Long-form thinking on cyber defence, detection, and resilience — from Slackware-era honeypots through to AI-driven SOC analytics.
Showing posts tagged source code — 3 results.
I have been promising myself I would read OpenSSH source carefully all year. A week of evenings has produced enough notes to write up. The implementation is more disciplined than I had expected and the architectural choices are educational.
Snort 1.7 is in beta. Reading the source has clarified several things about how the engine actually processes packets, and revealed a few design decisions that I think are going to influence future IDS work.
An evening spent reading the actual source code of the Linux kernel's TCP handling. What I expected to find versus what I actually found, and why every networking person should do this once.