Skip to content
How systems talk
Security series · stage 1 of 5 · 8 chapters · 214 minutes

How systems talk

Stage 1 of a hands-on security series: DNS, TCP and HTTP, TLS, cookies and sessions, with a real lab that runs entirely on your own machine.

Every request you send makes the same trip. Follow it station by station, and fix one real weakness at each stop.
The lab

Eight cases, one per chapter

Each case is a small program with one weakness, a check that proves your fix, and hints. Everything runs on 127.0.0.1 against code you own.

  1. 01 · DNS25 min

    The answer to a question nobody asked

    uv run python -m wire run 1

  2. 02 · TCP and HTTP framing30 min

    One message, two meanings

    uv run python -m wire run 2

  3. 03 · TLS28 min

    The certificate nobody checked

    uv run python -m wire run 3

  4. 04 · Cookies25 min

    The session cookie with no attributes

    uv run python -m wire run 4

  5. 05 · Sessions22 min

    The logout that did not log out

    uv run python -m wire run 5

  6. 06 · Sessions26 min

    The session id chosen before sign-in

    uv run python -m wire run 6

  7. 07 · Headers28 min

    The response that trusted the browser's defaults

    uv run python -m wire run 7

  8. 08 · Logs30 min

    The access log that kept every secret

    uv run python -m wire run 8

Measured on your machine

What a connection costs

uv run python -m wire try handshake times each step on 127.0.0.1. These are the numbers from the machine the lab was written on.

TCP connect, then close246 µs
TCP connect and TLS handshake2,594 µs
a whole HTTPS request on a new connection3,100 µs
Quick start

You need uv and git

uv installs Python for you, and the lab uses only Python's standard library. Nothing leaves your machine.

shell
git clone https://github.com/jars-demo/how-systems-talk-demo.git
cd how-systems-talk-demo/lab
uv sync
uv run python -m wire run 1

The series

  1. Stage 1

    How systems talk

    You are here

  2. Stage 2

    Identity

    Coming next

  3. Stage 3

    Application security

    Coming next

  4. Stage 4

    Cloud and containers

    Coming next

  5. Stage 5

    Detection and response

    Coming next