OSCP vs CEH: They Clear Different Gates
CEH gets a CV past a filter. OSCP convinces the person running the technical interview. Which one is worth six months of your evenings depends entirely on which gate is actually in front of you.
Practical technology knowledge
The practical tech
knowledge platform
Tutorials, guides, comparisons and analysis on security, Linux, networking, development, cloud and the tooling that powers modern technology — written by practitioners, for practitioners.
226
Articles
10
Topics
2019
Publishing since
Free tools
Practical tools, no sign-up
Most run entirely in your browser, so nothing you paste — a token, a password, production data — is ever sent to us.
Featured
Cyber Security
Home Network Security: What Your Doorbell Can Reach
Nobody is finding your camera by your IP address. They are finding it because UPnP opened a port, or because a password was reused. Turn off the first, fix the second, and put everything else on its own network.
Most read
All articles →01Fix any Git mistake: reset, revert, rebase and cherry-pick, by symptomDevelopment · 7 min02Rootless Docker: running containers without root on the hostLinux & Systems · 5 min03Node.js vs PHP: The Difference Is What Survives a RequestDevelopment · 7 min04Nginx rate limiting that works: leaky buckets, burst, and getting the client IP rightLinux & Systems · 6 min05Wi-Fi 7 vs Wi-Fi 6 and 6E: what actually changed, and whether to wait for Wi-Fi 8Networking · 7 min
Explore by topic
All topics →Latest articles
Search archive →
CloudFront vs Cloudflare: The Hop Everybody Forgets to Price
CloudFront meters delivery and gives you free origin egress from AWS. Cloudflare does not meter delivery but your S3 bucket still bills you on every cache miss. Which one wins comes down to a number most people have never measured.
Next.js Security: Where the Authorisation Check Belongs
Middleware is not an authorisation boundary — CVE-2025-29927 proved it with one header. Where to put the check so a page, a route handler and a Server Action are all covered, what leaks into the RSC payload, and the CSP choice that costs you static rendering.
Linux Kernel Module Debugging: printk, Dynamic Debug and ftrace
printk is the tool most likely to hide the bug you are chasing. Dynamic debug switches instrumentation on per line at runtime with no rebuild, ftrace shows what actually ran, and faddr2line turns an oops into a source line.
Nginx rate limiting that works: leaky buckets, burst, and getting the client IP right
The directives are the easy part. Behind a CDN, the usual configuration rate-limits the proxy and throttles every visitor as one. Here is the leaky bucket explained, burst and delay tuned properly, and real_ip set up safely.
Docker container security: 20 checks, ordered by what they actually prevent
A default docker run gives you root, a writable filesystem, most capabilities and no resource ceiling. Here is every hardening flag worth applying — with the four that block host compromise separated from the sixteen that are ordinary hardening.
Wi-Fi 7 vs Wi-Fi 6 and 6E: what actually changed, and whether to wait for Wi-Fi 8
Wi-Fi 7's headline 46 Gbps is unreachable and beside the point. Multi-Link Operation is the real upgrade, 320 MHz channels are regionally constrained, and Wi-Fi 8 certification is a 2028 matter.
Git hooks for secrets: catching them locally, and enforcing it where it counts
A local hook is bypassed by --no-verify, lives outside the clone, and never sees a web commit. Set it up anyway, then put the real enforcement in CI and push protection — and rotate before you rewrite history.
Nginx reverse proxy with SSL: the config, and the four things that break after it
A working reverse proxy config is the easy part. Lost client addresses, buffered streaming, silent WebSocket failures and security headers that vanish on error pages are what actually cost you an afternoon.