Curious-Techie Learn
In-depth technical guides explaining how internet protocols, web standards, cryptographic handshakes, and developer security architectures actually function under the hood.
Technical Guides & Protocol Breakdowns
Peer-reviewed architectural explanations with RFC references, diagrams, and companion interactive tools.
What is DNS & How Do Name Servers Work?
Understand the Domain Name System: hierarchical resolution trees, root servers, A/AAAA/MX/TXT records, and encrypted DNS-over-HTTPS (DoH).
What is SSL/TLS & How Does HTTPS Work?
Understand Transport Layer Security (TLS 1.3), asymmetric public key handshakes, X.509 certificate chains, and Certificate Transparency logs.
What is Content Security Policy (CSP) & How to Prevent XSS?
Master CSP Level 3: learn directive syntax, strict nonce implementations, hash verification, and how to safely deploy zero-trust headers.
What is CORS & the Same-Origin Policy?
Deconstruct Cross-Origin Resource Sharing: understand browser preflights, CORS headers, cookies, and avoid dangerous cross-origin security vulnerabilities.
What is OSINT & How Does Passive Reconnaissance Work?
Discover the science of Open Source Intelligence: mapping digital footprints, DNS histories, Certificate Transparency archives, and defensive threat modeling.
What is JSON? The RFC 8259 Technical Guide
Understand data types, syntax rules, Abstract Syntax Tree validation, serialization quirks, and why trailing commas fail.
What is JWT? JSON Web Token Architecture (RFC 7519)
Stateless authentication, header/payload/signature structure, Base64URL, algorithm confusion attacks, and why decoding is not verifying.
What is Base64? The 6-Bit Encoding Architecture
How binary data maps to 64 ASCII characters, padding equals signs (=), performance overhead, and encoding vs encryption.
What is Hashing? Cryptographic Digests & Avalanche Effect
One-way mathematical functions, collision resistance, SHA-256 vs MD5, rainbow tables, and password salting with Argon2.
What is a UUID? Versions, Entropy & RFC 9562
How distributed systems generate 128-bit keys without coordination. UUID v4 randomness vs time-ordered UUID v7 indexing.
What is a Regular Expression (Regex)?
Finite automata matching engines, character classes, quantifiers, lookaheads, and catastrophic backtracking ReDoS prevention.
What is URL Encoding (Percent-Encoding)?
RFC 3986 standards, reserved delimiters, UTF-8 byte translation, and query string sanitization.
What is Unix Time (Epoch)?
Why computers count seconds from Jan 1, 1970, 32-bit vs 64-bit timestamps, leap seconds, and the Year 2038 problem.
Explore by Topic Clusters
Every topic cluster interlinks existing client-side tools with in-depth RFC guides, troubleshooting solutions, head-to-head comparisons, technical references, direct Q&A, and interview preparation.
Cryptography & Hashing
Master SHA-256, SHA-512, MD5, HMAC generation, the avalanche effect, and integrity verification algorithms executing client-side.
- SHA-256 vs SHA-512
SHA-512 is fundamentally more secure and surprisingly runs faster on modern 64-bit CPUs than SHA-256 due to native 64-bit word operations. Choose SHA-256 for compact output and microcontrollers; choose SHA-512 for high-security applications and 64-bit server pipelines.
- Why can’t you decrypt or decode a cryptographic hash like SHA-256?
You cannot decode a cryptographic hash because hashing is a lossy, one-way mathematical function. A hash compresses arbitrary-sized data (e.g. an entire 4 GB operating system image) into a fixed 256 bits, discarding original information and making mathematical reversal impossible.
- What is the Avalanche Effect in cryptographic hashing?
The Avalanche Effect is a fundamental cryptographic property where altering a single input bit causes approximately 50% of the output digest bits to change unpredictably, preventing attackers from predicting output digests or reverse-engineering input patterns.
- Is MD5 still safe to use in modern software applications?
No, MD5 is completely broken for security purposes due to practical collision attacks where attackers generate two distinct files with identical MD5 checksums. It should never be used for passwords, SSL certificates, or digital signatures.
DNS & Internet Protocols
Deconstruct root nameservers, authoritative resolvers, A/AAAA/MX/TXT records, and encrypted DNS transport architectures.
- DNS-over-HTTPS (DoH, RFC 8484) vs DNS-over-TLS (DoT, RFC 7858)
DoH is superior for user privacy and censorship circumvention because its traffic blends inseparably with standard HTTPS web browsing on port 443. DoT is superior for enterprise network administration because dedicated port 853 allows network security teams to inspect or filter queries.
- HTTP Status Codes Reference & Diagnostic Guide (RFC 9110)RFC 9110 (HTTP Semantics)
Browser & Web Security
Enforce browser boundaries with CORS preflight configurations, strict Content Security Policies, and subresource integrity checks.
- How to Fix "No 'Access-Control-Allow-Origin' Header is Present" Error
Browser blocks client fetch requests with error: "Access to XMLHttpRequest at 'https://api.example.com' from origin 'https://myapp.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource."
- Why does the browser send an HTTP OPTIONS request before a POST request in CORS, and how do you prevent unnecessary preflight requests?senior level
- Content Security Policy (CSP Level 3) Directives CheatsheetW3C Content Security Policy Level 3
Data Encodings & Formats
Explore the 6-bit Base64 algorithm, hexadecimal byte representations, URL percent-encoding rules, and RFC 8259 JSON validation.
- Base64 (RFC 4648 §4) vs Hexadecimal (Base16, RFC 4648 §8)
Base64 is 33% more compact than Hexadecimal for binary transport (33% size overhead vs 100% size overhead). Use Base64 for images, attachments, and data URIs. Use Hexadecimal for cryptographic hashes, byte inspection, and color codes where human readability and character safety are paramount.
Tokens & Stateless Auth
Examine header-payload-signature structures, Base64URL decoding, algorithm confusion vulnerabilities, and cryptographic claim assertions.
- How to Troubleshoot & Fix "Invalid JWT Signature" Errors
Backend rejects JWT with error: "JsonWebTokenError: invalid signature" or 401 Unauthorized during token authentication.
- JSON Web Token (JWT) vs Server Session Cookie
Use Server Session Cookies for standard monolithic web applications and Single Page Applications sharing a backend domain. Use JWTs for distributed microservices, multi-region API gateways, and short-lived mobile authorization handshakes where database lookups on every request are prohibitive.
Unique Identifiers & Epochs
Generate globally unique identifiers without central coordination, compare UUID v4 vs v7 database indexing, and understand the 2038 epoch problem.
Privacy Engineering & OSINT
Understand digital footprints, image metadata forensics, passive WHOIS/RDAP registries, and browser sandboxing mechanics.
Frequently Asked Computer Science & Security Questions
Concise, accurate answers to high-impact technical questions across web cryptography, DNS infrastructure, identity protocols, and frontend performance.
What is the technical difference between HTTP and HTTPS encryption?
HTTP (Hypertext Transfer Protocol) transmits application data in cleartext TCP streams vulnerable to man-in-the-middle (MitM) eavesdropping. HTTPS (RFC 2818 / RFC 9110) encapsulates HTTP inside an encrypted TLS (Transport Layer Security 1.3) session. TLS uses asymmetric cryptography (ECDHE / RSA) to authenticate server identity via X.509 digital certificates, then negotiates a symmetric cipher (AES-256-GCM or ChaCha20-Poly1305) to encrypt all packet payloads.
Why is Base64 encoding not considered encryption or hashing?
Base64 (RFC 4648) is an algorithmic byte translation format designed to safely convey arbitrary binary bytes over 7-bit ASCII transport channels. It requires no cryptographic secret key and can be reversed instantly by anyone. In contrast, encryption requires a secret key to decipher ciphertext, and cryptographic hashing is an irreversible one-way mathematical function with no inverse mapping.
How does Content Security Policy (CSP Level 3) prevent Cross-Site Scripting (XSS)?
Content Security Policy (CSP Level 3 / W3C) restricts the execution of untrusted scripts by enforcing browser-level execution boundaries. When a strict CSP directive like script-src 'nonce-rAnd0m' 'strict-dynamic' is returned in HTTP headers, browsers automatically block unauthorized inline scripts (e.g., injected <script> tags) and disallow dynamic evaluation (eval()), rendering attacker injection payloads inert.
What is the difference between OAuth 2.0 and JSON Web Tokens (JWT)?
OAuth 2.0 (RFC 6749) is an authorization delegation framework that governs how clients request and receive permission to access third-party resources. JWT (RFC 7519) is a standardized token data structure comprising a Header, Payload, and Signature. OAuth authorization servers frequently issue signed JWTs as access tokens to carry verified user authorization claims statelessly across microservices.
Why does UUID v7 offer superior database indexing performance compared to UUID v4?
UUID v4 is purely pseudo-random, which causes severe B-tree page splits and write amplification when indexed as a primary key in high-throughput databases (PostgreSQL, MySQL). UUID v7 (RFC 9562) embeds a 48-bit millisecond Unix timestamp in the most significant bits, resulting in naturally chronological, time-ordered primary keys that optimize disk I/O and preserve sequential B-tree locality.
What causes Catastrophic Backtracking in Regular Expressions (ReDoS)?
Catastrophic Backtracking occurs in Nondeterministic Finite Automata (NFA) regex engines when pattern constructs contain nested or overlapping quantifiers (such as (a+)+$ or (x+x+)+y). When supplied with non-matching input strings, the engine exhaustively tests every exponential combination ($O(2^n)$ complexity), consuming 100% CPU time and causing Regular Expression Denial of Service (ReDoS).
How does DNS over HTTPS (DoH) prevent ISP snooping and DNS poisoning?
Traditional DNS queries (RFC 1035) travel in unencrypted UDP packets on port 53, allowing ISPs and network eavesdroppers to inspect every visited domain and inject forged responses. DNS over HTTPS (DoH, RFC 8484) encapsulates DNS lookups inside standard TLS-encrypted HTTPS connections over port 443, preventing wiretapping, censorship, and cache poisoning.
Is CORS configured on the frontend or backend, and how does it protect APIs?
CORS (Cross-Origin Resource Sharing) is enforced by the client browser but configured entirely on the backend server. The browser automatically sends an HTTP Origin header, and the backend server must respond with Access-Control-Allow-Origin. Without this header, the browser blocks the frontend JavaScript application from reading the response data, protecting private internal APIs from unauthorized third-party websites.
Ready to test these concepts in practice?
Explore our collection of 27 fast, zero-upload client-side developer utilities.