HTTPS Exposes Website Hostnames in Plain Text Due to TLS Design

·1 views

Every HTTPS connection begins with a TLS ClientHello message that includes the destination hostname in plain, unencrypted text via an extension called Server Name Indication (SNI). A developer confirmed this by capturing raw TLS handshake data and extracting readable hostnames — such as 'login.mybank.example.com' — without decrypting a single byte. The exposure is not a flaw but an intentional protocol design: servers sharing one IP address need to know which site is being requested before they can present the correct certificate and establish encryption. This creates a chicken-and-egg problem where the hostname must be sent before any encrypted channel exists to protect it. A proposed standard called Encrypted Client Hello (ECH) aims to address this, but it has not yet seen widespread adoption.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How ESP32-S3 Voice Satellites Fail: The Full Audio Pipeline Explained

A technical breakdown reveals that poor performance in ESP32-S3-based Home Assistant voice satellites stems not from microphone sensitivity alone, but from the entire audio pipeline spanning capture, I2S/PDM timing, Wi-Fi upload, and speaker playback. ESPHome's voice_assistant component splits responsibilities between the ESP32 device and Home Assistant Assist, but latency accumulates at every boundary across that split. Developers are cautioned that PDM microphone support behaves differently across ESP32 variants, meaning configurations cannot be blindly ported between chip versions. The ESP32-S3 is better suited for voice work due to its dual cores and AI vector instructions, yet it remains resource-constrained when simultaneously handling capture, wake detection, networking, and playback. ESPHome's own documentation warns that audio and Bluetooth components compete for RAM and CPU, a limitation that should be treated as a core architectural constraint rather than a minor footnote.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Structured Problem Deconstruction Beats Memorization in LeetCode Prep

A developer guide published on DEV Community argues that solving algorithmic problems on platforms like LeetCode should rely on structured pattern recognition rather than memorizing code blocks. The article introduces a framework called 'Problem Anatomy,' which breaks down every LeetCode problem into five components: a description, constraints, a main pattern, a modifier, and edge cases. According to the guide, the problem description always contains clues to the core algorithmic pattern, such as sliding window, graph traversal, or two-pointer approaches. The author illustrates this with an example where identifying a 'contiguous subarray of fixed length k' signals a fixed-size sliding window solution. The central argument is that sustainable interview performance comes from deductive reasoning built on structural analysis, not rote memorization of syntax.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Tutorial: Refactoring an ASP.NET Controller with Stopwatch and Primary Constructors

A hands-on tutorial for ASP.NET developers walks through fixing a basic ASP.NET app built with .NET 10 and C#. The guide focuses on cleaning up a controller by removing redundant methods and replacing DateTime with Stopwatch for more accurate response-time measurement. It also explains how primary constructors in C# implicitly turn injected services into class fields, which can cause lifecycle issues. Specifically, if a Singleton class depends on a Scoped service, that Scoped service will live as long as the Singleton, potentially causing bugs. The series plans to cover Entity Framework Core in an upcoming installment.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

WordPress Bootstrap Hooks Explained: Why Timing Determines Success or Failure

In WordPress development, calling functions in the wrong bootstrap hook can cause silent failures or fatal errors, even when the code itself is syntactically correct. For example, registering a post type during plugins_loaded triggers errors because taxonomies are not yet available, while adding theme support during init is silently ignored because that window has already closed. WordPress provides five key hooks in a strict sequence — muplugins_loaded, plugins_loaded, after_setup_theme, init, and wp_loaded — each designed for a specific class of actions. These timing bugs are notoriously difficult to diagnose because symptoms, such as missing thumbnails or broken translations, often appear unrelated to their root cause. Understanding which hook is open at each stage of the WordPress lifecycle is essential to writing reliable, predictable plugin and theme code.

0 comments Read more at DEV Community