[jongjong]

>> Cache, stack, heap, process, thread, socket, file, tcp, http, tls, websocks, socks, soc2???, deadlock, stack, queue, race, atomic, event loop, coroutine, async, database, transaction, index, replication, sharding, consistency, serialization, DNS, load balancer, container, namespace, and so on.

... communication protocol, method signatures, web components, ssh, CSS media queries, HTTP headers, WebSockets, timeouts, ETag, iterables, async iterables, middleware, CI/CD, build, consistent hashing, signatures, JWT, SSO, OAuth, SAML, XML, YAML, JSON, block cipher, ETL pipeline, SQL, SQL transactions (atomic), relational databases, foreign keys, schema normalization, referential integrity, 1-to-1, 1-to-n, n-to-n, document databases, compound indexes, idempotency, offset-based pagination, cursor-based pagination, P2P, Kademlia, structured vs unstructured network topology, message routing, frontend router, message storm, reconnect storm, locality, encapsulation, cohesion, coupling, design patterns, modularity, Big O notation, raytracing, shaders, VPN, VPC, data schema, schema validation, CORS, preflight-requests, CSRF, ASCII, UFT8, CSP, CPU context-switching, BIOS, bootloader, interrupt controller, ports, BIND protocol, BGP protocol, assembly language, big endian, little endian, register, signals, embarrassingly parallel, serial processing, event loop, binary trees, tree rebalancing, graph traversal algorithms, sorting algorithms, string character escaping and encoding, blob, base64, UUID, timestamp, CLI, Bash, unit tests, integration tests, e2e tests, TDD, stateful, stateless, proxy, nginx, haproxy, config, helm file, k8s, staging, git, push, commit, merge, rebase, cherry-pick, pub/sub, diff, honeypot, buffer overflow, pointer, file descriptor, authentication, certificates, TLS certificates, DNS Zone files, A record, CNAME, TXT record, SMTP, POP3, SOCKS5, Sha256, HMAC, Merkle trees, Merkle Signature Trees, Lamport OTS, Winternitz OTS, SPHINCS, lattice-based cryptography, pg-vector, vector embeddings, API, rate limiting, cookies, sameSite, httpOnly, localStorage, XSS attack, SQL injection, fetch API, module preloading, bundling...

Barely scratching the surface. I think I could probably keep typing all the technical terms I know for at least 24 hours straight. For most of the topics above, I could probably give a 1 or 2 hour lecture on each one from memory. Some I could give a day-long lecture each.

To explain all the terms I know to a basic degree, I would probably need to give a whole year of lectures back-to-back from 9am to 5pm. And I'm just a rank-and-file senior engineer with 15 years of experience.

It's also why the vast majority of software systems are insecure. The average senior software engineer doesn't know everything that they need to know to build secure software. Last time I poked around Coinbase APIs on HackerOne, I found a DoS vulnerability in less than 30 minutes. That's Coinbase, not some startup built by a bunch of recent graduates.

AI cannot avoid vulnerabilities either since it is trained on average engineer code. There's not enough high quality code available on the entire internet to train AI to implement secure code IMO. As impressive as Mythos may be, it's not enough. I don't even think formal verification would provide protection since sometimes issues with the spec itself can provide an opening for a vulnerability.

[buzzin_]

Nice list. I like it how you also included some made up terms. For completeness, those are not real:

ETag, SAML, CSP, BGP, haproxy, helm file, k8s, SOCKS5, Lamport OTS, Winternitz OTS, SPHINCS, lattice-based, pg-vector, sameSite, httpOnly. (Or, at least, i have no idea what those are ::)

[jongjong]

ETag is the HTTP response header which provides the shasum (hash) of a resource in order to allow the client to check if the resource has changed without having to load the resource. It's for client side (browser) caching.

SAML is Security Assertion Markup Language; an XML based SSO (Single Sign On mechanism).

CSP (Content Security Policy) which allows the application to specify additional security constraints for the browser to enforce.

BGP; border gateway protocol.

Haproxy is a load balancer.

Helm file; another word for helm chart.

SOCKS5 is a tunnelling protocol which allows you to tunnel through a machine over SSH; you can use it to browse the net or access remote services via another machine (hiding your IP)... It's a bit like a basic VPN. Very easy to setup, you can configure your browser (e.g. Firefox) to access the net via a SOCKS5 proxy so if the remote instance is in a different country, websites will treat you as though you are in that country... Just like a VPN except you have to control the remote machine yourself and log into it via SSH with the -D flag.

Lamport OTS is Lamport One Time Signature algorithm.

Winternitz serves a similar purpose but different tradeoffs and smaller signature size.

SPHINCS is a stateless hash-based signature scheme which works by building a tree of OTS keys (Lamport, Winternitz or other) which can be generated deterministically, on-demand.

Lattice-based cryptography is real.

pg-vector is a plugin for Postgres for vector embeddings and it provides some operators for finding records based on the nearest vector.

sameSite and httpOnly are cookie security settings.

[gjm11]

Apologies if I am simply missing a joke (which I think is true with p~=0.3), but:

At least some of these are definitely real things. For instance: "BGP" is the Boundary Gateway Protocol. "Lamport OTS" is a one-time digital signature scheme due to Leslie Lamport. k8s is an abbreviation for a piece of software called Kubernetes.

[divyekapoor]

Not at all! All of these are real. ETag: expiry tag on HTTP(s), SAML: auth protocol, CSP: constraint sat, BGP: border gateway protocol, haproxy: load balancer, helm: k8s package manager, SOCKS5: http proxy protocol, sameSite/httpOnly: configs for HTTP security… and so on.

Never mind. The answer before me did a much better job.

[reverius42]

"helm file" is, of course, supposed to be "helm chart".

[jongjong]

You're right, I was typing each term as it came to my mind. Helm chart is the correct term but DevOps people would know what I meant.

[minraws]

Coinbase not a startup built by recent graduates...

You overestimate Coinbase's engineering rigor.

But yes security in modern software systems is a joke. I don't even get paid to fix security bugs everytime I raise them the answer is to slap a sandbox and proxy and call it done.

[jongjong]

Yep, about 10 years ago, the security of most major systems was relatively robust; I could not have hacked them. The people who worked there knew much more than I did and they didn't leave many gaps.

Now I could hack essentially any system I want. At least DoS or crash them for sure, with minimal computing on my end. They're much more complex than they used to be. Security-through-obscurity used to be a no-no and sometime in the last 10 years it became the main security paradigm.

[ftjftjft]

a janitor could do the same though

[jongjong]

They could drag it out by telling stories of situations they faced but information density would be low and repetitive. As someone who cleaned boats professionally for a year in my early days, I'm pretty sure I could convey all I know about cleaning in under an hour. That's very different from one year of back-to-back lectures.

Cleaning boats, the learning tapered off after a few weeks. With software, I'm 15 years in and it barely tapered at all and it's much more intense. I've been pulling nights and weekends too.

With software knowledge, it would be high information density with little to no repetition. Every piece would provide useful concrete knowledge which would serve to increase technical capabilities and/or security.