networking
31 posts found
Myth: SSH Agent Forwarding Is a Safe Bastion Pattern
Passing your local SSH keys through jump hosts with agent forwarding exposes your private identity to any compromised bastion. Here is the mechanical reality an…
The SSRF Problem Nobody Talks About in AI Pipelines
Everyone hardens the model. Almost nobody hardens what the model fetches. A walkthrough of SSRF and SSRF-adjacent risks in AI ingestion pipelines, with practica…
How to Build a Censorship-Resistant Tunnel with Aether and MASQUE
A step-by-step guide to compiling and configuring Aether, a Rust userspace implementation of Cloudflare WARP using MASQUE over HTTP/3.
Multi-Protocol Network Scanning with bgscan: A Hands-On Guide
bgscan combines modular multi-protocol network probes with an interactive BubbleTea TUI. Learn how to configure scan chains, execute targeted network discovery,…
Cache Invalidation via Surrogate Keys: Edge Architecture and Purge Mechanics
Decouple cache invalidation from URL paths using Surrogate-Key headers for targeted CDN purging.
BGP Flowspec False Positives: When DDoS Filters Block Legitimate Traffic
Flowspec rules are coarse-grained. They catch attack traffic and legitimate traffic alike. How to monitor, whitelist, and protect your critical services from co…
Kernel Socket Tuning for High-Concurrency Load Balancers: TCP_NODELAY, TCP_FASTOPEN, and Listen Backlog
Disable Nagle, enable TCP Fast Open, tune listen backlog. Three socket parameters cut tail latencies 40–60% on modern load balancers.
Why Transport Layer Fingerprinting Will Replace IP Reputation
Perimeter security models that rely on IP reputation fail against residential proxy pools. Edge defense is shifting to transport-layer fingerprinting, inspectin…
Why Dropping All ICMP Breaks Path MTU Discovery
Blocking all ICMP traffic does not hide your servers from network scanners. Instead, it breaks Path MTU Discovery, causing silent connection freezes during TLS …
How to Tunnel Datagrams with MASQUE CONNECT-UDP Over HTTP/3
Configure RFC 9298 MASQUE CONNECT-UDP over HTTP/3 to tunnel datagrams without head-of-line blocking.