3 ms·

Learning a protocol by writing a toy client (or toy server) is a blast. It's so satisfying to see a real, production-quality server sending real responses to yo

• tptacek 5y ago
  You'd probably enjoy work as a software pentester, where the docket --- at least for non-web-applications, which admittedly are the most common project if you don't specialize --- is almost entirely building tooling-grade implementations of random protocols so you can test for vulnerabilities.
  • westurner 5y ago
    Here's caddy's go/tls wrapper with e.g. ACME, OCSP stapling: https://github.com/caddyserver/caddy/blob/master/modules/caddytls/tls.go https://github.com/caddyserver/caddy/blob/master/modules/cad... Django-ca also does OCSP and certbot-compatible ACMEv2 w/ known limitations: https://django-ca.readthedocs.io/en/latest/acme.html#known-limitations https://django-ca.readthedocs.io/en/latest/acme.html#known-l... E.g. https://google.github.io/clusterfuzzlite/ https://google.github.io/clusterfuzzlite/ is likely not so great at protocols because that requires testing concurrent and distributed systems and TLAplus, which at least currently can't find side channels FWIU. https://github.com/secfigo/Awesome-Fuzzing#network-protocol-fuzzers https://github.com/secfigo/Awesome-Fuzzing#network-protocol-... OSS-Fuzz runs CloudFuzz[Lite?] for many open source repos and feeds OSV OpenSSF Vulnerability Format: https://github.com/google/osv#current-data-sources https://github.com/google/osv#current-data-sources