Huli's blog

IndiePing 名錄收錄·資料來源與計算方式 ⓘ

收錄文章: 49篇

最新收錄

本頁 49 篇

從攻擊手法開始重新認識網路 - DNS 篇
「從攻擊手法開始重新認識網路」是一個新的系列文，比起從頭開始講起某個東西如何運作，我會直接先從攻擊手法開始切入，從這點去探討這個攻擊是怎麼做到的，又該如何防禦。帶著這些問題去閱讀文章，可以更有意識地去理解現在要學的是什麼，待會看到的東西又是為了解決什麼問題。比起平鋪直敘的講解名詞，「從一開始就帶著問題閱讀」是我更想嘗試的方式。這篇會聊聊 DNS 的運作原理、攻擊手法以及相對應的解法，話不多說直接開始。
2026/6/23 11:11Hulihttps://blog.huli.tw/2026/06/23/learn-network-from-attack-dns/
Reunderstanding the Internet from Attack - DNS
“Reunderstanding the Internet from Attack” is a new series of articles. Instead of starting from scratch to explain how something works, I will directly begin with attack techniques, exploring how these attacks are executed and how to defend against them. Reading the article with these questions in mind can help you consciously understand what you are learning and what problems the upcoming content aims to solve. Rather than a straightforward explanation of terms, “reading with questions from th
2026/6/23 11:11Hulihttps://blog.huli.tw/2026/06/23/en/learn-network-from-attack-dns/
npm 供應鏈攻擊從頭談起：原理、手法與防禦方式
2026 年 5 月 19 日，拿來做圖表的套件 antv 遭到攻擊，最新版本被植入惡意程式。 5 月 13 日，前端圈很熱門的 TanStack 系列 repo 也遭到攻擊。 4 月 1 日，每週有一億次下載的 axios 也同樣被攻擊，被發布了惡意版本。大概每隔一個月或甚至一週就會看到供應鏈攻擊的新聞，而被攻擊的對象也不只有 npm，Python 的 PyPI、.NET 的 NuGet、甚至是 Docker Hub 或是開發者在用的 VSCode extension，也全部都是目標。在這個前提下，開發者該如何保護自己？這篇主要來談談針對 npm 的供應鏈攻擊，先從原理開始聊起，接著來談談攻擊手法，以及防禦方式。
2026/5/25 11:17Hulihttps://blog.huli.tw/2026/05/25/dive-into-npm-supply-chain-attack/
A Deep Dive into npm Supply Chain Attacks and Defense
On May 19, 2026, the charting library antv was attacked, and the latest version was embedded with malicious code. On May 13, the popular TanStack series repo in the frontend community was also attacked. On April 1, axios, which has a hundred million downloads weekly, was similarly attacked, and a malicious version was released. It seems that news about supply chain attacks appears every month or even every week, and the targets are not limited to npm; Python’s PyPI, .NET’s NuGet, and even Docker
2026/5/25 11:17Hulihttps://blog.huli.tw/2026/05/25/en/dive-into-npm-supply-chain-attack/
從逆向工程重新認識 AI 的強大
之前寫過一篇感謝 AI 讓我這外行人也能做簡單的逆向工程，描述了我怎麼結合 AI agent 跟 ghidra MCP，去逆向一個 Golang binary（stripped），就算結果有點小錯誤，但整體方向都是對的。過了快兩個月，這中間我拿 AI 去逆向了更多東西，更多我以為 AI 逆不出來的東西，但 AI 狠狠地打了我的臉，我才是無知的那個。這篇記錄一下 AI 能做到的事情，最後聊聊這件事讓我對 AI 的看法有了怎樣的改變。
2026/4/18 10:46Hulihttps://blog.huli.tw/2026/04/18/ai-reverse-engineering-op/
Reunderstanding the Power of AI Through Reverse Engineering
Previously, I wrote a post titled Using AI to Do Simple Reverse Engineering, describing how I combined an AI agent with Ghidra MCP to reverse engineer a stripped Golang binary. Although there were some minor errors in the results, the overall direction was correct. Nearly two months have passed, and during this time, I used AI to reverse engineer more things, including many that I thought AI couldn’t handle. However, AI slapped me in the face, revealing that I was the ignorant one. This article
2026/4/18 10:46Hulihttps://blog.huli.tw/2026/04/18/en/ai-reverse-engineering-op/
從 Coupang 的個資外洩談內部威脅、金鑰管理與 JWT
從去年 11 月開始，Coupang 個資外洩的事件就受到不少關注，一來是據傳外洩的資料數目龐大，二來這間公司也有在台灣設點。隨著調查進度持續推進，也有越來越多細節出現，甚至還被形容為如同電影情節，去河裡打撈硬碟。最近跑去翻了韓國那邊出的報告發現寫得還滿詳細的，就寫一篇來聊聊這整件事情在技術上到底是怎麼做到的，以及在資安上又有哪些可以留意的地方。
2026/3/19 10:28Hulihttps://blog.huli.tw/2026/03/19/coupang-insider-kms-and-jwt/
Learn Internal Threats, Key Management, and JWT from the Coupang Data Breach
Since November last year, the data breach incident at Coupang has attracted considerable attention, partly due to the reportedly massive amount of leaked data, and partly because the company has a pre
2026/3/19 10:28Hulihttps://blog.huli.tw/2026/03/19/en/coupang-insider-kms-and-jwt/
感謝 AI 讓我這外行人也能做簡單的逆向工程
最近碰到一個場合拿到了個 Golang HTTP server 的 binary，需要把它拆開進一步研究，找到通往下一步的線索。但關於逆向工程這件事情，我是很陌生的。我只會把 binary 丟到 Ghidra 裡面，接著就什麼都不會了，我連搜尋字串都不會。不過現在 AI agent 已經進化得很快了，只要工具運用得當，像我這種的逆向外行人，也能簡單靠 AI 做基礎的逆向工程，這篇就來記錄一下步驟。先寫在前面，我拿到的跟這次示範的都是比較小的程式，如果是更大或更複雜的我也不知道能不能跑。我也不會覺得 AI 可以完全取代人原本需要做的部分，但鐵定能讓部分任務變得更輕鬆。而像我這樣的外行人，原本能逆出的東西接近沒有，靠 AI 之後能給一些線索都好，就算是亂講的也有一些些參考價值，有總比沒有好嘛，亂講的我還能想辦法再去驗證。至於原本就會逆向的，我也不確定 AI 有沒有幫助，或者是他們會怎麼用，這個不在本篇的討論範圍。
2026/3/1 12:20Hulihttps://blog.huli.tw/2026/03/01/reverse-engineering-with-ai-ghidra-mcp/
Using AI to Do Simple Reverse Engineering
Recently, I encountered a situation where I got a Golang HTTP server binary and needed to disassemble it for further research to find clues for the next steps. However, I am quite unfamiliar with reverse engineering. I only know how to throw the binary into Ghidra, and then I’m lost; I can’t even search for strings. But now AI agents have evolved rapidly. As long as the tools are used properly, even a reverse engineering layman like me can easily rely on AI to perform basic reverse engineering.
2026/3/1 12:20Hulihttps://blog.huli.tw/2026/03/01/en/reverse-engineering-with-ai-ghidra-mcp/
從 React 中學習 JavaScript 底層運作
前陣子去 JSDC 的線上前導活動分享了這個主題，想說既然都分享了，不如就寫篇文章好了。這篇文章的靈感來源以及內容其實都是來自於《JavaScript 重修就好》。當初寫書的時候就有參考 React 原始碼中的一些東西，這篇只是把原本分散在書中的各個 React 相關章節整理起來重寫一遍。我覺得從這些開源專案的程式碼中學一些新的概念滿有趣的，畢竟這些很多人用的框架通常碰過的 bug 也越多，學到這些問題的解法以後，也可以再回去反思以前自己學過的東西。這篇分成三個小章節： React 舊版的 XSS 從 React Fiber 學習 event loop 從 V8 bug 學習底層運作開頭先聲明一下，雖然標題叫做「從 React 中學習 JavaScript 底層運作」，只有最後一個比較底層，第一個更是與底層沒什麼關係。只是我沒想到比這個更好的標題，因此就用這個了。
2025/11/16 06:32Hulihttps://blog.huli.tw/2025/11/16/learn-advanced-javascript-from-react/
Learning the Core of JavaScript from React
Recently, I shared this topic at the online pre-event of JSDC. Since I already shared it, I thought it would be good to write an article. The inspiration and content of this article actually come from “JavaScript Relearning” (only available in Chinese). When I wrote the book, I referenced some elements from the React source code, and this article is just a reorganization and rewriting of the various React-related chapters that were originally scattered throughout the book. I find it interesting
2025/11/16 06:32Hulihttps://blog.huli.tw/2025/11/16/en/learn-advanced-javascript-from-react/
Chrome 內建的翻譯與 Prompt API
前陣子有個讀者分享給我他自己做的 Chrome extension：JP NEWS Helper，能夠摘要、翻譯 NHK News Easy 上面的文章，幫助學日文。由於這個擴充套件是開源的，因此我第一件好奇的事就是：「它是用哪一間 AI 的服務，key 怎麼處理？」，結果看了 source code 才發現居然是 Chrome 內建的 Web API，不是我以為的 HTTP API。算是有點後知後覺，現在才發現原來有內建的 Web API 可以用，因此寫篇文章簡單記錄一下。
2025/9/27 05:50Hulihttps://blog.huli.tw/2025/09/27/chrome-built-in-prompt-api/
Chrome's Built-in Translation and Prompt API
Recently, a reader shared with me a Chrome extension he created: JP NEWS Helper, which can summarize and translate articles from NHK News Easy, helping to learn Japanese. Since this extension is open source, my first curiosity was: “Which AI service does it use, and how is the key handled?” After looking at the source code, I found out that it actually uses Chrome’s built-in Web API, not the HTTP API I had assumed. It was a bit of a late realization for me to discover that there are built-in Web
2025/9/27 05:50Hulihttps://blog.huli.tw/2025/09/27/en/chrome-built-in-prompt-api/
不需要括號跟分號的 XSS
前陣子收到一封讀者來信，問我能不能寫一篇來講解 XSS without parentheses and semi-colons 這篇文章，說是這裡面的 payload 看不太懂。因此，這篇就來簡單講解一下這些 payload，參考的原文是 Gareth Heyes 的這兩篇文章： XSS technique without parentheses XSS without parentheses and semi-colons
2025/9/15 04:50Hulihttps://blog.huli.tw/2025/09/15/xss-without-semicolon-and-parentheses/
Explaining XSS without parentheses and semi-colons
Recently, I received an email from a reader asking if I could write an article explaining XSS without parentheses and semi-colons, saying that the payloads in it were hard to understand. Therefore, this article will briefly explain these payloads, referencing Gareth Heyes’ two articles: XSS technique without parentheses XSS without parentheses and semi-colons
2025/9/15 04:50Hulihttps://blog.huli.tw/2025/09/15/en/xss-without-semicolon-and-parentheses/
人人都需要一個 HTTP proxy 來 debug
身為每天都要與網頁打交道的前端工程師，熟悉 DevTools 的使用是相當合理的。每當接 API 出問題時，就按下快捷鍵打開 DevTools，切到 Network 分頁，找到紅色的那一行，右鍵複製成 cURL 貼到群組裡面，讓後端自己找找問題。但不曉得大家有沒有碰過 DevTools 不夠用的狀況，這時該怎麼辦？
2025/4/23 10:50Hulihttps://blog.huli.tw/2025/04/23/everyone-need-a-http-proxy-to-debug/
Everyone Needs an HTTP Proxy for Debugging
As a front-end engineer who deals with web pages every day, it is quite reasonable to be familiar with the use of DevTools. Whenever there is an issue with an API, I just press the shortcut to open DevTools, switch to the Network tab, find the red line, right-click to copy it as cURL, and paste it into the group chat for the backend team to troubleshoot. But I wonder if anyone has encountered situations where DevTools are not sufficient. What should we do then?
2025/4/23 10:50Hulihttps://blog.huli.tw/2025/04/23/en/everyone-need-a-http-proxy-to-debug/
VS Code Material Theme 不是惡意軟體——安全的線該畫在哪？
應該不少人都有跟到三週前 VS Code 上的知名套件 Material Theme 被微軟主動下架的新聞，那下架的理由是什麼呢？根據你得知這件事的消息來源以及自身個性，可能會有兩種回答：它「疑似」含有惡意程式碼它就是個惡意軟體為什麼跟自身個性有關呢？因為就算消息來源接收到的是第一種，在種種條件的互相加持影響之下，你也很有可能解釋成第二種。
2025/3/16 10:40Hulihttps://blog.huli.tw/2025/03/16/vscode-material-theme-is-not-a-malware/
VS Code Material Theme is Not a Malware — Where Should the Line Be Drawn?
Many people might have followed the news three weeks ago about the well-known extension Material Theme being proactively removed from VS Code by Microsoft. So what was the reason for its removal? Depending on your source of information, there might be two answers: It “allegedly” contains malicious code. It is indeed malware.
2025/3/16 10:40Hulihttps://blog.huli.tw/2025/03/16/en/vscode-material-theme-is-not-a-malware/
HITCON CTF & corCTF & sekaiCTF 2024 Writeup
It’s been a while since I wrote writeup. I’ve wanted to write for a long time but kept procrastinating. For something like CTF writeups, speed is quite important because most discussions happen in Dis
2024/9/23 10:40https://blog.huli.tw/2024/09/23/en/hitconctf-corctf-sekaictf-2024-writeup/
快速部署網站的新選擇：Zeabur 使用心得
以前當我想要部署一個簡單的服務時，我會去 Heroku 上面，因為簡單而且免費，雖然說還是有些使用限制，但整體而言還是很方便的，甚至還有一些簡單的 DB 可以用。如果是靜態網頁，會選擇 Netlify 或是 GitHub Pages，也都是簡單方便的選擇。但 Heroku 從 2022 年年底之後就不再提供免費方案了，因此那時一堆人在尋找替代方案，包括 Render 或是 fly[dot]io
2024/4/14 10:40https://blog.huli.tw/2024/04/14/zeabur-introduction-deploy-service/
0CTF 2023 筆記
今年的 0CTF 一共有三道 web 題，其中一道題目是 client-side 的，我就只解這題而已，順利拿到 first blood，這篇簡單記錄一下心得。關鍵字列表： CSS injection CSS exfiltration
2023/12/11 12:40https://blog.huli.tw/2023/12/11/0ctf-2023-writeup/
簡單分析 CVE-2023-46729：Sentry Next.js SDK 的 URL rewrite 漏洞
Sentry 在 2023 年 11 月 9 號時，在部落格上發布了這篇文章：Next.js SDK Security Advisory - CVE-2023-46729，內容主要在講述 CVE-2023-46729 這個漏洞的一些細節，包含漏洞成因、發現時間以及修補時間等等。雖然說是在 11/9 正式對外發布漏洞公告，但漏洞其實在 10/31 發佈的 7.77.0 版本已經
2023/11/13 14:40https://blog.huli.tw/2023/11/13/sentry-nextjs-sdk-cve-2023-46729/
原來 img src 也支援 mp4（Safari 限定）
有些網站會用 GIF 來做一些圖檔，畢竟會動嘛，看起來就比一些靜態的圖片還要厲害，還要來得更吸引人。或其實不只是因為吸引人，而是有些需求本來就需要一個會動的圖，例如說貼圖，會動是很正常的。但是 GIF 的缺點之一眾所皆知，就是檔案很大，真的很大。尤其是手機上因為解析度比較高，可能會需要用到三倍大小的圖片，就算只顯示 52 px，也要準備 156px 的圖檔，佔的空間就更多了。以網頁來說，當然是要
2023/9/11 20:10https://blog.huli.tw/2023/09/11/mp4-in-img-src/
Updating Blog with chatGPT
It’s been a long time since I made any major changes to my blog structure. Hexo has already released v6, and v7 is currently in beta, but my blog is still on hexo3. Recently, I had some free time and
2023/6/20 13:10https://blog.huli.tw/2023/06/20/en/update-blog-with-chatgpt/
Android App Reverse Engineering Part 3: Monitoring App Packets
I remember when I first started working with Android, it was easy to see which requests an app was sending. All I had to do was install Charles on my computer, set up the Wi-Fi on my phone to proxy to
2023/4/27 13:20https://blog.huli.tw/2023/04/27/en/android-apk-decompile-intro-3/
SekaiCTF 2022 Notes and Concurrent Limit
I casually played SekaiCTF 2022 last weekend and I have to say that the visual style is pretty cool. You can tell that a lot of effort was put into it, and it feels like a game. This time, I only play
2022/10/8 08:43https://blog.huli.tw/2022/10/08/en/sekaictf2022-safelist-and-connection/
Intigriti 0822 XSS Challenge Author Writeup
In Auguest, I and bruno made a XSS challenge on Intigriti. When we decided to make it, we hope it’s a difficult and fun challenge, and the players can also learn a lot from it. Here is the writeup f
2022/8/29 06:43https://blog.huli.tw/2022/08/29/en/intigriti-0822-xss-author-writeup/
GoogleCTF 2022 筆記
第一次參加 GoogleCTF，這次解了一題 web（HORKOS），然後另外一題偏接近但沒解出來（POSTVIEWER），依照慣例簡單寫一下每一題的 web 的解法，以解出人數來排序。附上關鍵字如下： log4j ReDoS hop by hop JavaScript magic function(?) async/await and Promise race conditio
2022/7/9 16:36https://blog.huli.tw/2022/07/09/google-ctf-2022-writeup/
ångstromCTF 2022 Writeup
I didn’t check all the challenges this time because when I joined the competition, most of the challenges already solved by my teammates lol I love JavaScript(yep, including those weird features) an
2022/5/5 16:43https://blog.huli.tw/2022/05/05/en/angstrom-ctf-2022-writeup-en/
JavaScript 中 RegExp 與字串取代的神奇特性
簡單記錄幾個最近碰到的神奇特性，直接講不有趣，先來幾個小挑戰：
2022/4/14 19:29https://blog.huli.tw/2022/04/14/javascript-string-regexp-magic/
SUSCTF 2022 Writeup
這個假日有不少 CTF，跟著隊伍 SU 一起打了 SUSCTF 2022，這篇簡單記錄一下幾個我有參與的題目的心得。會講到的題目列表如下： web/fxxkcors web/ez_note web/baby gadget v1.0 web/baby gadget v1.0’s rrrevenge web/HTML practice
2022/3/1 20:54https://blog.huli.tw/2022/03/01/susctf-2022-writeup/
How a flawed password reset mechanism can lead to account takeover vulnerabilities? Matters as an example
Password reset is a mechanism that almost all websites have. The most common way is to send a password reset link via email, and after clicking the link, the user can set a new password for the accoun
2022/1/4 12:00https://blog.huli.tw/2022/01/04/en/reset-password-vulnerability/
Understanding the Log4j and Log4Shell Vulnerabilities through Surveillance Cameras
The biggest news in the cybersecurity industry at the end of 2021 is undoubtedly the Log4j vulnerability, also known as CVE-2021-44228 or Log4Shell. Some even describe it as a “nuclear-level vulnerabi
2021/12/18 12:00https://blog.huli.tw/2021/12/18/en/what-is-log4j-and-log4shell/
Discovering My Lack of Front-end Knowledge through Cybersecurity
This article is the text version of my presentation “Discovering the Depth of Front-end through Cybersecurity” at Modern Web 2021. The video of the talk is not yet available, but if you want to see th
2021/10/24 23:00https://blog.huli.tw/2021/10/25/en/learn-frontend-from-security-pov/
Creating HTML Web Pages Suitable for Printing as PDFs with Paged.js
IntroductionI was recently tasked with generating a PDF report. There are many ways to create a PDF, such as using Word and then converting it to PDF. However, my first thought was to write it as a we
2021/6/12 14:10https://blog.huli.tw/2021/06/12/en/paged-js-htmo-to-pdf-best-solution/
Intigriti’s 0521 XSS 挑戰解法：限定字元組合程式碼
前言Intigriti 是國外的一個 bug bounty 平台，每個月都會推出一個 XSS 挑戰，有大約一到兩週的時間可以去思考，目標是在特定網站上面執行 alert(document.domain)，解出來之後把結果透過 Intigriti 平台回報，最後會隨機抽 3 個解掉的人得到他們自己商店的優惠券。上個月的挑戰因為解出來的人不多，所以我有幸運抽到 50 歐元的優惠券，其實很划算，因為商
2021/6/7 20:34https://blog.huli.tw/2021/06/07/xss-challenge-by-intigriti-writeup-may/
An Introduction to DOM Clobbering and Its Applications
IntroductionAs a front-end engineer, it is natural to know a lot about front-end-related knowledge, such as HTML or JS-related things, but those knowledge is usually related to “use”. For example, I k
2021/1/23 12:34https://blog.huli.tw/2021/01/23/en/dom-clobbering/
從 V8 bytecode 探討 let 與 var 的效能問題
前言在我以前寫過的兩篇文章：我知道你懂 hoisting，可是你了解到多深？以及所有的函式都是閉包：談 JS 中的作用域與 Closure 裡面，都談到了 let 與 var 作用域的不同。 let 的作用域是 block，而 var 則是 fucntion，像這個就是經典案例： for(var i=1; i<=10; i++) { setTimeout(function()
2020/2/20 21:49https://blog.huli.tw/2020/02/20/let-vs-var-bytecode/
深入 Session 與 Cookie：Express、PHP 與 Rails 的實作
前言這是一系列共三篇的文章，我稱之為 Session 與 Cookie 三部曲。系列文的目標是想要由淺入深來談談這個經典議題，從理解概念一直到理解實作方式。這是系列文的最後一篇，三篇的完整連結如下：白話 Session 與 Cookie：從經營雜貨店開始淺談 Session 與 Cookie：一起來讀 RFC 深入 Session 與 Cookie：Express、PHP 與 Rails 的
2019/8/9 21:10https://blog.huli.tw/2019/08/09/session-and-cookie-part3/
The Evolution of Web Scraping on Medium
IntroductionA few days ago, I posted an article on Medium titled Medium Chinese Writers’ Follower Ranking and Unprofessional Data Analysis, in which I used Node.js to write a simple web scraper and an
2019/7/12 19:10https://blog.huli.tw/2019/07/12/en/medium-crawler/
幕後花絮：Lidemy HTTP Challenge 的設計以及彩蛋
前言前陣子我為了幫自己的學生們更熟悉 HTTP 以及 API 的串接，寫出了一個小遊戲：Lidemy HTTP Challenge，需要根據每一關的說明取得正確的 token，一共有十五關，前十關基本，後五關進階。經過了一些朋友的測試之後，慢慢調整、改善，最後讓學生測試發現反應都不錯，於是就在前端社群正式對外公開這個遊戲，讓大家也能一起參與。如果你還沒玩過，那強烈建議你不要看這篇文章，因為這篇
2019/5/18 19:10https://blog.huli.tw/2019/05/18/lidemy-http-challenge/
兩年過後，我能夠被稱為資深工程師了嗎？
前言在兩年前我寫了這篇一個資淺工程師年末的自我省視，內文主要是檢視自己那年學到的東西以及抒發心得感想，並提出一些對於自己職涯發展上的疑問。標題之所以是打「資淺」工程師，是因為那時覺得連資深的邊都沾不上，所以用了資淺這個字來形容自己。兩年過去了，職稱從工程師變成資深工程師，甚至還再往上變成了 Front-end Team Lead。雖然職稱本來就不代表一切，但我認為它至少「代表著什麼」，你到了那
2018/12/29 21:10https://blog.huli.tw/2018/12/29/after-two-years-am-i-senior/
AWS Lambda + GitHub API + Google Sheet = Automated Sign-in System
IntroductionDuring the past year, I have conducted several teaching experiments in my spare time, hoping to improve my teaching materials through continuous teaching and gain some insights from studen
2018/9/14 21:10https://blog.huli.tw/2018/09/14/en/aws-lambda-and-github-api/
CORS is not as simple as I thought
IntroductionCORS (Cross-Origin Resource Sharing) has always been a classic problem in front-end development. Simply put, due to some security considerations of the browser, you will encounter some res
2018/8/18 21:10https://blog.huli.tw/2018/08/18/en/cors-is-hard/
A Brief Introduction to React Fiber and Its Impact on Lifecycles
IntroductionAlthough I’ve heard about React replacing its internal reconciler with something called Fiber for a long time, I’ve never studied it in detail and didn’t know what impact this change would
2018/3/31 21:10https://blog.huli.tw/2018/03/31/en/react-fiber-and-lifecycles/
淺談二分搜尋法
前言在寫程式的時候，其實會滿常用到「搜尋」的功能，最簡單的搜尋就是在一串數字裡面找出你想要的數字，而這也是我們今天的主題。這一篇大致上會分成三個部分，第一部分會先介紹線性搜尋法，第二部分介紹二分搜尋法，最後一部分談談二分搜尋法在不同條件底下的實作方式會有什麼不同。
2016/9/23 15:36https://blog.huli.tw/2016/09/23/binary-search-introduction/
ExperienceStruggling with DDoS: nginx, iptables and fail2ban
Recently, there was an incident where our server was attacked by a large number of requests. Unfortunately, the server was hosting a forum service. Assuming that the attack point was the forum homepag
2016/7/21 15:38https://blog.huli.tw/2016/07/21/en/the-battle-against-ddos-nginx-iptables-and-fail2ban/

本頁 49 篇

從攻擊手法開始重新認識網路 - DNS 篇
「從攻擊手法開始重新認識網路」是一個新的系列文，比起從頭開始講起某個東西如何運作，我會直接先從攻擊手法開始切入，從這點去探討這個攻擊是怎麼做到的，又該如何防禦。帶著這些問題去閱讀文章，可以更有意識地去理解現在要學的是什麼，待會看到的東西又是為了解決什麼問題。比起平鋪直敘的講解名詞，「從一開始就帶著問題閱讀」是我更想嘗試的方式。這篇會聊聊 DNS 的運作原理、攻擊手法以及相對應的解法，話不多說直接開始。
2026/6/23 11:11Hulihttps://blog.huli.tw/2026/06/23/learn-network-from-attack-dns/
Reunderstanding the Internet from Attack - DNS
“Reunderstanding the Internet from Attack” is a new series of articles. Instead of starting from scratch to explain how something works, I will directly begin with attack techniques, exploring how these attacks are executed and how to defend against them. Reading the article with these questions in mind can help you consciously understand what you are learning and what problems the upcoming content aims to solve. Rather than a straightforward explanation of terms, “reading with questions from th
2026/6/23 11:11Hulihttps://blog.huli.tw/2026/06/23/en/learn-network-from-attack-dns/
npm 供應鏈攻擊從頭談起：原理、手法與防禦方式
2026 年 5 月 19 日，拿來做圖表的套件 antv 遭到攻擊，最新版本被植入惡意程式。 5 月 13 日，前端圈很熱門的 TanStack 系列 repo 也遭到攻擊。 4 月 1 日，每週有一億次下載的 axios 也同樣被攻擊，被發布了惡意版本。大概每隔一個月或甚至一週就會看到供應鏈攻擊的新聞，而被攻擊的對象也不只有 npm，Python 的 PyPI、.NET 的 NuGet、甚至是 Docker Hub 或是開發者在用的 VSCode extension，也全部都是目標。在這個前提下，開發者該如何保護自己？這篇主要來談談針對 npm 的供應鏈攻擊，先從原理開始聊起，接著來談談攻擊手法，以及防禦方式。
2026/5/25 11:17Hulihttps://blog.huli.tw/2026/05/25/dive-into-npm-supply-chain-attack/
A Deep Dive into npm Supply Chain Attacks and Defense
On May 19, 2026, the charting library antv was attacked, and the latest version was embedded with malicious code. On May 13, the popular TanStack series repo in the frontend community was also attacked. On April 1, axios, which has a hundred million downloads weekly, was similarly attacked, and a malicious version was released. It seems that news about supply chain attacks appears every month or even every week, and the targets are not limited to npm; Python’s PyPI, .NET’s NuGet, and even Docker
2026/5/25 11:17Hulihttps://blog.huli.tw/2026/05/25/en/dive-into-npm-supply-chain-attack/
從逆向工程重新認識 AI 的強大
之前寫過一篇感謝 AI 讓我這外行人也能做簡單的逆向工程，描述了我怎麼結合 AI agent 跟 ghidra MCP，去逆向一個 Golang binary（stripped），就算結果有點小錯誤，但整體方向都是對的。過了快兩個月，這中間我拿 AI 去逆向了更多東西，更多我以為 AI 逆不出來的東西，但 AI 狠狠地打了我的臉，我才是無知的那個。這篇記錄一下 AI 能做到的事情，最後聊聊這件事讓我對 AI 的看法有了怎樣的改變。
2026/4/18 10:46Hulihttps://blog.huli.tw/2026/04/18/ai-reverse-engineering-op/
Reunderstanding the Power of AI Through Reverse Engineering
Previously, I wrote a post titled Using AI to Do Simple Reverse Engineering, describing how I combined an AI agent with Ghidra MCP to reverse engineer a stripped Golang binary. Although there were some minor errors in the results, the overall direction was correct. Nearly two months have passed, and during this time, I used AI to reverse engineer more things, including many that I thought AI couldn’t handle. However, AI slapped me in the face, revealing that I was the ignorant one. This article
2026/4/18 10:46Hulihttps://blog.huli.tw/2026/04/18/en/ai-reverse-engineering-op/
從 Coupang 的個資外洩談內部威脅、金鑰管理與 JWT
從去年 11 月開始，Coupang 個資外洩的事件就受到不少關注，一來是據傳外洩的資料數目龐大，二來這間公司也有在台灣設點。隨著調查進度持續推進，也有越來越多細節出現，甚至還被形容為如同電影情節，去河裡打撈硬碟。最近跑去翻了韓國那邊出的報告發現寫得還滿詳細的，就寫一篇來聊聊這整件事情在技術上到底是怎麼做到的，以及在資安上又有哪些可以留意的地方。
2026/3/19 10:28Hulihttps://blog.huli.tw/2026/03/19/coupang-insider-kms-and-jwt/
Learn Internal Threats, Key Management, and JWT from the Coupang Data Breach
Since November last year, the data breach incident at Coupang has attracted considerable attention, partly due to the reportedly massive amount of leaked data, and partly because the company has a pre
2026/3/19 10:28Hulihttps://blog.huli.tw/2026/03/19/en/coupang-insider-kms-and-jwt/
感謝 AI 讓我這外行人也能做簡單的逆向工程
最近碰到一個場合拿到了個 Golang HTTP server 的 binary，需要把它拆開進一步研究，找到通往下一步的線索。但關於逆向工程這件事情，我是很陌生的。我只會把 binary 丟到 Ghidra 裡面，接著就什麼都不會了，我連搜尋字串都不會。不過現在 AI agent 已經進化得很快了，只要工具運用得當，像我這種的逆向外行人，也能簡單靠 AI 做基礎的逆向工程，這篇就來記錄一下步驟。先寫在前面，我拿到的跟這次示範的都是比較小的程式，如果是更大或更複雜的我也不知道能不能跑。我也不會覺得 AI 可以完全取代人原本需要做的部分，但鐵定能讓部分任務變得更輕鬆。而像我這樣的外行人，原本能逆出的東西接近沒有，靠 AI 之後能給一些線索都好，就算是亂講的也有一些些參考價值，有總比沒有好嘛，亂講的我還能想辦法再去驗證。至於原本就會逆向的，我也不確定 AI 有沒有幫助，或者是他們會怎麼用，這個不在本篇的討論範圍。
2026/3/1 12:20Hulihttps://blog.huli.tw/2026/03/01/reverse-engineering-with-ai-ghidra-mcp/
Using AI to Do Simple Reverse Engineering
Recently, I encountered a situation where I got a Golang HTTP server binary and needed to disassemble it for further research to find clues for the next steps. However, I am quite unfamiliar with reverse engineering. I only know how to throw the binary into Ghidra, and then I’m lost; I can’t even search for strings. But now AI agents have evolved rapidly. As long as the tools are used properly, even a reverse engineering layman like me can easily rely on AI to perform basic reverse engineering.
2026/3/1 12:20Hulihttps://blog.huli.tw/2026/03/01/en/reverse-engineering-with-ai-ghidra-mcp/
從 React 中學習 JavaScript 底層運作
前陣子去 JSDC 的線上前導活動分享了這個主題，想說既然都分享了，不如就寫篇文章好了。這篇文章的靈感來源以及內容其實都是來自於《JavaScript 重修就好》。當初寫書的時候就有參考 React 原始碼中的一些東西，這篇只是把原本分散在書中的各個 React 相關章節整理起來重寫一遍。我覺得從這些開源專案的程式碼中學一些新的概念滿有趣的，畢竟這些很多人用的框架通常碰過的 bug 也越多，學到這些問題的解法以後，也可以再回去反思以前自己學過的東西。這篇分成三個小章節： React 舊版的 XSS 從 React Fiber 學習 event loop 從 V8 bug 學習底層運作開頭先聲明一下，雖然標題叫做「從 React 中學習 JavaScript 底層運作」，只有最後一個比較底層，第一個更是與底層沒什麼關係。只是我沒想到比這個更好的標題，因此就用這個了。
2025/11/16 06:32Hulihttps://blog.huli.tw/2025/11/16/learn-advanced-javascript-from-react/
Learning the Core of JavaScript from React
Recently, I shared this topic at the online pre-event of JSDC. Since I already shared it, I thought it would be good to write an article. The inspiration and content of this article actually come from “JavaScript Relearning” (only available in Chinese). When I wrote the book, I referenced some elements from the React source code, and this article is just a reorganization and rewriting of the various React-related chapters that were originally scattered throughout the book. I find it interesting
2025/11/16 06:32Hulihttps://blog.huli.tw/2025/11/16/en/learn-advanced-javascript-from-react/
Chrome 內建的翻譯與 Prompt API
前陣子有個讀者分享給我他自己做的 Chrome extension：JP NEWS Helper，能夠摘要、翻譯 NHK News Easy 上面的文章，幫助學日文。由於這個擴充套件是開源的，因此我第一件好奇的事就是：「它是用哪一間 AI 的服務，key 怎麼處理？」，結果看了 source code 才發現居然是 Chrome 內建的 Web API，不是我以為的 HTTP API。算是有點後知後覺，現在才發現原來有內建的 Web API 可以用，因此寫篇文章簡單記錄一下。
2025/9/27 05:50Hulihttps://blog.huli.tw/2025/09/27/chrome-built-in-prompt-api/
Chrome's Built-in Translation and Prompt API
Recently, a reader shared with me a Chrome extension he created: JP NEWS Helper, which can summarize and translate articles from NHK News Easy, helping to learn Japanese. Since this extension is open source, my first curiosity was: “Which AI service does it use, and how is the key handled?” After looking at the source code, I found out that it actually uses Chrome’s built-in Web API, not the HTTP API I had assumed. It was a bit of a late realization for me to discover that there are built-in Web
2025/9/27 05:50Hulihttps://blog.huli.tw/2025/09/27/en/chrome-built-in-prompt-api/
不需要括號跟分號的 XSS
前陣子收到一封讀者來信，問我能不能寫一篇來講解 XSS without parentheses and semi-colons 這篇文章，說是這裡面的 payload 看不太懂。因此，這篇就來簡單講解一下這些 payload，參考的原文是 Gareth Heyes 的這兩篇文章： XSS technique without parentheses XSS without parentheses and semi-colons
2025/9/15 04:50Hulihttps://blog.huli.tw/2025/09/15/xss-without-semicolon-and-parentheses/
Explaining XSS without parentheses and semi-colons
Recently, I received an email from a reader asking if I could write an article explaining XSS without parentheses and semi-colons, saying that the payloads in it were hard to understand. Therefore, this article will briefly explain these payloads, referencing Gareth Heyes’ two articles: XSS technique without parentheses XSS without parentheses and semi-colons
2025/9/15 04:50Hulihttps://blog.huli.tw/2025/09/15/en/xss-without-semicolon-and-parentheses/
人人都需要一個 HTTP proxy 來 debug
身為每天都要與網頁打交道的前端工程師，熟悉 DevTools 的使用是相當合理的。每當接 API 出問題時，就按下快捷鍵打開 DevTools，切到 Network 分頁，找到紅色的那一行，右鍵複製成 cURL 貼到群組裡面，讓後端自己找找問題。但不曉得大家有沒有碰過 DevTools 不夠用的狀況，這時該怎麼辦？
2025/4/23 10:50Hulihttps://blog.huli.tw/2025/04/23/everyone-need-a-http-proxy-to-debug/
Everyone Needs an HTTP Proxy for Debugging
As a front-end engineer who deals with web pages every day, it is quite reasonable to be familiar with the use of DevTools. Whenever there is an issue with an API, I just press the shortcut to open DevTools, switch to the Network tab, find the red line, right-click to copy it as cURL, and paste it into the group chat for the backend team to troubleshoot. But I wonder if anyone has encountered situations where DevTools are not sufficient. What should we do then?
2025/4/23 10:50Hulihttps://blog.huli.tw/2025/04/23/en/everyone-need-a-http-proxy-to-debug/
VS Code Material Theme 不是惡意軟體——安全的線該畫在哪？
應該不少人都有跟到三週前 VS Code 上的知名套件 Material Theme 被微軟主動下架的新聞，那下架的理由是什麼呢？根據你得知這件事的消息來源以及自身個性，可能會有兩種回答：它「疑似」含有惡意程式碼它就是個惡意軟體為什麼跟自身個性有關呢？因為就算消息來源接收到的是第一種，在種種條件的互相加持影響之下，你也很有可能解釋成第二種。
2025/3/16 10:40Hulihttps://blog.huli.tw/2025/03/16/vscode-material-theme-is-not-a-malware/
VS Code Material Theme is Not a Malware — Where Should the Line Be Drawn?
Many people might have followed the news three weeks ago about the well-known extension Material Theme being proactively removed from VS Code by Microsoft. So what was the reason for its removal? Depending on your source of information, there might be two answers: It “allegedly” contains malicious code. It is indeed malware.
2025/3/16 10:40Hulihttps://blog.huli.tw/2025/03/16/en/vscode-material-theme-is-not-a-malware/
HITCON CTF & corCTF & sekaiCTF 2024 Writeup
It’s been a while since I wrote writeup. I’ve wanted to write for a long time but kept procrastinating. For something like CTF writeups, speed is quite important because most discussions happen in Dis
2024/9/23 10:40https://blog.huli.tw/2024/09/23/en/hitconctf-corctf-sekaictf-2024-writeup/
快速部署網站的新選擇：Zeabur 使用心得
以前當我想要部署一個簡單的服務時，我會去 Heroku 上面，因為簡單而且免費，雖然說還是有些使用限制，但整體而言還是很方便的，甚至還有一些簡單的 DB 可以用。如果是靜態網頁，會選擇 Netlify 或是 GitHub Pages，也都是簡單方便的選擇。但 Heroku 從 2022 年年底之後就不再提供免費方案了，因此那時一堆人在尋找替代方案，包括 Render 或是 fly[dot]io
2024/4/14 10:40https://blog.huli.tw/2024/04/14/zeabur-introduction-deploy-service/
0CTF 2023 筆記
今年的 0CTF 一共有三道 web 題，其中一道題目是 client-side 的，我就只解這題而已，順利拿到 first blood，這篇簡單記錄一下心得。關鍵字列表： CSS injection CSS exfiltration
2023/12/11 12:40https://blog.huli.tw/2023/12/11/0ctf-2023-writeup/
簡單分析 CVE-2023-46729：Sentry Next.js SDK 的 URL rewrite 漏洞
Sentry 在 2023 年 11 月 9 號時，在部落格上發布了這篇文章：Next.js SDK Security Advisory - CVE-2023-46729，內容主要在講述 CVE-2023-46729 這個漏洞的一些細節，包含漏洞成因、發現時間以及修補時間等等。雖然說是在 11/9 正式對外發布漏洞公告，但漏洞其實在 10/31 發佈的 7.77.0 版本已經
2023/11/13 14:40https://blog.huli.tw/2023/11/13/sentry-nextjs-sdk-cve-2023-46729/
原來 img src 也支援 mp4（Safari 限定）
有些網站會用 GIF 來做一些圖檔，畢竟會動嘛，看起來就比一些靜態的圖片還要厲害，還要來得更吸引人。或其實不只是因為吸引人，而是有些需求本來就需要一個會動的圖，例如說貼圖，會動是很正常的。但是 GIF 的缺點之一眾所皆知，就是檔案很大，真的很大。尤其是手機上因為解析度比較高，可能會需要用到三倍大小的圖片，就算只顯示 52 px，也要準備 156px 的圖檔，佔的空間就更多了。以網頁來說，當然是要
2023/9/11 20:10https://blog.huli.tw/2023/09/11/mp4-in-img-src/
Updating Blog with chatGPT
It’s been a long time since I made any major changes to my blog structure. Hexo has already released v6, and v7 is currently in beta, but my blog is still on hexo3. Recently, I had some free time and
2023/6/20 13:10https://blog.huli.tw/2023/06/20/en/update-blog-with-chatgpt/
Android App Reverse Engineering Part 3: Monitoring App Packets
I remember when I first started working with Android, it was easy to see which requests an app was sending. All I had to do was install Charles on my computer, set up the Wi-Fi on my phone to proxy to
2023/4/27 13:20https://blog.huli.tw/2023/04/27/en/android-apk-decompile-intro-3/
SekaiCTF 2022 Notes and Concurrent Limit
I casually played SekaiCTF 2022 last weekend and I have to say that the visual style is pretty cool. You can tell that a lot of effort was put into it, and it feels like a game. This time, I only play
2022/10/8 08:43https://blog.huli.tw/2022/10/08/en/sekaictf2022-safelist-and-connection/
Intigriti 0822 XSS Challenge Author Writeup
In Auguest, I and bruno made a XSS challenge on Intigriti. When we decided to make it, we hope it’s a difficult and fun challenge, and the players can also learn a lot from it. Here is the writeup f
2022/8/29 06:43https://blog.huli.tw/2022/08/29/en/intigriti-0822-xss-author-writeup/
GoogleCTF 2022 筆記
第一次參加 GoogleCTF，這次解了一題 web（HORKOS），然後另外一題偏接近但沒解出來（POSTVIEWER），依照慣例簡單寫一下每一題的 web 的解法，以解出人數來排序。附上關鍵字如下： log4j ReDoS hop by hop JavaScript magic function(?) async/await and Promise race conditio
2022/7/9 16:36https://blog.huli.tw/2022/07/09/google-ctf-2022-writeup/
ångstromCTF 2022 Writeup
I didn’t check all the challenges this time because when I joined the competition, most of the challenges already solved by my teammates lol I love JavaScript(yep, including those weird features) an
2022/5/5 16:43https://blog.huli.tw/2022/05/05/en/angstrom-ctf-2022-writeup-en/
JavaScript 中 RegExp 與字串取代的神奇特性
簡單記錄幾個最近碰到的神奇特性，直接講不有趣，先來幾個小挑戰：
2022/4/14 19:29https://blog.huli.tw/2022/04/14/javascript-string-regexp-magic/
SUSCTF 2022 Writeup
這個假日有不少 CTF，跟著隊伍 SU 一起打了 SUSCTF 2022，這篇簡單記錄一下幾個我有參與的題目的心得。會講到的題目列表如下： web/fxxkcors web/ez_note web/baby gadget v1.0 web/baby gadget v1.0’s rrrevenge web/HTML practice
2022/3/1 20:54https://blog.huli.tw/2022/03/01/susctf-2022-writeup/
How a flawed password reset mechanism can lead to account takeover vulnerabilities? Matters as an example
Password reset is a mechanism that almost all websites have. The most common way is to send a password reset link via email, and after clicking the link, the user can set a new password for the accoun
2022/1/4 12:00https://blog.huli.tw/2022/01/04/en/reset-password-vulnerability/
Understanding the Log4j and Log4Shell Vulnerabilities through Surveillance Cameras
The biggest news in the cybersecurity industry at the end of 2021 is undoubtedly the Log4j vulnerability, also known as CVE-2021-44228 or Log4Shell. Some even describe it as a “nuclear-level vulnerabi
2021/12/18 12:00https://blog.huli.tw/2021/12/18/en/what-is-log4j-and-log4shell/
Discovering My Lack of Front-end Knowledge through Cybersecurity
This article is the text version of my presentation “Discovering the Depth of Front-end through Cybersecurity” at Modern Web 2021. The video of the talk is not yet available, but if you want to see th
2021/10/24 23:00https://blog.huli.tw/2021/10/25/en/learn-frontend-from-security-pov/
Creating HTML Web Pages Suitable for Printing as PDFs with Paged.js
IntroductionI was recently tasked with generating a PDF report. There are many ways to create a PDF, such as using Word and then converting it to PDF. However, my first thought was to write it as a we
2021/6/12 14:10https://blog.huli.tw/2021/06/12/en/paged-js-htmo-to-pdf-best-solution/
Intigriti’s 0521 XSS 挑戰解法：限定字元組合程式碼
前言Intigriti 是國外的一個 bug bounty 平台，每個月都會推出一個 XSS 挑戰，有大約一到兩週的時間可以去思考，目標是在特定網站上面執行 alert(document.domain)，解出來之後把結果透過 Intigriti 平台回報，最後會隨機抽 3 個解掉的人得到他們自己商店的優惠券。上個月的挑戰因為解出來的人不多，所以我有幸運抽到 50 歐元的優惠券，其實很划算，因為商
2021/6/7 20:34https://blog.huli.tw/2021/06/07/xss-challenge-by-intigriti-writeup-may/
An Introduction to DOM Clobbering and Its Applications
IntroductionAs a front-end engineer, it is natural to know a lot about front-end-related knowledge, such as HTML or JS-related things, but those knowledge is usually related to “use”. For example, I k
2021/1/23 12:34https://blog.huli.tw/2021/01/23/en/dom-clobbering/
從 V8 bytecode 探討 let 與 var 的效能問題
前言在我以前寫過的兩篇文章：我知道你懂 hoisting，可是你了解到多深？以及所有的函式都是閉包：談 JS 中的作用域與 Closure 裡面，都談到了 let 與 var 作用域的不同。 let 的作用域是 block，而 var 則是 fucntion，像這個就是經典案例： for(var i=1; i<=10; i++) { setTimeout(function()
2020/2/20 21:49https://blog.huli.tw/2020/02/20/let-vs-var-bytecode/
深入 Session 與 Cookie：Express、PHP 與 Rails 的實作
前言這是一系列共三篇的文章，我稱之為 Session 與 Cookie 三部曲。系列文的目標是想要由淺入深來談談這個經典議題，從理解概念一直到理解實作方式。這是系列文的最後一篇，三篇的完整連結如下：白話 Session 與 Cookie：從經營雜貨店開始淺談 Session 與 Cookie：一起來讀 RFC 深入 Session 與 Cookie：Express、PHP 與 Rails 的
2019/8/9 21:10https://blog.huli.tw/2019/08/09/session-and-cookie-part3/
The Evolution of Web Scraping on Medium
IntroductionA few days ago, I posted an article on Medium titled Medium Chinese Writers’ Follower Ranking and Unprofessional Data Analysis, in which I used Node.js to write a simple web scraper and an
2019/7/12 19:10https://blog.huli.tw/2019/07/12/en/medium-crawler/
幕後花絮：Lidemy HTTP Challenge 的設計以及彩蛋
前言前陣子我為了幫自己的學生們更熟悉 HTTP 以及 API 的串接，寫出了一個小遊戲：Lidemy HTTP Challenge，需要根據每一關的說明取得正確的 token，一共有十五關，前十關基本，後五關進階。經過了一些朋友的測試之後，慢慢調整、改善，最後讓學生測試發現反應都不錯，於是就在前端社群正式對外公開這個遊戲，讓大家也能一起參與。如果你還沒玩過，那強烈建議你不要看這篇文章，因為這篇
2019/5/18 19:10https://blog.huli.tw/2019/05/18/lidemy-http-challenge/
兩年過後，我能夠被稱為資深工程師了嗎？
前言在兩年前我寫了這篇一個資淺工程師年末的自我省視，內文主要是檢視自己那年學到的東西以及抒發心得感想，並提出一些對於自己職涯發展上的疑問。標題之所以是打「資淺」工程師，是因為那時覺得連資深的邊都沾不上，所以用了資淺這個字來形容自己。兩年過去了，職稱從工程師變成資深工程師，甚至還再往上變成了 Front-end Team Lead。雖然職稱本來就不代表一切，但我認為它至少「代表著什麼」，你到了那
2018/12/29 21:10https://blog.huli.tw/2018/12/29/after-two-years-am-i-senior/
AWS Lambda + GitHub API + Google Sheet = Automated Sign-in System
IntroductionDuring the past year, I have conducted several teaching experiments in my spare time, hoping to improve my teaching materials through continuous teaching and gain some insights from studen
2018/9/14 21:10https://blog.huli.tw/2018/09/14/en/aws-lambda-and-github-api/
CORS is not as simple as I thought
IntroductionCORS (Cross-Origin Resource Sharing) has always been a classic problem in front-end development. Simply put, due to some security considerations of the browser, you will encounter some res
2018/8/18 21:10https://blog.huli.tw/2018/08/18/en/cors-is-hard/
A Brief Introduction to React Fiber and Its Impact on Lifecycles
IntroductionAlthough I’ve heard about React replacing its internal reconciler with something called Fiber for a long time, I’ve never studied it in detail and didn’t know what impact this change would
2018/3/31 21:10https://blog.huli.tw/2018/03/31/en/react-fiber-and-lifecycles/
淺談二分搜尋法
前言在寫程式的時候，其實會滿常用到「搜尋」的功能，最簡單的搜尋就是在一串數字裡面找出你想要的數字，而這也是我們今天的主題。這一篇大致上會分成三個部分，第一部分會先介紹線性搜尋法，第二部分介紹二分搜尋法，最後一部分談談二分搜尋法在不同條件底下的實作方式會有什麼不同。
2016/9/23 15:36https://blog.huli.tw/2016/09/23/binary-search-introduction/
ExperienceStruggling with DDoS: nginx, iptables and fail2ban
Recently, there was an incident where our server was attacked by a large number of requests. Unfortunately, the server was hosting a forum service. Assuming that the attack point was the forum homepag
2016/7/21 15:38https://blog.huli.tw/2016/07/21/en/the-battle-against-ddos-nginx-iptables-and-fail2ban/