The article introduces the concept of an egress gateway, explains why iQIYI’s member‑cooperation services require a unified outbound gateway to handle IP‑whitelisting and external access, critiques the limitations of an Nginx proxy, and describes adopting APISIX with security, traffic‑control plugins and a UI‑driven URL translation layer.
This article explains how to build a dynamic IP blacklist that blocks malicious crawlers or users by using Nginx with a Lua access script and Redis for storage, covering requirements, environment setup, design choices, configuration steps, Lua code, and advanced extensions.
This article explains how to securely hash passwords in PHP using the password_hash function, demonstrates code examples for hashing and verifying passwords, discusses automatic salting, and highlights best practices for protecting user credentials.
This article explains how static resource handling via WebMvc.fn or WebFlux.fn can be exploited for path traversal, lists the affected Spring Framework and Spring Boot versions, and provides mitigation steps such as upgrading, enabling Spring Security HttpFirewall, or switching to Tomcat/Jetty.
The article recounts a real‑world incident where a device’s MAC address could not be changed because a previous engineer deliberately disabled the relevant function, discusses the discovery of the backdoor code, and examines the legal and ethical implications of such intentional vulnerabilities.
This article explains how JWT provides stateless user authentication while Session adds an extra security layer and state management, detailing their respective roles, the reasons for using Session alongside JWT, and offering Java code examples that illustrate their combined implementation.
Recent disclosures revealed critical Spring DoS flaws (CVE‑2024‑38809 and CVE‑2024‑38808) exploitable via oversized If‑Match/If‑None‑Match headers and malicious SpEL expressions, plus a Nacos 2.4.1 vulnerability allowing arbitrary file read/write through port 7848, mitigated by upgrading to the patched Spring and Nacos releases or restricting the vulnerable ports.
This article explains PHP's is_executable() function, its definition, parameters, return values, provides a full code example, discusses usage notes, and outlines common scenarios such as securing uploaded files, checking executable status, and verifying file permissions.
The article explains how to protect Spring Boot applications from XSS attacks by using custom annotations such as @XSS with an XssValidator and by implementing a request‑filter chain—including XssFilter and XssWrapper—to sanitize input, demonstrating through tests that both approaches reliably secure user data.
This guide outlines a complete security strategy for SaaS startups, covering external threats such as network attacks and data leaks, as well as internal risks like access control, host protection, code safety, log management, and third‑party integration, providing practical solutions and best‑practice recommendations.
PHP 8.4, released on November 21, 2024, introduces performance, usability, and security enhancements such as property hooks, a parenthesis‑free new operator, powerful array functions, an HTMLDocument class, new Sodium algorithms, a request parsing helper, stricter type declarations, JIT optimizations, and migration of several extensions to PECL.
The guide equips candidates for backend interviews by covering essential networking (HTTP/HTTPS, TLS handshake, status codes, headers, OCSP, session resumption, CSRF), RPC frameworks, Java class-loading and JVM memory/GC, OS process/thread scheduling, Spring bean lifecycle, Redis caching pitfalls, and MySQL indexing and query optimization.
This guide outlines comprehensive best practices for database server operations, covering hardware selection, OS and kernel tuning, storage choices, MySQL configuration, performance monitoring, backup strategies, security measures, high availability, automation, and systematic maintenance procedures to ensure optimal reliability and efficiency.
This article explains the concept of Single Sign‑On (SSO), outlines its implementation process—including user redirection, token generation, and cross‑system authentication—discusses challenges such as single point of failure, complexity, and cross‑domain issues, and highlights typical use cases in enterprise and e‑commerce environments.
At the 2024 OpenSource Summit China in Hong Kong, Linus Torvalds and Dirk Hohndel discussed the Linux kernel’s development roadmap, release cadence, security practices, the slow adoption of Rust, and the potential role of AI, while sharing candid views on cloud, Kubernetes, and legacy kernel support.
This article explains how to use PHP's session_regenerate_id function to securely regenerate session IDs, discusses the reasons for doing so, provides sample code, and outlines important precautions such as starting the session, using HTTPS, and avoiding excessive regeneration.
This article explains third‑party authorization login, using WeChat as a concrete example, and provides a detailed walkthrough of the OAuth2.0 protocol, its roles, grant types, token handling, and implementation steps for mobile and web applications.
This article explores why Android apps are increasingly linked in AI‑driven security assessments, examines academic papers on feature extraction, compares static and dynamic obfuscation techniques, reviews industry protection solutions, and proposes a plug‑in‑based dynamic obfuscation framework that maximizes feature dispersion while preserving app functionality.
This article provides a comprehensive, step-by-step tutorial on checking, installing, editing, and applying iptables firewall rules on a Linux system, including common port allowances, ICMP handling, rule persistence, and startup configuration using command-line examples.
This article analyzes recent critical security flaws in Spring Framework (CVE‑2024‑38808 and CVE‑2024‑38809) and Nacos Jraft port, explains their impact, provides version‑specific mitigation steps, code snippets for Spring Boot fixes, and offers additional hardening recommendations for developers and operators.
This guide explains how to use tcpdump on Linux to capture all traffic, filter by IP or port, save to files, read pcap files, and apply advanced filters, while highlighting important security, permission, and storage considerations.
This guide explains what Java Agents are, their core capabilities such as bytecode enhancement, performance monitoring, security checks, and debugging, and provides step‑by‑step instructions for implementing the premain method, creating a ClassFileTransformer, packaging the agent with Maven, and loading it both statically and dynamically.
A newly disclosed Linux kernel vulnerability called "indler"—a 0‑day memory‑corruption bug hidden since 2012—was uncovered by security researcher Zhang Yinkui, who detailed its discovery via a random kernel oops, KASAN detection, and its potential for massive remote code execution across billions of devices.
This comprehensive guide explains Nginx's high‑performance architecture, module system, multi‑process model, FastCGI integration, configuration best practices, tuning techniques, error troubleshooting, and a known PHP‑related vulnerability, providing practical steps for optimal deployment on Linux servers.
The article compares token‑based authentication options for Java microservices—stateless JWTs, OAuth 2.0 with access and refresh tokens, a centralized API‑gateway authority, and internal service‑to‑service schemes—guiding readers on selecting the best approach according to security, scalability, and business needs.
This article presents an embedding‑based method for time‑series anomaly detection in security and anti‑cheat scenarios, explains how to vectorise logs, sample and compute distribution features, details implementation code, and validates the approach with four synthetic experiments showing precision‑recall improvements at day and hour granularity.
This article introduces PHP 7.4's Foreign Function Interface (FFI), explains how to enable it, demonstrates basic usage and advanced examples for calling C functions, discusses performance considerations, security best practices, troubleshooting, and future directions for PHP developers.
This article presents a detailed case study of Ctrip's large‑scale desktop IT management solution, describing the challenges of handling tens of thousands of office PCs, the full‑link architecture built with Rust, Tauri, SpringBoot and Django, automated health monitoring, fault detection, remediation workflows, security measures, performance optimizations, and the measurable operational improvements achieved.
This article explains what an API gateway is, outlines its core functions such as routing, load balancing, security, rate limiting, aggregation and caching, and reviews ten popular gateway solutions—including Amazon API Gateway, Kong, Apigee, NGINX, Tyk, MuleSoft Anypoint, Azure API Management, IBM API Connect, Kubernetes‑native options, and Traefik—highlighting their key features and typical use cases.
This guide explains GPG's public‑key signature technology, walks through generating and managing ED25519 keys, shows how to sign and verify files, and provides configuration steps to use GPG without passphrase prompts, ensuring data integrity and authenticity.
Researchers from Truffle Security revealed that GitHub's delete function often fails to truly remove data, exposing a new Cross Fork Object Reference (CFOR) vulnerability that allows anyone with a commit hash to access deleted or private repository data, posing serious security risks.
This article examines frequent security and quality pitfalls in PHP development—such as deprecated functions, SQL injection, XSS, insecure file inclusion, poor error handling, session hijacking, hard‑coded credentials, insufficient input validation, outdated versions, and low code quality—and provides concrete best‑practice recommendations to avoid them.
This article compiles 19 practical Linux, security, networking, and Python interview questions covering command‑line techniques, system monitoring, load‑balancing, HTTP protocols, common vulnerabilities, TCP handshakes, TIME_WAIT optimization, and code snippets to help candidates prepare for sysadmin roles.
This article presents comprehensive guidelines for designing robust, secure, and maintainable enterprise services, covering API path conventions, request handling, input/output parameter design, business logic recommendations, exception handling, dependency management, monitoring, degradation strategies, encryption, and system admission practices.
This article outlines comprehensive best‑practice guidelines for designing robust, secure, and maintainable backend services—covering API path conventions, request handling, parameter design, error codes, dependency management, monitoring, degradation strategies, legacy service handling, encryption, access control, and tamper‑proof mechanisms, with practical code examples.
Zephyr RTOS 3.7.0 LTS was released on July 26, 2024, introducing over 650 contributors, new hardware models, expanded POSIX and Bluetooth support, numerous API changes, extensive driver updates, enhanced networking features, and a series of security patches covering multiple CVEs.
This article outlines the most frequent Kubernetes pitfalls—such as missing resource requests, omitted health checks, using the :latest tag, over‑privileged containers, insufficient monitoring, default namespace misuse, weak security settings, absent PodDisruptionBudgets, lack of pod anti‑affinity, and improper load‑balancing—and provides concrete commands, YAML examples, and best‑practice recommendations to prevent them.
The article argues that despite advances in tools and practices, modern software quality has declined over the past ten years due to factors such as increasing complexity, lack of focus, superficial engineering culture, and inadequate attention to reliability, usability, and security.
This article explains the OAuth 2.0 authorization framework, its core concepts, architecture, key roles, and implementation patterns for web, user‑agent, and native applications, helping readers grasp how delegated access works without sharing user credentials.
The article presents a comprehensive case study of Ctrip's full‑chain desktop operations system, detailing its architecture, cross‑platform Rust/Tauri agents, SpringBoot server, security measures, operational challenges, performance optimizations, and the measurable improvements in fault detection and repair across a massive corporate PC fleet.
The article examines the recent Windows BSOD crisis caused by a faulty CrowdStrike update, argues that memory‑unsafe languages like C/C++ contributed to the failure, and explains how Microsoft and the industry are turning to the memory‑safe Rust language for system, firmware, and cloud components to improve reliability and security.
Version 1.2 of the Linux Emergency Handbook introduces critical updates such as SSH key backdoor checks, detailed command timestamp logs, new journalctl log viewing techniques, enhanced password checks, added data USB guidance, and revamped post‑incident stages including routine security checks, loss assessment, and targeted investigations.
This article examines three categories of techniques—naïve, conventional, and advanced—for enabling fuzzy queries on encrypted data, comparing their implementation steps, performance impact, storage overhead, and security trade‑offs, and provides practical examples and reference links for further study.
This guide walks through practical Linux security hardening on RHEL7, covering account control, password policies, SELinux configuration, SSH restrictions, firewall rules, file attribute protections, and other measures to elevate the system to a B1 security level.
This article examines how mismatched read/write implementations in Android's Parcelable and AIDL mechanisms create exploitable IPC vulnerabilities, outlines several historical bug patterns, and discusses potential attack vectors and mitigation strategies.
This article compares the emerging system language Rust with the veteran web language PHP, examining their core features, performance, safety, learning curves, ecosystems, and deployment considerations to help developers choose the right tool for their specific project needs.
This article outlines six practical strategies to upgrade CI/CD pipelines, including performance and device‑compatibility testing, visual regression and accessibility checks, automated security scans with Dependabot, blue‑green deployments, phased testing, infrastructure‑as‑code integration, and automated rollback checkpoints, helping teams deliver higher‑quality software faster.
Learn step-by-step how to prepare your Linux server, download and install Docker 20.10.24 manually, configure daemon settings, set up systemd service, start and verify the engine, and apply essential security and optimization practices for reliable production deployments.
This article provides a comprehensive guide to Python's eval() function, covering its syntax, parameters, execution process, differences between globals and locals, dynamic versus static execution, common use cases, security risks, and alternatives such as ast.literal_eval() and exec().
This article explains what JSON Web Tokens are, outlines their typical workflow, and critically examines their drawbacks—including size overhead, redundant signatures, revocation challenges, lack of encryption, and broader security concerns—before concluding with practical recommendations for their use.
This guide explains the concept of Linux user namespaces, how they isolate UID/GID for Docker containers, the required subuid/subgid mappings, step‑by‑step daemon configuration, verification commands, and known limitations when using user namespace isolation.
This article explains how to securely hash passwords in PHP using the password_hash function, covering the concept of hashing, code examples for creating and verifying hashes, automatic salting, and best practices for protecting user credentials.
The article examines how AI-era large language model (LLM) applications impose new traffic, security, and scalability requirements on gateways, and explains how the Envoy‑based open‑source Higress gateway addresses these challenges with hot configuration updates, token‑based rate limiting, streaming support, and multi‑tenant capabilities.
This article explains the evolution from traditional cookie‑session authentication to token‑based JWT, detailing its structure, security mechanisms, implementation steps, advantages, limitations, and practical Java code examples, while also comparing it with modern authentication challenges in web and mobile environments.
This article explores essential service design considerations beyond standard guidelines, covering API path structuring, request handling, parameter design, security measures, monitoring, degradation strategies, and code examples to help build flexible, secure, and maintainable backend services.
This article explains what JWT is, how it works in authentication flows, and details its major drawbacks—including large token size, redundant signatures, revocation difficulties, stale data risks, and lack of encryption—while concluding that JWT may be suitable only for short‑lived, single‑use scenarios.
This article examines the historical evolution of login authentication technologies, from simple cookie‑based methods to token mechanisms, unified account centers, OAuth 2.0, and modern one‑click solutions, while discussing design considerations, security challenges, and future trends such as AI‑driven identity verification.
The article outlines how a VOD provider standardized its multi‑vendor CDN back‑source architecture by classifying videos as hot or cold, prioritizing fragment‑level pulls, throttling full‑file transfers, implementing real‑time monitoring, decoupling storage buckets, and adding OSIG authentication to reduce latency, bandwidth pressure, and security risks.
This article lists the six most hazardous Linux commands, explains why they can cripple a system, and provides practical safeguards to prevent accidental system destruction while highlighting proper usage practices for each command.
This article introduces several widely used PHP encryption algorithms—including MD5, SHA family, AES, RSA, and Base64 encoding—explaining their functions, security considerations, and PHP functions for implementation, while also mentioning additional algorithms like DES, RC4, and Blowfish for specific use cases.
This article explains the motivations for creating a custom PHP framework—such as meeting specific project needs, deepening technical understanding, ensuring long‑term maintainability, optimizing performance, improving usability, and enhancing security—while outlining the curriculum of the accompanying tutorial series.
This article analyzes a class of historical Android Parcelable vulnerabilities, explains the LazyValue mechanism and its use‑after‑recycled issue, demonstrates how negative length fields can rewind parcel pointers, and outlines exploitation steps and patch locations.
An RCE vulnerability (CVE‑2024‑32002) in Git allows attackers to embed malicious hooks via a recursive submodule and a case‑insensitive symlink, so that cloning the repository executes arbitrary code such as launching the calculator, affecting Git versions up to 2.45.0 unless patched.
This guide explains multiple Linux techniques—including nologin shells, sshd_config allow/deny lists, and hosts.allow/hosts.deny rules—to prevent selected users, groups, or IP addresses from logging in via SSH, with practical commands, examples, and a ready‑to‑run script.
This tutorial explains step‑by‑step how to set up a secure OAuth2 authorization‑code server in PHP, covering the OAuth flow, library installation, server code, database schema, and testing with curl.
This guide explains the principles of MD5 and SHA‑512 checksums, demonstrates how to generate and compare them using Linux commands such as md5sum and sha512sum, and shows how to automate integrity verification for files like calico.yaml during transfer or backup.
This article examines PHP 8’s major features such as JIT compilation, union types, attributes, match expressions, constructor property promotion, and null‑safe operator, then outlines anticipated PHP 9 improvements including enhanced JIT, native async/await, richer type system, standardized error handling, and stronger security.
The article details Ant Group’s security parallel aspect fusion AI solution, selected as an exemplary case at the 2024 World Intelligent Industry Expo, explaining its multi‑dimensional data collection, large‑model integration, baseline construction, knowledge‑graph generation, and superior threat‑detection performance.
This guide explains role‑based access control (RBAC), shows how to map users to roles and permissions, and provides a complete Jenkins pipeline example—including role configuration, permission assignment, and validation—for admin, development, and operations teams.
This article introduces eBPF, explains its zero‑intrusion observability advantages, describes its architecture and runtime workflow, outlines development prerequisites and compilation steps, and provides concrete Go‑based examples for tracing bash commands and measuring TCP connection latency.
This article explains the principles, core implementations, performance trade‑offs, and typical use cases of 4‑layer (transport‑level) and 7‑layer (application‑level) gateways, helping readers understand how each operates within the OSI/TCP‑IP models and choose the appropriate solution for their network architecture.
This article explains three common methods—eval, ast.literal_eval, and json.loads—for converting quoted Python strings into executable code or data structures, outlining their advantages, disadvantages, and appropriate use cases.
This article explains Python's eval() function, demonstrates basic and variable usage, highlights security risks, and presents safer alternatives such as ast.literal_eval and restricted eval implementations, providing code examples and practical recommendations for secure code execution.
The article examines how Android’s Scudo memory allocator has been refined over the past three years, detailing its four design goals, the cache and thread‑specific data mechanisms for fast allocation, strategies to balance safe memory release with performance, and the group‑based approach that reduces fragmentation while preserving security.
This article explains how AI-powered code generators create high‑quality code, outlines their capabilities such as language translation and documentation assistance, discusses safety and copyright concerns highlighted by research, and emphasizes that while popular, these tools should augment rather than replace developers.
This article explains how Windows’ Best‑Fit Mapping can cause PHP‑CGI to misinterpret query‑string characters, allowing attackers to inject malicious parameters and execute arbitrary code, and provides detailed mitigation steps including version upgrades and Apache rewrite rules.
The article investigates undocumented x86 opcodes, describing a depth‑first search that uses page‑faults to locate hidden instruction boundaries, and reports finding dozens of executable but undocumented instructions on Intel and AMD CPUs, highlighting potential security risks and the need for vigilant hardware analysis.
AI gateways have emerged as essential infrastructure for modern AI applications, offering specialized security, load balancing, cost management, and observability that go beyond traditional API gateways, and understanding their differences and deployment considerations is crucial for developers and ops teams.
This article explains how to secure Spring Boot API responses using RSA asymmetric encryption and digital signatures, covering RSA fundamentals, project setup, Maven configuration, key management, annotation‑driven encryption/decryption, front‑end JavaScript encryption with JSEncrypt, and practical testing steps.
This article explains how Spring Boot Actuator can unintentionally expose sensitive endpoints like /env, /configprops, and /threaddump, and provides detailed configuration and custom sanitizing techniques to protect confidential information in production environments.
This article details how upgrading from Elasticsearch 5.x/2.x to 8.x dramatically improves search, aggregation, and write performance while reducing storage costs, introduces vector KNN, synthetic _source, TSDS, searchable snapshots, security enhancements, and provides migration examples and code snippets for enterprise search platforms.
This article explains how Chrome's built‑in password leak alert works and demonstrates how to integrate the same compromised‑password checking into a Spring Boot 3.3 application using the HaveIBeenPwned API, complete with code examples and screenshots.
This article introduces the five mainstream access‑control models—ACL, DAC, MAC, ABAC, and RBAC—explaining their principles, real‑world examples, drawbacks, and how RBAC can be extended and applied in practical user, role, and permission management systems.
The article examines Git CVE‑2024‑32002, a remote‑code‑execution flaw that lets attackers run malicious code simply by cloning a crafted repository, exploiting Git hooks, submodules and case‑insensitive symbolic‑link tricks, and advises users to verify their Git version and update to mitigate the risk.
Learn 18 essential API design rules covering signature, encryption, IP whitelisting, rate limiting, parameter validation, unified responses, exception handling, logging, idempotency, pagination, stress testing, async processing, data masking, documentation, request methods, headers, batch operations, and single‑responsibility principles for robust backend services.
This article presents a comprehensive overview of OPPO's application distribution platform, detailing the black‑gray‑market threats it faces, the multi‑layered anti‑fraud architecture—including perception, identification, evaluation, and disposal modules—and real‑world case studies that demonstrate the effectiveness of its traffic anti‑cheat tools.
Git’s CVE‑2024‑32002 is a critical remote‑code‑execution flaw where a malicious repository can exploit hooks, submodules, and symlinks on case‑insensitive file systems to inject and run attacker‑controlled scripts during a recursive clone, affecting versions up to 2.45.0 and mitigated by disabling recursive submodule fetching, avoiding untrusted clones, and updating Git.
The article recounts a Tencent engineer's six‑year journey from early DNS‑bypass tricks to modern HTTP/2 + QUIC implementations, highlighting technical challenges, security innovations, and the iterative process behind multiple promotion evaluations.
A collection of Zhihu users’ answers reveals that operations engineers handle complex monitoring, deep Linux expertise, fire‑fighting, network security, and infrastructure management—tasks that often exceed developers’ expectations and require a broad, high‑level technical skill set.
This article outlines frequent Kubernetes mistakes—such as missing resource requests, skipping health checks, using the latest image tag, over‑privileged containers, insufficient monitoring, default namespace misuse, and lack of security settings—and provides practical guidance and code examples to prevent them.
This article explains how IPv6 solves IPv4 address exhaustion, outlines its unique features such as 128‑bit addressing, lack of NAT, automatic configuration via SLAAC, privacy‑focused temporary addresses, and common myths, while also discussing practical drawbacks, developer opinions, and the future of Internet connectivity.
This guide provides a step‑by‑step hardening checklist for Red Hat AS 3/4, covering shared‑account detection, redundant‑account lock policies, root remote‑login restrictions, password complexity and lifespan, critical directory permissions, audit logging, SSH configuration, unnecessary service removal, and patch installation.
This guide explains the security challenges of WebSocket, outlines a step‑by‑step JWT authentication flow, and presents three practical token‑passing techniques—including URL parameters, post‑connection messages, and sub‑protocols—while emphasizing the use of wss:// and safe token storage.
This article documents a month‑long effort to replace Fastjson with Gson in Java projects, analyzing security vulnerabilities, comparing performance and features of Fastjson, Jackson and Gson, and providing detailed migration steps, code examples, and solutions to common issues such as date handling, SpringBoot integration, Swagger compatibility and numeric type conversion.
The article dissects three Android flaws—a misconfigured FileProvider, the privileged startAnyWhere capability, and asymmetric Parcel serialization—showing how their interaction lets an attacker hide a malicious Intent, bypass export checks, read private data, alter system settings, and gain elevated privileges, while outlining mitigation strategies.
This article presents a curated set of Python automation scripts covering clipboard management, code quality analysis, file integrity verification, stock price forecasting, bulk image downloading, network port scanning, encrypted password storage, bulk email sending, README.md generation, and folder organization, each with explanations and complete source code.
This guide explains how to protect PHP applications from SQL injection attacks by installing the Cloudmersive Security API client via Composer and using its content‑threat detection endpoint to scan user input, all with a free API key offering up to 800 scans per month.
APKDeepLens is a Python‑based tool that automatically scans Android APK files for security flaws, covering the OWASP Top 10 mobile risks and providing detailed, actionable reports for developers, pentesters, and security researchers.
Microsoft has pledged an unrestricted $1 million to the Rust Foundation, earmarking funds for hiring engineers, scholarship programs, and priority projects that enhance Rust’s performance, memory safety, and long‑term sustainability, while analysts highlight the broader industry shift toward secure, high‑performance languages.
CAPTCHAs, originally designed as human‑based computation tools to block bots, have become costly, discriminatory, and largely ineffective security measures that waste billions of dollars annually while providing profit to service providers, prompting a 2024 debate on their continued use.
