This article explains how QR code login works by describing QR code basics, token‑based authentication, and the step‑by‑step process that enables a mobile app to securely authenticate a PC or web client without transmitting passwords.
This article reviews the Ice Lake‑based next‑generation Intel SGX, compares its security and performance improvements over previous generations, presents detailed benchmark results on memory access, dynamic memory management and enclave switching, and describes software optimizations implemented in the Occlum runtime to mitigate remaining overheads.
This article explains how to configure Spring Boot 2.2.11's remember‑me feature using a persistent token repository, customize HttpSecurity, create the required database schema, and understand the underlying authentication flow through detailed code snippets and step‑by‑step analysis.
Arm's Vision Day unveiled the Armv9 architecture, highlighting three core pillars—enhanced security with Confidential Compute Architecture, AI acceleration, and advanced vector/DSP capabilities via SVE2—while outlining the roadmap, performance gains, and future CPU and GPU developments for the next decade.
Python 3.9.3 and 3.8.9 were released early with multiple security patches, OpenSSL CVE fixes, module hardening, FTP PASV safety, audit hooks, Unicode handling improvements, and various bug fixes for syntax errors, import cycles, recursion limits, SSL context, and SMTP authentication.
Microservice architectures increase deployment flexibility but also expand the attack surface, so this article outlines seven essential security best practices—including using an API gateway, layered defenses, DevSecOps, trusted encryption libraries, service-level protection, multi-factor authentication, and dependency vulnerability scanning—to safeguard microservice-based applications.
This guide explains what CSRF attacks are, outlines common defense strategies such as captchas, referer checks, and token validation, and provides a complete Spring Boot implementation—including custom annotations, token storage with Guava or Redis, an interceptor, configuration, and a token‑generation endpoint—complete with testing steps.
The article explains Java's String immutability, shows how concatenation creates new objects, and discusses the design reasons—caching, security, thread‑safety, hash‑code caching and performance—while recommending mutable alternatives like StringBuilder for modifiable text.
IntelliJ IDEA 2020.3.3 introduces a Trusted Projects feature that checks project trust, offers safe mode to block code execution, and provides configuration options to reduce security risks when opening unknown projects across various languages and build systems.
This article explains the fundamental concepts of API gateways, their design motivations, key features such as routing, load balancing, security, and elasticity, and compares popular implementations like OpenResty, Kong, Zuul, and Spring Cloud Gateway for microservice architectures.
This article explores methods to prevent user-injected JavaScript from manipulating DOM objects, including using Shadow DOM and Web Workers to create secure sandboxed environments.
Device fingerprinting uniquely identifies devices using collected data; this article explains how uniqueness and stability are measured, shows probability‑based calculations for single and combined fields, discusses the shortcomings of client‑side methods, and details a server‑side multi‑algorithm approach that improves security and stability.
This article explains what insecure deserialization is, why it leads to high‑severity attacks, demonstrates typical PHP, Ruby, and Java examples, and provides practical techniques for identifying, exploiting, and mitigating unsafe deserialization vulnerabilities.
The Spring nohttp project is an open‑source tool that scans and replaces insecure http:// URLs with HTTPS, preventing man‑in‑the‑middle attacks, updating Maven and documentation links, offering multiple modules and a command‑line interface, and providing example XML configuration for secure classpath resolution.
This guide walks operations engineers through comprehensive Linux hardening techniques—including account and login protection, unnecessary service removal, password and key authentication policies, proper use of sudo, system welcome message sanitization, file‑system safeguards, and practical rootkit detection with chkrootkit and RKHunter—plus a step‑by‑step response plan for compromised servers.
This article explains how to boost the efficiency of massive regular‑expression matching by using Intel's Hyperscan library, integrating it with Apache Flink for streaming processing, and providing deployment guidelines for both private and internal environments.
The article examines China's push for free public data sharing, highlighting policy directives, the need for top‑level design, security standards, and education to create a unified, safe data‑governance framework that fuels the digital economy.
This guide walks you through setting up Spring Authorization Server 0.1.0 on Spring Boot 2.4.2, covering Maven dependencies, bean configurations, token customization, and testing with curl commands for authorization code flow, token issuance, refresh, and revocation.
This guide presents a comprehensive checklist of Kubernetes best practices covering container image selection, registry authentication, namespace isolation, labeling, annotations, RBAC, pod security policies, network policies, secrets management, image scanning, CI/CD, canary releases, monitoring, service mesh, and admission controllers to help you build secure, stable, and scalable production clusters.
This article explains how to boost massive regular‑expression matching speed by using Intel's Hyperscan engine together with Apache Flink for streaming, covering security scenarios, architectural challenges, deployment options, usage examples, performance results, and future enhancements.
The Python Software Foundation released Python 3.8.8 and 3.9.2 to patch CVE‑2021‑3177, a buffer‑overflow flaw in ctypes that enables remote code execution and denial‑of‑service attacks, prompting users to upgrade immediately to protect their systems.
This roundup covers Huawei’s new "Hongmeng" trademark filing, Ma Huateng’s advice on focusing on services over features, a death‑threat email sent to curl’s creator, Richard Brodie’s nostalgia for classic Word, state‑owned enterprise reforms in China, a survey on tech workers’ actual hours, and a Chinese AI team’s breakthrough in monkey‑face recognition.
This article explains Apache Ranger's role as a centralized security framework for Hadoop, detailing its key features, architecture, policy workflow, practical administration examples, and how to automate bulk policy management with Java and REST APIs.
The article examines Fastjson’s features, demonstrates basic usage, compares it with other Java JSON libraries, and explains why the author decided to abandon Fastjson due to its lower popularity, design shortcomings, numerous open issues, and a history of serious AutoType vulnerabilities.
This article outlines comprehensive Docker security best practices covering infrastructure hardening, image trust and scanning, and access/authentication controls to help organizations safeguard containerized applications in cloud‑native environments.
This article explains the inherent security risks of cloud‑native Kubernetes deployments—such as workload, namespace, and CRD cascading deletions and concurrent pod updates—and presents practical OpenKruise‑based protection techniques like label‑driven cascade‑deletion blocking, pod‑deletion flow control, and automatic PUB/PDB generation to ensure runtime stability.
This article introduces a behavior‑based captcha solution that replaces traditional text captchas with slide‑puzzle and click‑word challenges, explains its terminology, interaction flow, project directory layout, and provides online demo links for both web and mobile implementations.
This tutorial walks through setting up Spring Authorization Server on Spring Boot 2.4.2, covering Maven dependencies, custom bean configuration, token generation, testing with curl commands, and token customization options, providing a complete example for OAuth2 authorization implementation.
This week’s roundup covers the Shenzhen court ruling that WeChat friend lists are not personal privacy, Microsoft’s removal of legacy Edge, the formation of the Rust Foundation, a novel supply‑chain attack on 35 tech firms, Linux floppy driver updates, Go generics progress, and other notable industry developments.
This article provides a comprehensive overview of the Domain Name System, explaining how hostnames map to IP addresses, the hierarchical distributed design of DNS servers, query processes, caching mechanisms, packet structures, common attack vectors, and defensive measures such as DNSSEC.
This guide explains how to configure module IP access restrictions in ThinkPHP by adding 'allow_module_ip' and 'deny_module_list' entries to config.php, shows the recommended placement, and demonstrates the necessary modifications to the framework's App.php file to enforce the rules.
This comprehensive guide covers 66 key computer networking topics, from the evolution of HTTP protocols and request methods to TCP/IP fundamentals, TLS/HTTPS security, web performance optimization, caching strategies, cookies, tokens, and common interview questions, providing clear explanations, diagrams, and practical examples for developers.
This article explains how to extract RGB values from a CAPTCHA image with PHP, convert the pixel data into binary patterns, map those patterns to digits using a predefined dictionary, and achieve 100% recognition accuracy, illustrating a practical backend security technique.
This article compiles the most influential 2021 software development trends—from cloud, edge, containers, AI, blockchain, and more—alongside curated deep-dive resources covering frontend innovations such as smart code generation, TypeScript declarations, authentication mechanisms, node_modules challenges, React best practices, security protocols, and operational resilience.
This article outlines comprehensive production‑grade Kubernetes best practices—including health probes, RBAC, resource management, network policies, monitoring, autoscaling, image security, and zero‑downtime strategies—to help teams run secure, efficient, and highly available workloads.
This guide explains how to install the php-dfa-sensitive library via Composer, create a SensitiveWords service class with helper methods, configure custom word dictionaries, and use the provided static functions to detect, replace, or mark sensitive words in PHP projects.
This guide explains how to use Nginx configuration directives to deny execution of uploaded scripts, block access to specific file types and directories, return custom HTTP status codes, and limit access by client IP to improve web server security.
This article explains the most important non‑functional characteristics of software architecture—such as performance, reliability, availability, resilience, scalability, security, and many others—and provides practical techniques and best‑practice recommendations for enhancing each of these qualities in modern systems.
This article examines how modern software development relies heavily on external dependencies, outlines the hidden risks they introduce, and provides a comprehensive set of guidelines—including design review, code quality checks, testing, licensing, and isolation techniques—to help teams evaluate, monitor, and safely manage third‑party packages.
This guide walks Linux operations engineers through common signs of a compromised host—such as missing logs, altered password files, unexpected login events, and deleted critical files—and provides concrete command‑line techniques for detection, investigation, and recovery using tools like ll, du, lastlog, who, lsof, and tcpdump.
This guide outlines comprehensive Linux security hardening steps—including account protection, service minimization, password policies, sudo usage, file system safeguards, rootkit detection tools, and post‑attack response—to help operations teams secure their servers against common threats.
This weekly roundup covers a Flash‑related railway incident, QQ’s browser‑history scanning, Apple’s WeChat‑compatible code, Elastic’s move to SSPL, AWS’s Elasticsearch fork, China’s GitHub alternative, RHEL’s free small‑business offer, a Windows 10 crash bug, IntelliJ IDEA’s 20‑year milestone, Visual Studio’s native WSL2 support, Brave’s IPFS support, Linux distributions dropping Chromium, a GDPR fine in Germany, the US revoking Intel‑Huawei supply licences, and Tencent’s defence of its data‑collection practice.
This guide explains how to set up SSH certificate‑based authentication by creating a Certificate Authority, generating user and host keys, signing certificates, configuring both server and client to trust them, and managing revocation, offering a more secure alternative to password or key‑pair logins.
This article explains the fundamentals of Single Sign-On (SSO) and the CAS framework, outlines suitable use cases, compares three implementation approaches, details key CAS components and ticket types, and walks through a step‑by‑step cross‑domain SSO deployment process.
The article reviews MySQL 8.0.23's maintenance release, detailing new features such as invisible columns, query attributes, security enhancements, InnoDB auto‑extend size, replication terminology changes, X protocol improvements, and various deprecations, providing code examples and links to official documentation.
This guide explains Kafka's authentication and authorization mechanisms, covering SASL/PLAIN and SASL/SCRAM setups, JAAS file creation, server property configuration, ACL management, and provides complete Java producer and consumer examples for secure communication.
This guide provides system administrators with a step‑by‑step checklist to audit and harden Linux operating systems, covering account management, password policies, service restrictions, filesystem permissions, logging configuration, and practical command examples for comprehensive security compliance.
This article explains how to protect front‑end/back‑end separated interfaces by designing an API signature scheme that includes appId, appSecret, timestamp, nonce and signature, detailing the generation process, request validation, anti‑replay measures and implementation using a custom filter in Java.
This article introduces several essential Linux commands—including crypt (via mcrypt), various kill utilities, shred for secure deletion, zombie process identification, the at scheduler, and daemon management—explaining their purposes, usage examples, and relevant options for system administrators.
This article reviews seven popular static code analysis tools, outlining why static analysis matters, each tool's key features, drawbacks, supported languages, and pricing to help developers choose the right solution for improving code quality and security.
Designing a distributed system involves overcoming major challenges such as heterogeneity, transparency, openness, concurrency, security, scalability, and fault tolerance, each requiring careful consideration of hardware, software, network, and management aspects to build robust, scalable, and secure architectures.
This article explains why permission systems are essential, introduces the RBAC model and its variants, outlines its key characteristics, and guides you through designing a basic role‑based access control system with practical examples and diagrams.
This article reviews Java persistence technologies, shows how raw string concatenation in JDBC, MyBatis, JPA/Hibernate and native SQL can lead to SQL injection, and provides concrete safe‑coding patterns such as PreparedStatement, #{ } bindings, named parameters, and dynamic‑SQL safeguards.
This comprehensive guide explains TCP vs UDP, the three‑way handshake, four‑way termination, half‑open queues, SYN‑Flood attacks, header fields, timestamps, Fast Open, retransmission timeout calculations, flow control, congestion control, Nagle’s algorithm, delayed ACKs and keep‑alive mechanisms, providing essential knowledge for networking interviews and system design.
Auditing Linux system operations is essential for security and troubleshooting, but excessive logs can overwhelm analysis; this guide outlines common filtering rules and compares five recording methods—history, custom bash, snoopy, auditd, and eBPF—highlighting their advantages, limitations, and practical configuration examples.
This article examines Service Mesh security by outlining core requirements, detailing Istio’s built‑in zero‑trust mechanisms—including mutual TLS, AAA, and automatic certificate rotation—and comparing the security features of Linkerd and Alauda Service Mesh, offering practical insights for designing robust microservice protection.
This article demonstrates how to use Python's zipfile module to open and extract password‑protected ZIP archives, explains the required parameters, shows successful and failed extraction attempts, and provides a simple brute‑force script that iterates numeric passwords to recover the archive's contents.
This article analyzes token-based identity authentication in multi‑client information systems, classifies various token types, compares their natural and controllable attributes, proposes a four‑layer hierarchy, and discusses practical usage scenarios and design principles to improve security and privacy.
Huatai Securities' data science development platform passed the DevSecOps security and risk management assessment at level 2, showcasing advanced domestic security practices, and the interview reveals the cultural, procedural, and technical steps that enabled this achievement and future improvement plans.
The 2020 GOLF+ IT New Governance Leadership Forum in Beijing showcased Ping An Bank's Smart Due Diligence System passing the first DevSecOps security and risk management assessment, highlighting the role of the Starlink platform in integrating DevOps practices, enhancing security, and driving industry‑wide IT governance improvements.
The article details how Industrial and Commercial Bank of China’s mobile banking project passed the DevSecOps security and risk‑management assessment, outlining the standards, implementation steps, challenges faced, and the benefits gained for both the organization and the broader financial industry.
The article introduces the widely‑starred GitHub project “Node.js Best Practices,” highlighting its multilingual documentation, comprehensive coverage of project structure, error handling, coding standards, testing, production, security, and performance, and encourages readers to visit the repository for detailed guidance.
This article explains why Kerberos is needed for Hadoop clusters, details the Kerberos authentication workflow, and provides step‑by‑step instructions for configuring Flink to run on a Kerberos‑protected YARN environment using delegation tokens or keytab files, along with proxy‑user settings.
This step‑by‑step guide shows how to deploy a production‑grade log collection pipeline by installing Filebeat on log sources, forwarding logs to a hardened Kafka cluster, processing them with Logstash, storing them in an Elasticsearch 7.2.0 cluster secured with X‑Pack, and visualizing the data in Kibana, all on CentOS 7.6 with detailed security hardening, configuration scripts, and verification commands.
Explore a curated collection of cutting‑edge frontend knowledge—including a zero‑cost micro‑frontend framework, reasons to drop CSS @apply, canvas‑based electronic signatures with PDF output, large‑scale SSR strategies, Chrome 87 enhancements, ECMAScript 2021 features, XSS defenses, automated SVG icon delivery, ESLint best practices, JavaScript metaprogramming, node_modules pitfalls, Monorepo management, and Rax mini‑program runtime insights.
This article explains the fundamentals of the HTTP protocol, its security weaknesses, illustrates man‑in‑the‑middle attacks, and shows how symmetric and asymmetric encryption together with TLS/SSL and a CA‑based certificate chain secure communications in HTTPS.
Auditing Linux system operations can be streamlined by applying filtering rules to exclude noisy cron and daemon logs, avoiding sensitive command exposure, and choosing appropriate recording methods—such as history, custom bash, snoopy, auditd, or eBPF—each with distinct advantages, limitations, and configuration examples.
This guide walks through essential Linux security measures, covering common attack vectors, network and OS hardening, firewall configuration with iptables, user and group management, and detailed file‑permission techniques, providing practical commands and examples for robust system protection.
This guide explains how to configure the vsftpd FTP server on Linux, covering port settings, disabling anonymous and real user logins, active and passive mode configuration, firewall rules, and step‑by‑step creation of virtual users with PAM authentication and per‑user configuration files.
This article summarizes recent developments across data‑center, cloud, 5G, edge, AI, security, automotive and aerospace sectors, including new partnerships, product launches, government contracts, and emerging threats shaping the pervasive computing landscape.
The article explains how the vague term “user” creates design flaws and security vulnerabilities across domains such as airline booking systems, Unix environments, and SaaS platforms, and argues for precise terminology to avoid costly rework and confused‑deputy attacks.
This whitepaper provides a detailed, end‑to‑end framework for organizations and technical leaders to understand, implement, and continuously improve security across the cloud‑native lifecycle—covering development, release, deployment, runtime, supply‑chain protection, zero‑trust architecture, and compliance—while emphasizing automation, observability, and cross‑functional collaboration.
This article explains the mechanisms of HTTPS certificate verification in Android, outlines various implementation methods, demonstrates how to bypass verification using tools like JustTrustMe and SSLkiller, and provides detection and protection strategies for developers to safeguard their apps against such attacks.
The DataFunTalk year‑end conference will be held online on December 19‑20, featuring over 90 speakers across multiple forums covering recommendation algorithms, knowledge graphs, AI, big data, security, and product development, with detailed session schedules, speaker bios, and registration information.
This guide explores several powerful yet intimidating Linux commands—including crypt, kill, shred, zombie process detection, at midnight scheduling, and daemon management—explaining their purposes, usage nuances, and safety considerations for system administrators and power users.
This article examines the classification, security attributes, and hierarchical design of various authentication tokens for multi‑client systems, offering a layered approach that balances usage cost, change cost, and privacy while outlining practical scenarios and implementation principles.
This guide explains how to use Nginx directives to deny execution of uploaded script files, block specific file types, restrict directory access, and limit client IPs, thereby strengthening website security for user‑facing services.
This guide explains WireGuard's strict kernel requirements, shows how to upgrade kernels on various Linux distributions, provides detailed commands for installing WireGuard on older kernels, and introduces a one‑click script that automates configuration, firewall adjustments, and client management.
This article explains how to use JWT tokens in a Java backend to prevent duplicate form submissions, covering the problem of repeated clicks, two mitigation approaches, detailed token generation utilities, session handling methods, and practical code examples for creating, validating, and managing tokens.
This article compares Spring and Spring Boot, explaining their fundamental concepts, Maven dependencies, MVC and security configurations, template engine setup, startup mechanisms, and packaging options, while providing practical code examples to help Java developers choose and migrate between the two frameworks.
This article describes Ctrip's adoption of Cilium with BGP to build a high‑performance, eBPF‑based cloud‑native network, covering the evolution from Neutron+OVS, the BGP peering model, traffic forwarding paths, L4 load‑balancing, security policy implementation, and multi‑cluster integration using ClusterMesh.
This article details Laiye Technology's end‑to‑end security strategy—including application hardening, password policies, brute‑force defenses, SQL injection, XSS and CSRF mitigations, privilege controls, secure file uploads, code‑review standards, and infrastructure vulnerability scanning—to protect sensitive data and AI‑driven robot platforms from a wide range of attacks.
This article explains why robust systems are essential, outlines key architectural and design principles, presents practical implementation details such as service layering, micro‑service migration, container simulation code, timeout handling, monitoring, security measures, and performance tuning to help engineers build reliable, scalable backend applications.
KASAN, the Kernel Address Sanitizer, is a built‑in Linux kernel tool that uses shadow memory to mark each 8‑byte block’s accessibility, enabling detection of out‑of‑bounds and use‑after‑free errors while consuming about one‑eighth of RAM and requiring kernel configuration changes to activate.
This article introduces Harbor, an enterprise‑grade Docker image registry designed for cloud‑native environments, detailing its efficient distribution mechanisms, security features such as signing and vulnerability scanning, HA solutions, and step‑by‑step installation methods using offline packages, Docker‑compose, and Helm charts.
This article explains Android's Binder inter‑process communication mechanism, compares it with other Linux IPC methods, describes its architecture in both Java and native layers, outlines the security advantages, and details the underlying kernel protocol and command set.
This article explains how to write and integrate ARM64 inline assembly in iOS applications to implement anti‑debugging checks, discusses the syntax, constraints, calling conventions, common pitfalls, and provides complete assembly‑only solutions for secure runtime detection.
This article examines reliable and relatively reliable methods for executing untrusted JavaScript code in Node.js, comparing new Function, the VM module, and Worker Threads, discussing their isolation levels, memory and CPU limits, performance overhead, and extending to container and WebAssembly security solutions.
In a detailed interview, UCloud’s virtual network lead Zhou Jian explains how the company’s SDN‑based solutions address heterogeneous network challenges—security isolation, performance, and consistent user experience—through programmable VPCs, hybrid gateways, global traffic cleaning, and multi‑cloud connectivity, illustrating the evolution from VPC 1.0 to today’s global backbone.
This article explains the principles and workflows of typical authentication mechanisms—including HTTP Basic authentication, cookie‑based sessions, JSON Web Tokens, and OAuth—detailing their encryption processes, storage strategies, token refresh techniques, and security considerations for modern web applications.
An interview with Red Hat engineer Bethany Griggs reveals how Node.js 15 addresses security, error handling, and future priorities while responding to Ryan Dahl’s criticisms that inspired the Deno runtime, highlighting the platform’s role in cloud‑native microservices and server‑side JavaScript.
This guide explains how to start, stop, restart, enable, and disable the firewalld service on CentOS 7, add or remove ports, list open ports, and perform related queries using firewall‑cmd and ss commands.
This article examines the evolution, core requirements, architectural models (centralized and decentralized), persistence strategies, scalability, high availability, performance optimization, security mechanisms, and additional design trade‑offs of distributed file systems, providing a comprehensive overview for architects and engineers.
This article explains the severe risks of CSRF attacks for web services, debunks common misconceptions, and presents six concrete development rules plus a Koa2 code example to effectively protect Node.js back‑ends, especially in financial applications.
Chrome 86 introduces stable File System Access APIs, blocks mixed‑content downloads, adds ParentNode.replaceChildren, enhances HTTP security warnings, and unveils experimental WebHID, Multi‑screen Placement, and :focus-visible features while deprecating WebComponents v0 and FTP support.
Security researcher William Bowling discovered that Rails' url_for helper can be abused via controllable parameters to create open redirects and account takeover on GitHub Gist, allowing theft of OAuth tokens and earning a $10,000 bounty.
This article introduces a SpringBoot-based backend demo that integrates MyBatis-Plus, Apache Shiro, and JWT, outlines its custom annotations and security features, explains the request flow, and provides step‑by‑step instructions for setting up the database, configuring the environment, and running the application.
This article provides a comprehensive guide to customizing Laravel's built‑in authentication system, covering route parameters, controller generation, password confirmation, device logout, redirect logic, user creation via Tinker and factories, login throttling, and additional credential checks, all with practical code examples.
This guide walks you through the essential steps for handling WeChat Pay V3 integration, including obtaining and parsing the API certificate with Java's KeyStore, extracting the key pair, constructing the required signature string, performing SHA256withRSA signing, and assembling the Authorization token for secure payment requests.
This article explains how Tencent's self‑developed KonaJDK underpins cloud Java services, enhances micro‑service monitoring, adds national cryptography support, optimizes large‑heap tools like jmap, and delivers performance gains for big‑data workloads, while contributing key features back to the OpenJDK community.
