security.jelia.nyc is our new visual, hands-on guide to how real attacks on computers and networks work, and, mostly, how defenders stop, detect and recover from them.
It is the companion to networks.jelia.nyc: that site explains the plumbing, this one explains how to defend it. Every chapter opens with a narrated walkthrough and gives you instruments you can drive yourself, from a password-guessing cost calculator to a firewall that really evaluates your rules. Everything is defensive and educational: the examples are harmless illustrations, never working attacks.
One DLL, many forms, many holes
An ASP.NET Web Forms site looks like a folder of separate pages. It is not. Build it, and the code behind every form, plus every shared helper, is compiled into one assembly in the /bin folder. That is why one careless line in a base page or a data-access class can show up as forty findings on a scanner report, and why one good change can close all forty.
Chapter 14, One DLL, many forms, many holes, opens that DLL and tours the weaknesses that gather inside it: SQL injection and cross-site scripting, view state and the machine key, cross-site request forgery, insecure direct object references, file uploads and path traversal, verbose error pages, outdated libraries and DLL search order. Each one is mapped to its CWE and OWASP 2025 category, shown as vulnerable code next to the fix, and paired with how to detect it.
- Form map: twelve forms wired to seven shared helpers. Patch one helper and watch every form that calls it close at once. Count root causes, not findings.
- View state seal: a real HMAC-SHA-256 over a toy view state, showing why a secret, per-site machine key matters and what happens when the signature check is turned off.
- web.config auditor: set eleven configuration switches and get graded findings, each with its CWE and OWASP category, plus the corrected config text.
The watch floor, with RedPatch
Most days a security team does not fight anyone. It reads. Chapter 19, The watch floor, is about that daily work: reading the advisory stream (CVE, CVSS v4.0, EPSS, CISA’s Known Exploited Vulnerabilities catalog and SSVC), triaging by exposure, exploitability and asset value, patching against the clock, then verifying the fix and hunting back through the logs for anything that got in first.
The chapter follows RedPatch, the security arm of LIBCSystems, and its blog THE WATCH FLOOR, through a real case: the PHP2Shell patch, where it was 2 hours 46 minutes from the first CVE record to LIBCSystems’ fixed builds. It comes with a triage simulator, where you order ten advisories and see the risk your plan leaves open, and a patch-timeline clock that shows why hours beat days once exploitation starts.
What else it covers
- Foundations: threat models and attack trees, the cryptography that matters, TLS and certificates, and passwords, MFA and passkeys
- Defending the network: firewalls and segmentation, DNS security, BGP hijacks and RPKI, SPF, DKIM, DMARC and phishing, and the move from VPNs to zero trust
- Software and the web: memory safety, SQL injection and cross-site scripting, ASP.NET Web Forms, cookies, CSRF and CORS, and the software supply chain
- Detect and respond: logs and detection mapped to MITRE ATT&CK, incident response and backups that survive ransomware, and the patch watch floor
- A glossary of more than 200 terms in plain English, each linked to the chapter that explains it
Seventeen of the nineteen chapters are live today; the chapters on local-network attacks and denial of service are still being finished. Every claim is sourced to RFCs, NIST, MITRE, OWASP, CISA or the vendor’s own documentation.
RedPatch is the practical side of the same work: sourced security fixes for macOS, Windows, Windows Server and Linux, driven by what is being exploited right now. RedPatch tells you which steps to take on the machines you run; security.jelia.nyc explains why each of those steps matters.
Read it: security.jelia.nyc · start with the Web Forms DLL chapter or the watch floor