Lelton Borges

Busque sempre o novo....

[Dr Milan Milanović @milan_milanovic]

𝗝𝗪𝗧'𝘀 𝗯𝗶𝗴𝗴𝗲𝘀𝘁 𝘄𝗲𝗮𝗸𝗻𝗲𝘀𝘀 𝗶𝘀 𝗶𝘁𝘀 𝗳𝗹𝗲𝘅𝗶𝗯𝗶𝗹𝗶𝘁𝘆. 𝗣𝗔𝗦𝗘𝗧𝗢 𝗿𝗲𝗺𝗼𝘃𝗲𝘀 𝗶𝘁.

The JWT spec lets the token specify which algorithm to trust. That single design choice is behind most JWT failures in production.

Here is what PASETO does differently.

𝟭. 𝗧𝗵𝗲 𝗮𝘁𝘁𝗮𝗰𝗸 𝗹𝗶𝘃𝗲𝘀 𝗶𝗻 𝘁𝗵𝗲 𝗵𝗲𝗮𝗱𝗲𝗿

A JWT carries an "alg" field that names its own signing algorithm. You can set it to "none" and some libraries skip verification.

Or take the public RSA key, use it as an HMAC secret, sign with HS256, and a server that trusts the header accepts the forged token.

That is the RS256-to-HS256 confusion attack, and it still breaks real systems.

𝟮. 𝗣𝗔𝗦𝗘𝗧𝗢 𝗽𝗶𝗻𝘀 𝘁𝗵𝗲 𝗰𝗿𝘆𝗽𝘁𝗼 𝘁𝗼 𝘁𝗵𝗲 𝘃𝗲𝗿𝘀𝗶𝗼𝗻

A PASETO token reads version.purpose.payload. The version fixes the cipher suite, so there is nothing left to negotiate.

v4.public is always Ed25519. v4.local is always XChaCha20 with BLAKE2b. No alg header means no alg:none and no confusion attack.

𝟯. 𝗬𝗼𝘂 𝗽𝗶𝗰𝗸 𝗮 𝗽𝘂𝗿𝗽𝗼𝘀𝗲, 𝗻𝗼𝘁 𝗮𝗻 𝗮𝗹𝗴𝗼𝗿𝗶𝘁𝗵𝗺

A local token is encrypted with a symmetric key. A public token is signed so that anyone with the public key can verify it.

A standard JWT is only signed, so the payload is readable base64, and secrets leak when people forget that.

𝟰. 𝗙𝗼𝗿 𝘀𝗲𝘀𝘀𝗶𝗼𝗻𝘀, 𝘆𝗼𝘂 𝘄𝗮𝗻𝘁 𝗻𝗲𝗶𝘁𝗵𝗲𝗿

JWTs are only safe as short-lived tokens, minutes, not the weeks a login session runs. Google does exactly this: JWTs only hand a login between hosts, and the browser session stays a cookie.

PASETO is the better pick for that short-lived signed token: SSO handoff, service-to-service calls, one-time use.

For sessions, a cookie backed by Postgres or Redis is simpler, and revoking one is a single row delete.

Most logins reach for a token where a session would do.

[adah @alohaproxy]

Learning Go?

Pick your path:

Go + Gin → Backend APIs

Go + gRPC → Distributed Systems

Go + Kafka → Event-Driven Systems

Go + Kubernetes → Cloud Native

Go + Docker → Containers

Go + Terraform → Infrastructure

Go + Prometheus → Observability

Go + Redis → High-Performance Caching

Go + WebSockets → Real-Time Apps

One language. Countless engineering careers. 🫡

[Ayaan 🐧 @twtayaan]

26 letters. 26 DevOps concepts. One infographic.

How many have you worked with? 👇

[Alex Xu @alexxubyte]

API Security Best Practices

Most API breaches happen because of broken authorization, leaked secrets, or missing rate limits. Let's look at some of the basics.

- Use Modern OAuth/OIDC + MFA: PKCE for public clients, short-lived tokens, and step-up MFA for anything sensitive. Implicit and password grants should be dead by now.
- Enforce Fine-Grained Authorization: Check object, function, and field-level permissions on every request. BOLA is still the top API vulnerability.
- Minimize Scopes and Data: Give each client the smallest token scope and the least data it needs. Only return the fields the caller actually needs.
- Encrypt Every Hop: TLS for external traffic and mTLS between services. If it crosses a network boundary, encrypt it.
- Protect Secrets and Keys: Store signing keys in HSM-backed vaults. Rotate them.
- Validate Requests with Schemas: Reject unknown fields, oversized payloads, and suspicious URLs at the gateway. Don't let bad input reach your business logic.
- Rate Limit and Cap Resources: Quotas per user, payload size caps, and execution timeouts. Without these, one misbehaving client takes down your entire system.
- Defend Sensitive Business Flows: Protect login, checkout, and OTP with anti-bot, idempotency keys, and step-up auth.
- Control Outbound and Third-Party Calls: Allowlist where your API can call out to and block internal metadata endpoints. Your security is only as strong as your weakest integration.
- Harden Config and Error Handling: Deny by default on CORS, methods, and debug endpoints. Return generic errors, never stack traces.
- Inventory APIs and Versions: Track every endpoint, version, and shadow API. You can't secure what you don't know exists.
- Log, Detect, and Respond: Push auth decisions and anomalies to a SIEM. Alert on 401 spikes before they become incidents.

Over to you: Which of these best practices is the hardest to enforce across your services?

[Ayaan 🐧 @twtayaan]

4 kubectl plugins that save me time every week:

1⃣ kubectl-tree: Visualize resource ownership
https://t.co/FyEzTHcGWj

2⃣ kubectl-neat: Clean noisy YAML output
https://t.co/jfgN3niZzK

3⃣ kubefwd: Forward entire namespaces instantly
https://t.co/PDTHrWFeW2

4⃣ kubectl-view-secret: Read secrets without base64 gymnastics
https://t.co/aQJ4v4K5vk

[Ayaan 🐧 @twtayaan]

Still debugging Kubernetes with only kubectl?

These 4 tools save hours during incidents:

🔹 k9s: Cluster dashboard in your terminal
🔹 stern: Multi-pod log tailing
🔹 Kubeshark: Wireshark for Kubernetes
🔹 k8sgpt: AI explains what's broken

Repos 👇

k9s: https://t.co/LDGubuA9Dt
stern: https://t.co/rqZAb64hOw
Kubeshark: https://t.co/0v5TFFersY
k8sgpt: https://t.co/T3W9n8j0RW

[Dhanian 🗯️ @e_opore]

These 10 Linux tools make the classics feel ancient—I use them on every machine

Grab Linux ebook: https://t.co/YmVhAkcj5o

[DevopsCube @devopscube]

75% OFF Linux Foundation Prime Sale is Live now🚀

Use code JPRIME26CCCT at https://t.co/C7Uw2BWcX6 to get flat 40% discount on Individual certifications like CKA, CKAD etc.

Save up to 55% using code JPRIME26BCT on the following k8s certification bundles.

- Kubestronaut Bundle: https://t.co/RCvKl8lwt4
- CKA + CKAD: https://t.co/PcLv6wrgWE
- CKA + CKS Bundle: https://t.co/Q0oftVhejG
- CKA + CKAD + CKS Exam bundle: https://t.co/FpGH7sCu8Z
- KCNA + CKA: https://t.co/gTh4V3UPl9
- KCSA + CKS Exam Bundle: https://t.co/ugSKJ2EjWg
- KCNA + KCSA Exam Bundle: https://t.co/zvSxZti8QZ

Get 75% discount on the following superbundles using code JPRIME26SBCT

- Cybersecurity Super Bundle
- Cloud Native Developer Super Bundle
- Cloud Native Super Bundle

Get 20% of THRIVE-Annual using code JPRIME26TOCT

♻️ P.S. Don’t forget to repost and share it with the DevOps community and your friends!

#kubernetes #devops #cka #ckad #cks

[Tom Dörr @tom_doerr]

Step-by-step guide to securing Linux servers

https://t.co/sp4eEBvN8e

[Ayaan 🐧 @twtayaan]

Your incident response toolkit in 8 Kubernetes commands. 🚨

[GitHub Projects Community @GithubProjects]

httpsok is a tool that automates SSL certificate renewal by detecting Nginx configurations directly, without requiring manual setup.

- Auto-detects Nginx configs, suitable for legacy or complex production environments
- Supports wildcard, multi-domain, and multi-server certificates
- Provides WeChat push alerts for expiring certificates
- Works with CDN, load balancers, and OSS from major cloud providers

[Neo Kim @systemdesignone]

API Design Playbook (Giveaway Alert)

• Core API fundamentals.
• Clean & scalable design principles.
• Popular patterns used in real-world systems.
• Practical concepts for interviews & building projects.

24 HOURS ONLY!

To get it for free:

1 Follow @systemdesignone [MUST]
2 Like & Retweet to get DM
3 Reply "Playbook"

Then I'll DM you the details.

[Tom Dörr @tom_doerr]

Runs Windows apps as native Linux programs

https://t.co/MMLcT7pqHR

[Ben Dicken @BenjDicken]

It's a chonky boi guys

[Shraddha Bharuka @BharukaShraddha]

If I had to start System Design from scratch again, I’d ignore 90% of the internet…

…and just study these 40 articles.

No random YouTube hopping.
No endless tabs.
No confusion.

Just a clean, structured path that actually works.

This is the roadmap I *wish* I had during my interview prep 👇

You’ll learn:
• How to think in systems (not just memorize answers)
• Real trade-offs (scalability vs consistency, latency vs cost)
• How to design like a senior engineer

And the best part?
You can even:
→ Ask questions via voice in real-time
→ Get instant feedback
→ Practice HLD even as a beginner

Here’s the full breakdown:

1. HLD Basics → https://t.co/wwSc89YhEH
2. Core Concepts & Trade-offs → https://t.co/8zHIKju6ad
3. Networking & DNS → https://t.co/2pXkfudjfC
4. Load Balancing & Scaling → https://t.co/ZBrhdOYhzO
5. Application Architecture → https://t.co/VO68OWT0EK
6. Databases → https://t.co/hO58Rbdfmy
7. Caching → https://t.co/UpJTS786rI
8. Async Processing → https://t.co/vy6FN7NkES
9. Communication Protocols → https://t.co/epmD5E44tP
10. Performance & Monitoring → https://t.co/4OsgVix1Dj
11. Cloud Design Patterns → https://t.co/ppZOR1CV1Q
12. Reliability Patterns → https://t.co/bTSWTdWAoJ

Save this.
This is easily 50+ hours of scattered learning—compressed into one roadmap.

Follow this, and System Design will finally start making sense.

[Tom Dörr @tom_doerr]

Enterprise zero-trust VPN faster than OpenVPN

https://t.co/V2eLcYrngG

[Shraddha Bharuka @BharukaShraddha]

GIT — MASTER TREE 🌳

Git
│
├── 01. Foundations
│ ├── What is Git?
│ ├── Version Control
│ ├── Local Repository
│ ├── Remote Repository
│ ├── Git Workflow
│ └── Git vs GitHub
│
├── 02. Repository Setup
│ ├── git init
│ ├── git clone
│ ├── git config
│ ├── .gitignore
│ ├── Repository Structure
│ └── Git Aliases
│
├── 03. Core Workflow
│ ├── git status
│ ├── git add
│ ├── git commit
│ ├── git push
│ ├── git pull
│ └── git fetch
│
├── 04. Branching
│ ├── git branch
│ ├── git checkout
│ ├── git switch
│ ├── Feature Branches
│ ├── Release Branches
│ └── Hotfix Branches
│
├── 05. Merging & Rebasing
│ ├── git merge
│ ├── git rebase
│ ├── Fast-Forward Merge
│ ├── Squash Merge
│ ├── Cherry Pick
│ └── Conflict Resolution
│
├── 06. Collaboration
│ ├── GitHub
│ ├── GitLab
│ ├── Bitbucket
│ ├── Pull Requests
│ ├── Code Reviews
│ └── Forking Workflow
│
├── 07. History & Inspection
│ ├── git log
│ ├── git diff
│ ├── git show
│ ├── git blame
│ ├── git reflog
│ └── Commit History
│
├── 08. Undoing Changes
│ ├── git restore
│ ├── git reset
│ ├── git revert
│ ├── Undo Commits
│ ├── Recover Lost Work
│ └── Detached HEAD
│
├── 09. Advanced Git
│ ├── Stashing
│ ├── Tags
│ ├── Submodules
│ ├── Git Hooks
│ ├── Sparse Checkout
│ └── Monorepos
│
├── 10. Git in Production
│ ├── CI/CD Integration
│ ├── Branch Protection
│ ├── Release Management
│ ├── Semantic Versioning
│ ├── Deployment Pipelines
│ └── GitOps
│
└── 11. Future of Git
├── AI-Assisted Commits
├── Automated Code Reviews
├── AI Pair Programming
├── Intelligent Merging
└── Autonomous Development Workflows

Most developers memorize Git commands.

The best engineers understand the workflow behind them. 🚀

[Neo Kim @systemdesignone]

If you want to get ahead of 99% of software engineers, then read these 12 books:

1 Designing Data-Intensive Applications
2 Clean Code
3 The Pragmatic Programmer
4 The Mythical Man-Month
5 Introduction to Algorithms
6 Code Complete
7 The C Programming Language
8 Refactoring
9 The Art of Computer Programming
10 Structure and Interpretation of Computer Programs
11 Peopleware
12 Design Patterns

What else should make this list?

[Tom Dörr @tom_doerr]

Comprehensive Claude Code guide covering setup, MCP, and 954+ agent skills

https://t.co/toumPhim77

[Nav Toor @heynavtoor]

An engineer in Mumbai started building an ebook manager in 2006. Twenty years later, almost 3 million people across 236 countries open it every two months.

His name is Kovid Goyal. The software is called Calibre. He still maintains it as principal developer. The last release shipped a week ago.

It is free. It is GPL-3.0 open source. It runs on Windows, Mac, and Linux.

Here is what it does in plain words.

You drag an ebook into it. It reads almost every format on Earth. EPUB. MOBI. AZW. AZW3. KFX. PDF. Comics in CBR and CBZ. Word documents. Text files.

You can convert any of those into any other format with two clicks. So the book you bought on Kindle can be read on a Kobo. The PDF your professor sent can be read as an EPUB on your phone. The comic in CBR can be turned into an EPUB.

You can edit the metadata, fix the cover, add tags, organize a library of ten thousand books.

You can send the book to your Kindle, your Kobo, your Tolino, your phone, your tablet straight from the app.

You can run a small content server on your own laptop and read your books on any browser in your house.

24,978 stars on GitHub. 2.9 million active installs in the last 60 days. United States is the biggest user base at 14.8 percent, India is in the top 20, every country on the map has it running somewhere.

This is what your personal library was supposed to look like. A folder of files you own. Not a device that locks you in.

(Link in the comments)