惯性聚合 高效追踪和阅读你感兴趣的博客、新闻、科技资讯
阅读原文 在惯性聚合中打开

推荐订阅源

T
Threat Research - Cisco Blogs
S
Securelist
H
Heimdal Security Blog
Scott Helme
Scott Helme
D
Darknet – Hacking Tools, Hacker News & Cyber Security
The Hacker News
The Hacker News
C
CXSECURITY Database RSS Feed - CXSecurity.com
Spread Privacy
Spread Privacy
Cyberwarzone
Cyberwarzone
V
Vulnerabilities – Threatpost
C
Cybersecurity and Infrastructure Security Agency CISA
C
CERT Recently Published Vulnerability Notes
P
Proofpoint News Feed
Threat Intelligence Blog | Flashpoint
Threat Intelligence Blog | Flashpoint
人人都是产品经理
人人都是产品经理
C
Cisco Blogs
www.infosecurity-magazine.com
www.infosecurity-magazine.com
Engineering at Meta
Engineering at Meta
Project Zero
Project Zero
CTFtime.org: upcoming CTF events
CTFtime.org: upcoming CTF events
cs.AI updates on arXiv.org
cs.AI updates on arXiv.org
有赞技术团队
有赞技术团队
T
Tailwind CSS Blog
Cisco Talos Blog
Cisco Talos Blog
Last Week in AI
Last Week in AI
让小产品的独立变现更简单 - ezindie.com
让小产品的独立变现更简单 - ezindie.com
O
OpenAI News
P
Proofpoint News Feed
Google Online Security Blog
Google Online Security Blog
Recent Announcements
Recent Announcements
Hacker News: Ask HN
Hacker News: Ask HN
美团技术团队
Stack Overflow Blog
Stack Overflow Blog
U
Unit 42
P
Privacy International News Feed
Google DeepMind News
Google DeepMind News
G
GRAHAM CLULEY
Apple Machine Learning Research
Apple Machine Learning Research
TaoSecurity Blog
TaoSecurity Blog
S
Security @ Cisco Blogs
C
Check Point Blog
H
Hackread – Cybersecurity News, Data Breaches, AI and More
Jina AI
Jina AI
S
Secure Thoughts
G
Google Developers Blog
C
Cyber Attacks, Cyber Crime and Cyber Security
L
LINUX DO - 最新话题
T
Tenable Blog
Latest news
Latest news
I
InfoQ

Stonecharioteer on Tech

I Traced My Traffic Through a Home Tailscale Exit Node What Was I Reading Last? In Three Not-So-Easy Pieces Dogfooding Is Hard Code blocks in your books, finally GoForGo v0.9.0 Merrilin - We built an app to read books I use a Macbook now Data Structures & Algorithms - Preparing for Interviews Using a local DNS namespace for local service discovery Direction KOllector - Publishing KOReader Highlights gbt: branches touched in the last 24 hours A Soiree into Symbols in Ruby Some Smalltalk about Ruby Loops Ruby Blocks Returning from Ruby Blocks, Procs and Lambdas My Linux Laptop Finally Works: How Claude Helped Me Fix Years of Annoyances TIL: Watchexec - Modern File Watching for Development Workflows A Less Busy Mind GoForGo - Learn Go through live examples Migrating My Old Blog to Hugo with Claude The Qtile Window Manager: A Python-Powered Tiling Experience Read the RFCs that Built the Internet Py-x-Protobuf - Or How I Learned to Stop Worrying and Love Protocol Buffers Python Reverse a List New Beginnings Leaving ChainSafe Systems Screen Lock for Cinnamon Desktop using Zenity and Terminal Commands Crews Not Teams A System for Getting Better at LeetCode So Far So Rust Retrying HTTP Requests with Rust A Primer on Control Charts Learning Rust Explicit is Better than Implicit: Rust for Pythonistas Using Custom Delimiters in Jinja Templates TIL: Creating Fixed Length Iterables in Python Documentation Without Assumption Vagrant Python - A Reflection in 2022 Learning Golang No, A Virtual Machine Is Not Enough: Why Developers Need Native Linux Empathy in Tech For Those Who Came in Late A Weekend With PostgreSQL TIL: Gooey and Python Fire for Quick GUIs and CLIs TIL: 2ality - Dr. Axel Rauschmayer's JavaScript Blog TIL: MassDNS - High-Performance Bulk DNS Lookups TIL: Matomo Analytics, Google Tech Writing, Memory Programming, and NES TV Signals TIL: MontyDB - MongoDB Implemented in Python Returning to the Craft of Programming TIL: CPUFetch, OneFetch, and Learn CSS TIL: DNS Performance Testing and Pi-hole with Unbound TIL: Eli Bendersky's Blog, Awesome By Example, NoCoDB, and Martin Kleppmann TIL: CRDTs, Extreme HTTP Performance, and BYTEPATH Game TIL: AutoInvent, ASGI, Python Packaging, RAPIDS GPU Computing, and FlaskCon TIL: MangaDesk - Terminal Client for MangaDex TIL: McFly - Smart Shell History Search TIL: Siege Load Testing and Awesome FastAPI Resources TIL: Ventoy Bootable USB and Justniffer Network Analysis TIL: CLI Code Review, Git Split Diffs, and Internal Combustion Engine TIL: Benford's Law, Web Security Headers, Event Sourcing, and Mozilla Security Guidelines How to Write Documentation - The README.md File The Importance of Documentation TIL: NNgroup UX Research, SponsorBlock, and Labella Python Library TIL: The Little Book of Rust Macros and Rust Performance Book TIL: Git-Bug Distributed Issue Tracker and Omni Kubernetes Monitoring TIL: Zellij - Modern Terminal Multiplexer TIL: How Discord Handles 2.5 Million Concurrent Voice Users TIL: Volumio - The Audiophile Music Player TIL: Areopagitica - Milton's Defense of Free Speech TIL: Fast Node Manager, Zoxide Smart CD, Technical Writing, PyO3, and Qubes OS TIL: Slurm Workload Manager for HPC Clusters TIL: Data Visualization Guide and Oso Authorization Academy TIL: CORS Deep Dive, Piku Tiny PaaS, Rust Strings, and Deno Standard Library TIL: Raspberry Pi OS Development, Vim Beginner Guide, Password Management, and QueryBook TIL: uBlock Origin Performance Optimization on Firefox TIL: Breaking PostgreSQL at Scale and LeetCode Problem Patterns TIL: Awesome Tmux Resources for Terminal Multiplexing TIL: Grit - A Multitree-Based Personal Task Manager TIL: Lens 4.2 Kubernetes IDE, Shell Scripting Guide, and Dark HTTP Server Do The Job You Hate So You Won't Hate The Job You Love TIL: Innernet VPN Solution and NoteCalc Calculator App TIL: Argo CD for GitOps and Lens Kubernetes IDE TIL: Modern Rust CLI Tools - System Monitoring, HTTP Requests, and DNS TIL: tz - A Time Zone Helper Tool TIL: Distributed Systems Education, Fallacies, and Self-Hosted Internet Archiving TIL: Real-Time Voice Cloning Technology TIL: ChartMuseum for Helm, AMD's Corporate Journey, and Kubernetes Pod Scaling TIL: Docker and Kubernetes Tools - Whaler, Descheduler, and Dive TIL: Post-Mortem Collection, Terminal Plotting, and Technical Twitter TIL: Dark Mode Toggle Web Component by Google Chrome Labs TIL: Python eval(), exec(), and compile() Functions TIL: Camelot PDF Tables, PostgreSQL Row Level Security, Zerodha Varsity, and Write Yourself a Git TIL: fuser Command for Process and File Investigation TIL: i Hate Regex - The Ultimate Regex Cheat Sheet TIL: Dolt - Git for Data and Database Version Control TIL: x86 Assembly Programming and SafeEyes Break Reminder TIL: Comprehensive Distributed Systems Reading List TIL: Cosmopolitan C Library, Distributed Systems Book, High Performance Browser Networking, and Rust Roguelike Tutorial
TIL: IP Address Parsing Complexities, Low-Level System Design, and Linux Command Fundamentals
2020-12-27 · via Stonecharioteer on Tech

Network Programming Complexities

IP Address Parsing Challenges

  • Fun with IP address parsing · blog.dave.tf
  • Deep exploration of IP address parsing edge cases and complexities
  • Demonstrates that seemingly simple tasks can have surprising depth
  • Real-world examples of parsing failures and security implications

IP Address Parsing Edge Cases

  • IPv4 Formats: Decimal, octal, hexadecimal, and mixed representations
  • Leading Zeros: Different interpretations (octal vs decimal)
  • IPv6 Complexity: Multiple valid representations of same address
  • URL Context: How browsers and applications parse IP addresses differently
  • Security Implications: Parsing differences can lead to security vulnerabilities

Example Parsing Variations

# These all represent the same IPv4 address (127.0.0.1):
127.0.0.1        # Standard dotted decimal
127.1            # Abbreviated form
0x7f000001       # Hexadecimal
0177.0.0.1       # Mixed octal/decimal
2130706433       # Pure decimal

Security Considerations

  • Bypass Attempts: Attackers use parsing differences to bypass filters
  • SSRF Vulnerabilities: Server-Side Request Forgery through IP parsing
  • Access Control: Inconsistent parsing can circumvent IP-based restrictions
  • Validation Failures: Applications may validate differently than they parse

System Design Resources

Low-Level System Design Primer

  • GitHub - prasadgujar/low-level-design-primer
  • Comprehensive resource for low-level system design concepts
  • Focus on object-oriented design and software architecture patterns
  • Preparation for system design interviews and real-world development

Low-Level Design Topics

  • Object-Oriented Design: Classes, interfaces, and design patterns
  • Design Patterns: Creational, structural, and behavioral patterns
  • SOLID Principles: Software design principles for maintainable code
  • System Architecture: Component design and interaction patterns
  • Code Organization: Structuring large codebases effectively

Design Pattern Applications

  • Singleton: Ensuring single instance of critical components
  • Factory: Creating objects without specifying exact classes
  • Observer: Implementing event-driven architectures
  • Strategy: Implementing interchangeable algorithms
  • Command: Encapsulating operations as objects

Linux Command Line Mastery

Linux Commands Handbook

Essential Command Categories

  • File Operations: ls, cp, mv, rm, find, locate
  • Text Processing: cat, grep, sed, awk, sort, uniq
  • System Information: ps, top, df, du, free, uname
  • Network: ping, wget, curl, ssh, scp, netstat
  • Process Management: kill, jobs, nohup, screen, tmux

Command-Line Productivity

  • Pipes and Redirection: Combining commands for complex operations
  • Shell Scripting: Automating repetitive tasks
  • Regular Expressions: Pattern matching and text processing
  • Environment Variables: Customizing shell behavior
  • History and Shortcuts: Efficient command-line navigation

Network Programming Best Practices

Robust IP Address Handling

  • Use Libraries: Leverage well-tested parsing libraries
  • Consistent Validation: Same parsing logic for validation and processing
  • Canonical Forms: Convert to canonical representation early
  • Security Testing: Test with malformed and edge-case inputs
  • Documentation: Document expected input formats clearly

Network Security Considerations

  • Input Validation: Strict validation of network inputs
  • Allowlist Approach: Define what’s allowed rather than what’s blocked
  • Canonical Representation: Work with normalized network addresses
  • Error Handling: Fail securely when parsing fails
  • Logging: Log parsing failures for security monitoring

System Design Principles

Low-Level Design Focus

  • Component Interaction: How system components communicate
  • Data Flow: How information moves through the system
  • Error Handling: Graceful degradation and error recovery
  • Performance: Efficient algorithms and data structures
  • Maintainability: Code organization and modularity

Design Process

  • Requirements Analysis: Understanding what the system needs to do
  • Component Identification: Breaking system into manageable pieces
  • Interface Design: Defining how components interact
  • Implementation Planning: Choosing appropriate technologies and patterns
  • Testing Strategy: Ensuring system correctness and reliability

Key Takeaways

  • Hidden Complexity: Simple-seeming tasks often have unexpected depth
  • Security Implications: Parsing differences can create security vulnerabilities
  • Standard Libraries: Use well-tested libraries for complex parsing tasks
  • System Design: Low-level design skills complement high-level architecture knowledge
  • Command-Line Skills: Linux command proficiency remains essential for developers
  • Continuous Learning: Even experienced developers encounter surprising edge cases

These discoveries highlight the importance of understanding both the theoretical foundations and practical complexities of software development, from network protocol parsing to system design patterns.