Curious-Techie Learn
In-depth technical guides explaining how internet protocols, web standards, cryptographic handshakes, and developer security architectures actually function under the hood.
Technical Guides & Protocol Breakdowns
Peer-reviewed architectural explanations with RFC references, diagrams, and companion interactive tools.
What is DNS & How Do Name Servers Work?
Understand the Domain Name System: hierarchical resolution trees, root servers, A/AAAA/MX/TXT records, and encrypted DNS-over-HTTPS (DoH).
What is SSL/TLS & How Does HTTPS Work?
Understand Transport Layer Security (TLS 1.3), asymmetric public key handshakes, X.509 certificate chains, and Certificate Transparency logs.
What is Content Security Policy (CSP) & How to Prevent XSS?
Master CSP Level 3: learn directive syntax, strict nonce implementations, hash verification, and how to safely deploy zero-trust headers.
What is CORS & the Same-Origin Policy?
Deconstruct Cross-Origin Resource Sharing: understand browser preflights, CORS headers, cookies, and avoid dangerous cross-origin security vulnerabilities.
What is OSINT & How Does Passive Reconnaissance Work?
Discover the science of Open Source Intelligence: mapping digital footprints, DNS histories, Certificate Transparency archives, and defensive threat modeling.
What is JSON? The RFC 8259 Technical Guide
Understand data types, syntax rules, Abstract Syntax Tree validation, serialization quirks, and why trailing commas fail.
What is JWT? JSON Web Token Architecture (RFC 7519)
Stateless authentication, header/payload/signature structure, Base64URL, algorithm confusion attacks, and why decoding is not verifying.
What is Base64? The 6-Bit Encoding Architecture
How binary data maps to 64 ASCII characters, padding equals signs (=), performance overhead, and encoding vs encryption.
What is Hashing? Cryptographic Digests & Avalanche Effect
One-way mathematical functions, collision resistance, SHA-256 vs MD5, rainbow tables, and password salting with Argon2.
What is a UUID? Versions, Entropy & RFC 9562
How distributed systems generate 128-bit keys without coordination. UUID v4 randomness vs time-ordered UUID v7 indexing.
What is a Regular Expression (Regex)?
Finite automata matching engines, character classes, quantifiers, lookaheads, and catastrophic backtracking ReDoS prevention.
What is URL Encoding (Percent-Encoding)?
RFC 3986 standards, reserved delimiters, UTF-8 byte translation, and query string sanitization.
What is Unix Time (Epoch)?
Why computers count seconds from Jan 1, 1970, 32-bit vs 64-bit timestamps, leap seconds, and the Year 2038 problem.
Frequently Asked Computer Science & Security Questions
Concise, accurate answers to high-impact technical questions across web cryptography, DNS infrastructure, identity protocols, and frontend performance.
What is the technical difference between HTTP and HTTPS encryption?
HTTP (Hypertext Transfer Protocol) transmits application data in cleartext TCP streams vulnerable to man-in-the-middle (MitM) eavesdropping. HTTPS (RFC 2818 / RFC 9110) encapsulates HTTP inside an encrypted TLS (Transport Layer Security 1.3) session. TLS uses asymmetric cryptography (ECDHE / RSA) to authenticate server identity via X.509 digital certificates, then negotiates a symmetric cipher (AES-256-GCM or ChaCha20-Poly1305) to encrypt all packet payloads.
Why is Base64 encoding not considered encryption or hashing?
Base64 (RFC 4648) is an algorithmic byte translation format designed to safely convey arbitrary binary bytes over 7-bit ASCII transport channels. It requires no cryptographic secret key and can be reversed instantly by anyone. In contrast, encryption requires a secret key to decipher ciphertext, and cryptographic hashing is an irreversible one-way mathematical function with no inverse mapping.
How does Content Security Policy (CSP Level 3) prevent Cross-Site Scripting (XSS)?
Content Security Policy (CSP Level 3 / W3C) restricts the execution of untrusted scripts by enforcing browser-level execution boundaries. When a strict CSP directive like script-src 'nonce-rAnd0m' 'strict-dynamic' is returned in HTTP headers, browsers automatically block unauthorized inline scripts (e.g., injected <script> tags) and disallow dynamic evaluation (eval()), rendering attacker injection payloads inert.
What is the difference between OAuth 2.0 and JSON Web Tokens (JWT)?
OAuth 2.0 (RFC 6749) is an authorization delegation framework that governs how clients request and receive permission to access third-party resources. JWT (RFC 7519) is a standardized token data structure comprising a Header, Payload, and Signature. OAuth authorization servers frequently issue signed JWTs as access tokens to carry verified user authorization claims statelessly across microservices.
Why does UUID v7 offer superior database indexing performance compared to UUID v4?
UUID v4 is purely pseudo-random, which causes severe B-tree page splits and write amplification when indexed as a primary key in high-throughput databases (PostgreSQL, MySQL). UUID v7 (RFC 9562) embeds a 48-bit millisecond Unix timestamp in the most significant bits, resulting in naturally chronological, time-ordered primary keys that optimize disk I/O and preserve sequential B-tree locality.
What causes Catastrophic Backtracking in Regular Expressions (ReDoS)?
Catastrophic Backtracking occurs in Nondeterministic Finite Automata (NFA) regex engines when pattern constructs contain nested or overlapping quantifiers (such as (a+)+$ or (x+x+)+y). When supplied with non-matching input strings, the engine exhaustively tests every exponential combination ($O(2^n)$ complexity), consuming 100% CPU time and causing Regular Expression Denial of Service (ReDoS).
How does DNS over HTTPS (DoH) prevent ISP snooping and DNS poisoning?
Traditional DNS queries (RFC 1035) travel in unencrypted UDP packets on port 53, allowing ISPs and network eavesdroppers to inspect every visited domain and inject forged responses. DNS over HTTPS (DoH, RFC 8484) encapsulates DNS lookups inside standard TLS-encrypted HTTPS connections over port 443, preventing wiretapping, censorship, and cache poisoning.
Is CORS configured on the frontend or backend, and how does it protect APIs?
CORS (Cross-Origin Resource Sharing) is enforced by the client browser but configured entirely on the backend server. The browser automatically sends an HTTP Origin header, and the backend server must respond with Access-Control-Allow-Origin. Without this header, the browser blocks the frontend JavaScript application from reading the response data, protecting private internal APIs from unauthorized third-party websites.
Ready to test these concepts in practice?
Explore our collection of 27 fast, zero-upload client-side developer utilities.