, and detailing the four grant types—authorization code, implicit, resource‑owner password credentials, and client credentials—along with token request/response formats and refresh token usage.
This article provides a comprehensive introduction to OAuth 2.0, covering its purpose, core roles, token types, four main grant flows (authorization code, implicit, resource‑owner password, client credentials), token refresh mechanisms, and practical request/response examples for developers.
The article dissects Android WebView’s evolution to Chromium‑based multi‑process mode, explains the costly initialization steps—including thread checks, provider creation, and Chromium engine startup in a sandbox process—highlights common security pitfalls, and offers idle‑time pre‑initialization and request‑interception techniques to boost performance.
This article explains what Microsoft AppVerifier is, how it helps detect memory corruption, security vulnerabilities, and privilege issues in Windows applications, and provides detailed download links, usage steps, configuration tips, common troubleshooting problems, and best‑practice recommendations for reliable testing.
This article explains several methods—ranging from insecure shortcuts to recommended practices—for hiding the MySQL password‑exposure warning that appears when invoking MySQL tools from a Linux shell, providing code examples and security considerations for each approach.
The 2022 Cloud‑Native Threat Report reveals a rise in Kubernetes‑targeted attacks, persistent supply‑chain threats in container images, and active exploitation of the Log4j zero‑day, underscoring the urgent need for specialized security measures in modern cloud‑native environments.
This article explains the standard JWT claims, shows how to generate a token with custom claims in Java, and compares single‑token and double‑token renewal strategies, including practical steps, Redis storage tips, and a brief overview of WeChat web authorization.
eBPF is a kernel‑level sandbox technology that enables safe, high‑performance, programmable instrumentation for networking, security, and observability, and this article answers seven key questions covering its definition, applications, origins, usage steps, implementation details, best practices, and current ecosystem.
This guide explains how to protect a Spring Cloud Gateway service from packet sniffing by using RSA asymmetric encryption, timestamp validation, unique request IDs stored in Redis, and MD5 signature checks, with complete Java and front‑end code examples.
This article provides a comprehensive tutorial on implementing Single Sign-On using the CAS (Central Authentication Service) framework, covering the concepts of SSO and CAS, required development environment, server-side deployment, client configuration, and end‑to‑end testing with detailed code examples.
In the Pwn2Own 2022 competition, hacker Manfred Paul exploited two critical Firefox vulnerabilities in under eight seconds, earning $100,000, while the event also uncovered major bugs across Ubuntu, Tesla, Microsoft, and Safari, highlighting the real-world impact of rapid zero‑day exploits.
This comprehensive guide explains what Nginx is, its core features, typical use cases, ecosystem extensions, installation methods, detailed configuration examples—including HTTPS, redirects, static mapping, proxying, rate limiting, authentication, load‑balancing strategies, and security hardening—plus an overview of its architecture and source‑code layout.
This article introduces the open‑source mall‑tiny rapid‑development scaffold, explains its core features and integration with the mall‑admin‑web front‑end, and provides a step‑by‑step guide to upgrading it to Spring Boot 2.7.0, covering Swagger, Spring Security, MyBatis‑Plus, circular‑dependency resolution, and CORS configuration.
This article outlines essential Kubernetes security principles based on the 4C model, discusses best practices for clusters, containers, and code, and reviews several open‑source tools such as Kubescape, kube‑bench, Terrascan, kube‑hunter, and Anchore for assessing and improving cluster security.
Mozilla’s security team has blocked the malicious Firefox add-ons “Bypass” and “Bypass XM”, which abused the browser’s proxy API to hijack updates and bypass paywalls, affecting hundreds of thousands of users, and introduced new fallback mechanisms and a “Proxy Failover” extension in Firefox 93.
Linux kernel 5.18, announced on May 22 by Linus Torvalds, brings a host of new features such as C11 compiler support, enhanced hardware compatibility, Btrfs ioctl extensions, io_uring upgrades, RSA crypto for virtio-crypto, and numerous driver and filesystem improvements.
This article compares Alibaba Cloud's MSE cloud‑native gateway with the traditional Nginx Ingress Controller across performance, cost, reliability and security, presenting benchmark data, CVE analysis, architectural advantages, and a step‑by‑step migration plan for Kubernetes clusters.
An AOSP commit proposed by a Xiaomi engineer to prohibit shell extraction of installed APKs—citing potential IP leakage—was rejected after receiving only the author’s support and two opposing votes, with reviewers arguing that such restrictions are ineffective, could be bypassed, and should be handled via DRM or device‑specific policies.
The SQLE 1.2205.0 release introduces three major features, enhancements to the SQL audit workflow, Oauth2 and LDAPS integrations, and a comprehensive list of bug fixes and optimizations, providing a more secure and efficient experience for database users and administrators.
Spring Authorization Server 0.3.0 has been officially released, bringing updated documentation, major feature changes such as token customizer relocation, removal of deprecated APIs, dependency upgrades to Spring Boot 2.7.0 and Spring Security 5.7.1, and new contributors, with detailed module overviews and changelog links.
This document explains the need for a unified account management system in enterprise cloud platforms, defines key terminology, outlines the advantages of token‑based authentication, describes the OAuth2 password‑grant flow and JWT usage, and details the technical design, interface specifications, and credential renewal process for secure cross‑service access.
This article provides a comprehensive overview of Android 12's new security and privacy features, including the Privacy Information Center, location accuracy levels, package visibility filtering, deprecation of system‑dialog closing intents, app hibernation, permission group queries, microphone and camera toggles, and numerous other system‑level changes that affect app behavior and user experience.
This article presents 36 practical guidelines for backend engineers covering interface parameter validation, compatibility, extensibility, idempotency, logging, error handling, security, rate limiting, caching, transaction management, and more, helping you design reliable, maintainable, and high‑performance APIs across any language.
This article explains the fundamentals of SSH, key‑based authentication, the SSH agent workflow, how SSH agent forwarding operates, how to configure ProxyJump, and the associated security risks along with mitigation techniques.
This article explores whether modern CPUs contain undocumented or hidden instructions, explains the challenges of searching the variable‑length x86 ISA, presents a depth‑first algorithm that skips irrelevant bytes, shows how to infer instruction length using page‑fault side‑effects, and reveals discovered hidden opcodes on Intel and AMD processors.
This article explains how SQL injection can exploit a Java Spring course‑selection system by concatenating user input into SQL statements, demonstrates various injection techniques such as always‑true conditions and UNION queries, and provides multiple defensive measures including prepared statements, type checking, permission restrictions, and request‑parameter filtering.
This article compares Podman and Docker, detailing their architectures, root privileges, security, integration with Kubernetes, image building tools, and how they can be used together, helping developers choose the appropriate container runtime for their projects.
This article provides an in‑depth comparison of Podman and Docker, covering their architectures, root‑less operation, security, integration with Kubernetes, support for Swarm/Compose, and practical guidance on when to choose or combine each container solution.
Microsoft researchers uncovered the Nimbuspwn vulnerability in systemd’s networkd-dispatcher, detailing how directory‑traversal, symlink‑race, and TOCTOU flaws let attackers replace root‑owned scripts, achieve privilege escalation, and why coordinated patching across hundreds of Linux distributions is critical.
A bug in the AkuDreams 3D‑animation NFT auction smart contract locked 11,539.5 ETH (worth about $34 million) and prevented refunds, prompting the developer foobar and the project team to investigate, disclose two contract errors, and eventually offer a partial 0.5 ETH refund to affected bidders.
The article introduces the ShadowRealm API, a new JavaScript proposal that creates highly isolated execution realms, explains its type signatures, demonstrates .evaluate() and .importValue() methods with code examples, compares it to eval, Function, iframes, Web Workers, and Node.js vm, and outlines practical use cases such as plugin execution, testing, and web scraping.
This article explains several Linux commands—such as rm -rf, fork bombs, direct writes to block devices, and malicious script execution—that can irreversibly damage systems, detailing their effects, typical usage examples, and essential precautions to avoid catastrophic data loss.
This article surveys a range of front‑end topics—including alternative web‑framework solutions, the rise of pnpm, JavaScript stack memory, TypeScript overloads, integrating Golang with Node.js, innovative development approaches, and essential network security insights—providing concise technical overviews and references.
This article presents a detailed checklist covering general information, application requirements, security and compliance, CI/CD practices, Kubernetes configuration, monitoring, testing, and 24/7 service team readiness to ensure reliable production deployment of HTTP‑based web services on Kubernetes.
This tutorial explains how to create complex, high‑entropy passwords on Linux using GPG or OpenSSL, optionally filter out special characters with sed, and then assess password strength with the cracklib‑check tool on CentOS 8, illustrating both weak and strong examples.
IntelliJ IDEA 2022.1 introduces a Dependency Analyzer for conflict resolution, an enhanced New Project wizard, a dedicated Notifications tool window, extensive language and framework support—including Java 18, Kotlin 1.6.20, Go microservices, Kubernetes, and improved security scanning—plus numerous usability upgrades such as uniform tab splitting, UML export formats, and a Gradle progress bar.
This article presents fifteen practical guidelines for managing software dependencies, covering pre‑inclusion checks such as design review, code quality, testing, security, licensing, and transitive dependencies, as well as post‑use practices like encapsulation, isolation, update strategies, and continuous monitoring to maintain a secure and reliable supply chain.
Learn how to protect sensitive data in Kubernetes by encrypting secrets, using Bitnami Sealed Secrets or external secret managers, and safely storing encrypted manifests in Git, with step‑by‑step commands for installing kubeseal, creating sealed secrets, and deploying them as Kubernetes Secrets.
This article examines GitHub Copilot’s code‑completion, comment‑driven generation, and repetitive‑task automation features, evaluates its accuracy and security concerns, and argues that while it can streamline mundane coding, it will not replace skilled programmers.
The article examines how rapid cloud‑native adoption reshapes application design and operations while introducing six distinct security risks, and proposes a comprehensive DevSecOps framework that integrates early‑stage security controls across infrastructure, compute, development, and management to protect modern containerized environments.
This article introduces the ShadowRealm API, a new JavaScript proposal that creates independent, highly isolated realms for executing code, explains its type signatures, demonstrates .evaluate() and .importValue() methods with practical examples, and compares it with eval, Web Workers, iframes, and Node.js vm.
Elasticsearch 8.0 introduces major updates including 7.x REST API compatibility headers, default-enabled security with registration tokens, system index protection, a preview KNN search API using dense_vector, storage‑saving field mappings, faster geo indexing, PyTorch model support, and numerous deprecations and configuration changes across aggregations, allocation, analysis, authentication, and core infrastructure.
This article provides a step‑by‑step tutorial on integrating the Fair 2.0 dynamic framework into Flutter applications, covering dependency setup, widget conversion, bundle generation, runtime loading, parameter passing, navigation, plugin bridging, performance evaluation, update strategies, security checks, and practical lessons learned from its deployment in the 58 拍客 app.
This comprehensive guide explains the DNS system, its distributed architecture, protocol nuances, hierarchical naming structure, resolution process, caching, smart routing, BIND configuration, load balancing, subdomain delegation, debugging tools, and security considerations such as amplification attacks.
The article explains how counterfeit Chrome browsers proliferate in China, how search engine ads and misleading download pages trick users into installing malicious software, and provides a reliable method to obtain the genuine offline Chrome installer to protect against these security threats.
This article explains what JSON Web Token (JWT) is, its underlying mechanism and data structure, compares it with traditional session authentication, and demonstrates how JWT can be used for cross‑domain single sign‑on, access/refresh token handling, and secure API authentication.
This article explains the lightweight JWT specification, demonstrates how to build a token with header, payload, and signature using Base64 encoding and Node.js, and discusses its security properties, verification process, and suitable use cases for web authentication.
This article explains the officially announced Spring Framework remote code execution vulnerability CVE‑2022‑22965, outlines the affected environments, provides upgrade paths for Spring and Spring Boot, and shares safe code‑based mitigation techniques for developers.
This article explains the newly disclosed Spring Framework remote code execution flaw affecting JDK 9+ Spring MVC/WebFlux applications deployed as WARs on Apache Tomcat, outlines the affected conditions, current patch status, and provides code‑level workarounds for safe remediation.
A Kubernetes node was compromised for Monero mining due to empty iptables, an exposed kubelet API, and a mis‑commented configuration, prompting a detailed post‑mortem and practical hardening steps to prevent similar attacks.
This article outlines nine key reasons why developers favor Linux—ranging from its powerful command line and strong security to low resource usage, privacy protection, free licensing, and extensive community support—making it a reliable, developer‑friendly operating system for desktops, servers, and embedded devices.
This article examines the major Java trends for 2022, including the push to migrate from Java 8 to newer LTS releases, improved cloud and container support, multi‑platform advancements, security lessons from Log4Shell, and upcoming features in Java 18.
Microsoft’s upcoming Windows 11 Sun Valley 2 (22H2) update, codenamed SV2, brings a series of refined UI changes such as a revamped Alt+Tab, File Explorer tabs, new personalization options, plus security enhancements like Smart App Control, all rolled out gradually through the Insider preview builds.
This tutorial demonstrates two Python approaches for creating image verification codes—using the graphic-verification-code library for a quick four‑line solution and the captcha library for customizable random captchas—complete with installation commands, code examples, and sample outputs.
This article explains the necessity of a unified account management system for enterprise applications, defines key authentication terms, outlines the background and goals of token-based security, details the OAuth2 password‑grant flow with JWT, and discusses technical choices, interface design, and token renewal processes.
This article explains how NanoID, a compact and faster alternative to UUID, offers better security, smaller size, higher performance, and broad language support, while also discussing its limitations and future prospects for unique identifier generation in software development.
Spring Authorization Server 0.2.3 introduces default client settings for public clients, splits OAuth2 client authentication providers, optimizes the in‑memory authorization service, adds federated‑identity demos, unifies token generation via OAuth2TokenGenerator, and upgrades core dependencies, with code examples illustrating each enhancement.
This article outlines twelve essential best‑practice steps—including updating to the latest stable release, enforcing PodSecurityPolicy, using namespaces, applying network policies, and hardening API server, scheduler, controller‑manager, etcd, and kubelet settings—to comprehensively secure a Kubernetes cluster.
The article presents a comprehensive design of the Cleaner anti‑crawler system, detailing its background, current challenges, related research, system architecture—including data processing, ban center, and ban store modules built on Flink, MQ, and Redis—implementation details, effectiveness evaluation, and concluding insights on achieving real‑time accuracy in protecting platform data.
This guide provides a detailed, step‑by‑step hardening strategy for Linux systems, covering distro selection, kernel choices, extensive sysctl tweaks, boot‑loader parameters, MAC policies, sandboxing, memory allocator hardening, compile‑time mitigations, root account protection, firewall rules, swap configuration, PAM policies, microcode updates, IPv6 privacy, partition mounting options, entropy sources, and physical security measures.
This guide explains Linux's SUID, SGID, and sticky bit permissions, shows how to inspect them with stat and ls, and provides step‑by‑step commands to set, verify, and revoke these special bits on files and directories.
This article explains how MySQL 8.0.27 adds multi‑factor authentication (MFA) via the new authentication_policy system variable, demonstrates configuring the variable, creating users with single or multiple authentication plugins, installing external plugins, and verifies MFA behavior with practical Docker‑based examples.
This article explains why Java bytecode is easy to decompile and introduces several practical techniques—including isolation, class encryption, native code conversion, and various forms of code obfuscation—to increase the difficulty of reverse‑engineering Java applications.
The article explains Minix’s origin as a teaching OS, its evolution into MINIX 3, its role inside Intel’s Management Engine, the security risks it introduces, and how it compares to Linux, highlighting why it may be the world’s most widely deployed operating system.
Under Jason Donenfeld’s leadership, Linux kernel’s random number generator was overhauled in versions 5.17 and 5.18, replacing SHA1 with BLAKE2s and shifting from per‑NUMA to per‑CPU structures, delivering up to a 131% speed increase and an astonishing 8450% boost in getrandom() performance on multi‑core systems.
This article provides a comprehensive guide on integrating Apache Shiro into a Spring Boot application, covering core components, Maven configuration, bean definitions, security manager setup, custom realms, filter chain configuration, and the complete login authentication flow with code examples.
This article outlines the design rationale, objectives, and technical choices for a unified, token‑based authentication system based on OAuth2 password grant and JWT, detailing terminology, workflow steps, security benefits, and interface specifications to enable cross‑system single sign‑on and secure access control.
This tutorial explains how to create a simple PNG CAPTCHA using PHP by generating a random four‑character code, drawing it with random rotation and position, adding noise lines and dots, and outputting the image for use in form validation.
The presentation outlines Alibaba Cloud's native data lake solution built on Apache Iceberg, covering data lake fundamentals, cloud migration challenges, Iceberg's architecture and features, real‑time ingestion with Flink, unified metadata management, security guarantees, and testing practices to ensure reliable, scalable big‑data analytics.
This article explains what DNS root servers are, how they function in the hierarchical name‑resolution process, why there are only thirteen IPv4 root addresses, where they are located worldwide—including China’s nodes—and lists common public DNS services for both IPv4 and IPv6.
This guide walks you through installing the Unix‑style Pass password manager on Linux, configuring GnuPG keys, initializing a secure password store, using basic Pass commands, and integrating it with browsers via PassFF for seamless, encrypted credential management.
This article explains how HTTP caching works, highlights security and privacy risks such as those introduced by the Spectre vulnerability, and recommends safe cache-control settings like using private caches and varying by Cookie to protect sensitive web resources.
This article traces the development of DevOps, explains how its evolution into DevSecOps integrates security early in the software lifecycle, outlines the resulting benefits of faster, cheaper, and safer delivery, and discusses the technical, cultural, and organizational challenges that must be overcome for successful adoption.
Elasticsearch 8.0 introduces major updates including 7.x REST API compatibility headers, default-enabled security with registration tokens, known issues on ARM/macOS, a preview KNN search API using dense_vector, storage reductions for keyword and text fields, faster geo indexing, PyTorch model support, and numerous other enhancements across aggregations, allocation, analysis, authentication, and core infrastructure.
This article explains ARMv8‑A AArch64 virtualization support, covering Stage 2 page‑table translation, virtual exceptions, traps, hypervisor types, memory management, device emulation, interrupt handling, clock virtualization, VHE, nested virtualization, and the performance overhead of context switches.
This guide outlines ten practical methods for Linux system administrators to identify signs of intrusion, from missing logs and altered password files to unusual network traffic and recovering deleted log files using process file descriptors.
This guide presents a concise set of best‑practice rules for designing consistent, RESTful backend APIs—including naming conventions, URL structures, HTTP methods, versioning, pagination, security, and documentation tools—to help developers create clear, maintainable, and user‑friendly services.
This article outlines ten lesser‑known Python security pitfalls—from optimized‑away asserts and directory permission quirks to path traversal, regex misuse, Unicode normalization attacks, and IP address normalization—illustrating how subtle language features can lead to serious vulnerabilities in real‑world applications.
Elasticsearch 8.0 introduces major updates including 7.x REST API compatibility headers, default-enabled security with enrollment tokens, protected system indices, a preview KNN search API, storage‑saving field encodings, faster geo indexing, and numerous deprecations and enhancements across aggregations, authentication, cluster coordination, and packaging.
Elasticsearch 8.0 introduces 7.x REST API compatibility headers, default‑on security features with automatic enrollment tokens, tighter protection of system indices, a preview KNN search API, storage‑saving field encodings, faster geo‑point and geo‑shape indexing, PyTorch model support, and a long list of deprecations and internal improvements.
