标签：#beginners

I've always loved teaching and helping others achieve things. There is a huge sense of accomplishment leveraging someone else's abilities. Not only telling them "you can!", but rather help them feel "I can". I was working as a developer for some time when I decided it was time to contribute to other projects. But, honestly, finding the right project, the right issue, and having the right timing was much harder than what I expected initially. I decided to create something that could help me out: scrape some orgs, find good-first-issue labels, and aggregate them together in a README file. Contributing to Open Source isn't easy for many reasons: The obvious, the technical: finding your first technically possible contribution is a combination of the right language, the right depth, and knowing which repo to search in. good-first-issues tackled that by scraping the language and the issue title to somewhat give me a little of context to start with. The not so obvious, the human side of it. My first contribution(s) were hard because I felt exposed, my weaknesses were in the wild for everyone to see and point them out to me. At least that was how I felt. And once I found the right issue, and I decided to give that step forward, many times I didn't get an answer back. That kills any motivation left. Probably PR ghosting is the biggest reason why someone quits their willingness to contribute to OSS. At first, good-first-issues was just a place others could come to find issues. But I realised it could be that issue. There were functionalities I wanted to bring and either I didn't have the time, or didn't have on the top of my head how to do them. "I can kill two birds with one stone" I thought. I knew where I wanted the repo to go, and I wanted it to be community-driven. Creating good self-contained, clear and approachable issues is an art in itself: I didn't want to create the obvious "Fix this typo" (which I did initially) or "Add your name as a contributor" issues. But I di

Introduction Website hosting has been greatly improved through the use of cloud computing. This has made it easier for individuals as well as businesses to access, scale, and use hosting services at a reasonable price. One of the easiest and most efficient methods that developers may use to host a static site on Microsoft Azure is the Static Website Hosting option offered by Azure Blob Storage, which allows developers to upload their static files without the need for a traditional web or virtual server (i.e., HTML, CSS, JavaScript, and media files). In this project, I will download a free static website template from Tooplate, customize the downloaded version using Visual Studio Code (VS Code), and then deploy the new version to Azure Blob Storage for public viewing. This will involve editing all content, images, styles, and branding so that the template reflects how I want it to look when it is completed. To develop my own static website using Azure Blob Storage, I will first navigate to Tooplate and browse the templates available for modification (or further development). After deciding which template is most suitable, I will download the ZIP package of the template and extract it onto my local computer's disk drive. Then, I will open the ZIP file's contents using VS Code to customize all aspects of the website prior to publishing. After customizing the template, we will create an Azure storage account, enable Static Website Hosting, upload the customized/static website files to the Azure Blob Storage $web container, and then publish the created static website into the cloud. Project Objectives .Download a free static website template from Tooplate. .Go to VS code and edit the downloaded template from there .Create a Resources Group .Create an Azure Storage Account. .Enable Azure Static Website Hosting. .Upload website files to Azure Blob Storage. .Deploy and access the website through Azure's public endpoint. .Document the deployment process. Prerequisites Before

I build RESTful APIs for a living. I've designed event-driven architectures, set up CI/CD pipelines, containerized applications on Azure, mentored junior developers. 7 years of this. Then I opened LeetCode and stared at a medium problem for 45 minutes and closed the tab. Working as a backend engineer for this long means you just never touch advanced DSA. My day to day is .NET, Azure, SQL, clean architecture. EF Core handles the data layer, Azure handles the scaling. I haven't needed to implement a graph traversal or think about tree balancing since university. So when I decided to start interviewing at bigger companies I figured I just needed a quick refresher. I studied this stuff in college. It would come back. It didn't. 7 years is a long time and most of it was gone. What I Tried I went through the usual options. LeetCode grinding. Jumping into random problems with no structure just kept reminding me how much I'd forgotten without actually helping me relearn any of it. YouTube. Watched hours of Abdul Bari, freeCodeCamp, various bootcamp videos. I'd finish a video convinced I understood it, then open my editor and draw a complete blank. Watching someone solve a problem and solving it yourself are not the same thing at all. Books. CLRS is great if your fundamentals are still intact. Mine weren't. None of these were bad resources. The problem was I kept jumping between them with no thread connecting them. A video here, a problem there, a random chapter somewhere else. After years away from this stuff I needed to go back to basics and build up properly, and nothing was set up for that. What Actually Helped Eventually I just mapped out what a proper learning order looked like and started going through it myself. Big O → Arrays → HashMaps → Linked Lists → Stacks & Queues → Recursion → Trees → Graphs → Dynamic Programming For me, order mattered. Going back to Big O first made Arrays click properly. Arrays made HashMaps make sense again. I couldn't get Trees to stick un

Your security scanner just came back with 6 flagged items. All missing HTTP headers. You did what any reasonable developer does: Googled each one, copy-pasted the recommended config, and shipped a fix in 20 minutes. Job done. Security score green. PR merged. You also probably shipped at least two of them wrong. Here is the thing nobody tells you about HTTP security headers: knowing what to add is the easy part. Understanding why it matters, when it actually doesn't, and how a misconfigured one breaks your app in production — that's where most developers fall short. This isn't another "add these 7 headers to secure your app" post. This is the one that explains what's actually happening. First, The Contrarian Take Missing a security header is not automatically a vulnerability. If you do bug bounties, this will save you a rejection. If you're a dev, it'll save you from cargo-culting configs that don't apply to your app. Context is king. X-Frame-Options: DENY is a valid security header. YouTube doesn't use it. Because the entire point of YouTube is for people to embed its videos in iframes. Applying that header would break a core product feature. That's not a security oversight — it's a deliberate design decision. A missing Content-Security-Policy header is not a vulnerability in itself. It only becomes relevant if you already have an XSS problem to mitigate. CSP is defense-in-depth. Not a fix for a broken input sanitisation layer. This matters because a lot of developers (and worse, automated scanners) treat these headers like a binary checklist. Present = secure. Missing = vulnerable. Reality is messier than that. Now — with that said — let's talk about what each one actually does. #1. HTTP Strict Transport Security (HSTS) Most developers think HSTS is just "force HTTPS." It's more precise than that. When your app redirects http:// to https:// , that first request is still unencrypted. For a fraction of a second, on a public network, that window exists. An attacker on

You've been building REST APIs — one endpoint for users, another for posts, another for comments. The client makes three requests, stitches the data together, and half of it gets thrown away because it wasn't needed in the first place. GraphQL was built to fix exactly that. It gives the client full control over what data it receives. One request. Exactly what you asked for. Nothing more, nothing less. The Problem REST Couldn't Solve Before understanding GraphQL, you need to understand the two problems that drove its creation. Over-fetching The server returns more data than the client needs. GET /users/123 Response: { "id": 123, "name": "Anne", "email": "anne@example.com", "phone": "...", "address": "...", "createdAt": "...", ← you didn't need any of this "updatedAt": "..." ← but the server sent it anyway } The client only needed name and email — but it downloaded the whole object every time. Under-fetching One endpoint doesn't return enough, so the client has to make multiple requests. GET /users/123 → gets the user GET /users/123/posts → gets their posts GET /users/123/followers → gets their followers Three round trips to the server just to render one screen. On a mobile network, that cost is real. GraphQL's answer: Let the client write the query. The server returns exactly what was asked. What Is GraphQL? GraphQL is a query language for your API and a runtime for executing those queries. It was created by Facebook in 2012, open-sourced in 2015, and is now maintained by the GraphQL Foundation . Unlike REST, which exposes multiple URL endpoints, GraphQL exposes a single endpoint — typically POST /graphql . The client sends a query in the request body describing exactly what it wants, and the server responds with only that data. Key characteristics: Single endpoint — everything goes through POST /graphql Client-driven — the client defines the shape of the response Strongly typed — every field has a declared type in the schema Introspective — clients can query the API

Originally published at ayonbuilds.hashnode.dev I can't eat the food I want. I can't travel. I can't do the things my peers do. I'm a 2nd year CS student in Chandigarh. No connections. No money. No big university name behind me. Last week I was researching AI security tools and stumbled across a startup called Artemis . Founded in 2025. Just raised $70M . Building AI agents that automatically investigate security threats. I had just built something in the same category. From my room. With free tools. Zero budget. Simulated data. No users. No team. Not even close to what they've built. But I understood the problem well enough to build a working version of it myself. And that told me something. I'm not there yet. Not even close. But I'm working on the right problems at the right time — and I'm just getting started. Here's what I built — ARIA (Autonomous Risk Investigation Agent) . It detects suspicious authentication events in real time, maps them to MITRE ATT&CK threat techniques, and automatically generates plain-English incident reports using an LLM investigation chain. Built with FastAPI, React, PostgreSQL, and Groq API. GitHub: github.com/Ayon99/ARIA My name is Ayon. I'm building AI systems in public — the wins, the failures, the gap between what I make and what the funded teams make, and everything I'm learning along the way. I have one goal. Break through. Completely. Whatever it takes . If you're in a similar position — small city, limited resources, big ambition — follow along. I'm not going to pretend I've figured it out. But I'm going to document every step of figuring it out.

Introduction Excel is one of the most used tools for data analysis. It allows beginners like myself to easily clean, organize, analyze and visualize data.Excel enables users to work with large datasets and extract meaningful insights without requiring advanced technical skills. What is Excel Excel is a spreadsheet that allows you to collect, organize, analyze, calculate, and visualize data efficiently.Despite the emergence of other data analysis tools like SQL and Power BI, Excel remains one of the most widely used tools for both personal and professional data management.This can be credited to its ease of access, learning, and use. Ways Excel is used in real-world data analysis This week, I had the opportunity to explore how Excel is used in real-world data analysis.I discovered that Excel is not just a basic spreadsheet tool, but a powerful application that helps make sense of data and support decision-making. Data organization and cleaning Excel is used to structure raw data, remove duplicates, and fix errors. This improves data quality, making it easier to analyze and more reliable for decision-making.This improves data quality, making it easier to analyze and more reliable for decision-making. Financial Excel is commonly used in finance to create budgets, calculate profits and losses, and monitor expenses.It helps organizations keep accurate financial records and understand their financial situation. Business decision-making Businesses use Excel to track sales, compare performance over time, and identify trends.This helps managers understand what is working well and what needs improvement. Excel features and formulas In just a week, I have learned several Excel formulas that simplify data management and make working with data more efficient. SUM function The SUM function is used to add a range of values together in Excel, making it one of the most essential tools for quick calculations.It's used to automatically add a range of numerical values together, elimina

Have you ever trained a model that performed beautifully on your training data but fell apart the moment it saw new data? Or perhaps you built something so simple it couldn't even learn the training data properly? These are the classic traps of overfitting and underfitting — and every machine learning practitioner runs into them. In this article, we'll cover what they are, how to detect them, how to fix them, and where the bias-variance tradeoff ties it all together — with real-world examples and code throughout. What is Model Fitting? Model fitting is the process of training a predictive model on a dataset to find the optimal parameters that best capture the underlying patterns in the data. The goal is simple: the model should generalize well to unseen data — not just memorize the training examples. There are three possible outcomes when fitting a model: Outcome Description Good fit Captures underlying patterns, generalizes well Underfitting Too simple, misses patterns even in training data Overfitting Too complex, memorizes noise, fails on new data What is Underfitting? Underfitting occurs when a model is too simple to capture the underlying patterns in the data. It performs poorly on both the training set and on new, unseen data. Think of it like this: imagine asking a child to predict house prices and they only use the rule "all houses cost $100,000." That model ignores all relevant features (size, location, age) and will be wrong almost every time. Why Does Underfitting Occur? Model is too simple : A linear model trying to fit a curved, nonlinear relationship Too few features : Important variables are left out Too much regularization : Penalizing complexity so heavily that the model can't learn anything meaningful Insufficient training : The model hasn't been trained long enough Real-World Example Suppose you're predicting whether an email is spam. If you only use the feature "email length" and ignore word content, sender, and links, your model will underfit —

Talk about AI causing layoffs started back in 2024. At that time, many companies were under pressure...

Bitcoin can look simple from the outside: paste an address, choose an amount, send. Under that simple interface are several concepts that are useful for developers and technical beginners to understand. This post is not trading advice and does not discuss price. It is a practical mental model for what is happening when someone sends Bitcoin. 1. A wallet does not "hold coins" the way an app balance does Many beginners imagine a wallet as a container full of coins. That is close enough for casual conversation, but it can be misleading. A Bitcoin wallet manages keys and helps create transactions. The Bitcoin network tracks spendable outputs on the ledger. When you send BTC, the wallet constructs a transaction that spends previous outputs and creates new outputs. You do not need to master every detail on day one, but the high-level idea matters: control of keys controls the ability to spend. 2. An address is a destination, not an identity A Bitcoin address is where funds can be sent. It is not a username and it is not automatically tied to a person in the way a social profile is. Before sending, beginners should check the address carefully. A small copy-paste mistake can be permanent. Malware can also replace clipboard contents, so visually checking the beginning and ending characters is a useful habit. For larger transfers, a tiny test transaction can reduce risk. 3. Fees are about block space Bitcoin transactions compete for limited block space. A fee is not a tip to a company. It is part of the transaction economics that helps miners decide which transactions to include. When the network is busy, low-fee transactions may wait longer. When the network is quieter, confirmations may happen faster. The beginner lesson is simple: do not assume "sent" means "fully settled." Check confirmations and understand that fee choice can affect waiting time. 4. The mempool is a waiting area Before a transaction is confirmed in a block, it may sit in the mempool, which is a pool of u

Web Security: OWASP Top 10 and How to Fix Them (2026) Security isn't a feature you add later — it's built into every layer. Here's how the top 10 vulnerabilities work and how to prevent them. #1 Broken Access Control // ❌ Vulnerable: User can access anyone's data app . get ( ' /api/users/:id ' , ( req , res ) => { const user = await db . users . findById ( req . params . id ); res . json ( user ); // No check if requester owns this data! }); // ✅ Secure: Always verify ownership app . get ( ' /api/users/:id ' , async ( req , res ) => { // Check: Is the logged-in user requesting their OWN data? if ( req . params . id !== req . user . id && req . user . role !== ' admin ' ) { return res . status ( 403 ). json ({ error : ' Access denied ' }); } const user = await db . users . findById ( req . params . id ); res . json ( user ); }); // ✅ Better: Use middleware for all protected routes const requireOwnership = ( resourceType ) => async ( req , res , next ) => { const resource = await db [ resourceType ]. findById ( req . params . id ); if ( ! resource ) return res . status ( 404 ). json ({ error : ' Not found ' }); if ( resource . userId !== req . user . id && req . user . role !== ' admin ' ) { return res . status ( 403 ). json ({ error : ' Access denied ' }); } req . resource = resource ; // Attach for route handler next (); }; app . get ( ' /api/posts/:id ' , auth , requireOwnership ( ' posts ' ), ( req , res ) => { res . json ( req . resource ); }); #2 Cryptographic Failures // ❌ Storing passwords in plain text or weak hashing const password = " password123 " ; db . users . insert ({ email , password }); // NEVER DO THIS! // ✅ Proper password hashing with bcrypt const bcrypt = require ( ' bcrypt ' ); const SALT_ROUNDS = 12 ; // Higher = slower = more secure (12 is good balance) async function hashPassword ( password ) { return bcrypt . hash ( password , SALT_ROUNDS ); } async function comparePassword ( password , hash ) { return bcrypt . compare ( password , hash ); /

Hello everyone! It has been a busy week, but I've made some exciting progress on my machine learning journey. Here is what I've been up to: Kaggle Orbit Wars & AWS I completed the baseline implementation for the Kaggle Orbit Wars competition and initially hit a score of around 1030. My score has dipped slightly over the past few days, so I am currently brainstorming ways to improve it. This week also marked my very first time using AWS! I used it to extract data for reinforcement learning. Transparency check: I spent exactly $7.58 USD on AWS resources during the process. Paper Reading & RL Insights I spent a lot of time reading research papers this week. AlphaZero: I was initially excited about using the self-play mechanism from AlphaZero. However, because this specific game has rock-paper-scissors dynamics, standard self-play might not work effectively. AlphaStar: This led me to the AlphaStar paper, which uses self-play combined with League Training . The engineering behind AlphaStar is incredible. Two specific concepts really stood out to me: Pointer Networks and V-trace off-policy correction . I was also impressed by their use of an LSTM core to handle long-term memory. Next Steps Moving forward, I plan to leverage Kaggle, AWS, and GCP credits to train different components of my model. I am giving myself total freedom to experiment, imagine, and test unconventional solutions. Random life update to close out the week: I used to have long hair because I was insecure about my forehead, but I finally decided to shave it all off at home by myself. It honestly feels really weird right now, but it's a fresh start!

For years I saw "open source contributions" on job descriptions and just... nodded along. Typed it into Google once, got overwhelmed, closed the tab. It always seemed like something other people did. People who actually knew what they were doing. People who weren't me. Then I started looking into it properly. And honestly? It still seemed big. Like I'd need to understand an entire codebase, find a complex bug, write some genius fix that the maintainers would applaud. Turns out that's not it at all. I found some resources that changed how I saw it completely. The bar to start is embarrassingly low, and that's intentional. The open source community built it that way on purpose. So I did it. Was it a few lines of code? Yes. Did I do it directly in the browser like a person who has no idea what they're doing? Also yes. Do I care? Absolutely not. Where to actually start: goodfirstissue.dev — filters repos by good first issue label up-for-grabs.net — same idea, different interface Docs you already use — if you read something and think "that's oddly worded," you're already there GitHub search — label:"good first issue" is:open and filter by language Here's the thing though, this isn't just about open source. Everything seems big and intimidating at first. So you start small. One tiny contribution. Not because it's impressive but because it's real, and it's yours, and it builds something. Confidence mostly. Then you do a slightly bigger thing. Then a bigger thing after that. You don't level up by waiting until you're ready. You level up by starting small and not stopping. My first contribution exists now. That's enough for today.

My Journey Towards AI and Software Development Hello everyone, My name is Kunal Tiwari, and I am a student who is passionate about technology, artificial intelligence, and software development. Technology has always fascinated me because it allows people to transform ideas into real-world solutions. Over time, I developed a strong interest in understanding how software is built and how AI can help solve everyday problems. I started exploring programming and software development with curiosity and a desire to learn. Although I am still at the beginning of my journey, I believe that consistent learning and practical projects are the best ways to grow as a developer. My current interests include: Artificial Intelligence (AI) Android App Development Software Engineering Problem Solving Building useful applications Through this blog, I plan to share my learning experiences, projects, challenges, and lessons that I discover along the way. My goal is not only to improve my technical skills but also to document my progress and connect with other learners and developers. I know the journey ahead will require patience, dedication, and continuous learning. However, I am excited about the opportunities that technology offers and look forward to building meaningful projects in the future. Thank you for reading my first post. I hope to share valuable insights and experiences as I continue my journey towards AI and software development. Best regards, Kunal Tiwari

Hey Folks! 👋 Good Day... This blog is a summary of the concepts covered during the last two classes at my institute. One of the reasons I enjoy writing these blogs is that they serve as my personal knowledge journal. Whenever I need a quick refresher on a concept, I can simply revisit my blog instead of searching through notes or recordings. It helps me reinforce what I've learned while also documenting my learning journey. Over the past two days, we explored several important Java concepts, including constructors, the this keyword, inheritance, constructor chaining. In this blog, I'll share what I learned in the simplest way possible, using real-world analogies, practical examples, and the thought process that helped me understand these concepts more clearly. If you're a beginner learning Java, I hope this walkthrough makes these topics a little easier to grasp and a lot more memorable. What Is a Constructor? According to Oracle Java Documentation: A constructor is a special method that is used to initialize objects. The constructor is called when an object of a class is created. In simple terms: Imagine you order a new smartphone. Before the phone reaches your hands, the factory installs the operating system, configures the hardware, and prepares everything for use. A constructor does exactly the same thing for an object. Before you use an object, Java uses the constructor to prepare it. My First Confusing Example I wrote the following code: public class SuperMarket { String name = "python" ; int price ; public SuperMarket ( String name , int price ) { System . out . println ( "Are you constructor?" ); name = name ; price = price ; } public static void main ( String [] args ) { SuperMarket product1 = new SuperMarket ( "abc" , 20 ); System . out . println ( product1 . name ); } } I expected the output to be: abc But Java printed: python And honestly... I was completely confused. After all, I passed "abc" into the constructor. Why was Java ignoring it? The Hotel Roo

Create a storage account and configure high availability. Create a storage account for the internal private company documents. In the portal, search for and select Storage accounts . Select + Create . Select the Resource group created in the previous lab. Set the Storage account name to private . Add an identifier to the name to ensure the name is unique. Select Review , and then Create the storage account. Wait for the storage account to deploy, and then select Go to resource . This storage requires high availability if there’s a regional outage. Read access in the secondary region is not required. Configure the appropriate level of redundancy . Explanation A storage account is like a digital locker in the cloud. Resource group is a folder that organizes related services. High availability means your files stay safe even if one region (data center area) has problems Configure Redundancy In the storage account, in the Data management section, select the Redundancy blade . Ensure Geo-redundant storage (GRS) is selected. **Refresh **the page. Review the primary and secondary location information. Save your changes. Explanation : Redundancy means keeping copies of your files in multiple places. GRS ensures your files are copied to another region for safety. Create a storage container, upload a file, and restrict access to the file. Create a private storage container for the corporate data. In the storage account, in the Data storage section, select the Containers blade. Select + Container . Ensure the Name of the container is private . Ensure the Public access level is Private (no anonymous access). As you have time, review the Advanced settings, but take the defaults. It means: don’t change anything in the Advanced settings unless the lab specifically tells you to. Azure already chooses safe, recommended defaults for you. Select Create . Explanation : A container is like a folder inside your storage account. Setting Public access level to Private means nobody can see

📌 This article was originally published on Sherdil E-Learning . I'm republishing it here so the dev.to community can benefit too. The Kubernetes vs Docker question is one of the most common sources of confusion for developers entering DevOps. People hear both names constantly, see them used together in job listings, and assume they must be competitors. They are not. Docker and Kubernetes do different jobs, and most modern infrastructure uses both. This guide explains what each tool actually does, how they fit together in a real deployment, the practical difference between Docker Compose and Kubernetes, and which one you should learn first. Docker: the container creator Docker is a tool for building, running, and managing containers . A container is a lightweight, portable package that contains an application together with its dependencies, runtime, system libraries, environment variables, and configuration files. The same container runs the same way on a laptop, a CI runner, a production server, or a cloud platform. In a typical Docker workflow you: Write a Dockerfile that describes how to build the image Run docker build to produce the image Run docker run to launch a container from it For multiple containers (a web app plus a database, for example), you use Docker Compose to define the whole set in a docker-compose.yml file and start them with one command. Docker is excellent for individual containers and small multi-container applications. The limitation is scale. What happens when you need a hundred containers across a dozen servers? When one container crashes at 3 a.m.? When you need to roll out a new version without downtime? Docker alone does not solve those problems. For the official reference, see docs.docker.com . Kubernetes: the orchestration layer above Docker Kubernetes (often shortened to K8s ) is an open-source platform that runs containers across many machines as a single coordinated system . It was originally built at Google, based on their internal

I built 24 browser-based tools. Here is the complete technical guide for building your own and selling PRO licenses on Gumroad. Architecture: One HTML File + GitHub Pages + Gumroad No frameworks, no backend, no monthly costs. One HTML file on GitHub Pages. Gumroad handles payments. The PRO Flow User hits free limit → PRO modal Buy button → Gumroad popup ( window.open , NOT target=_blank ) Payment → Gumroad postMessage with license key message listener catches key Key verified via Gumroad API ( /v2/licenses/verify ) localStorage saves PRO (in try-catch!) Gotchas From 24 Tools postMessage security: Check d.success && d.purchase , never just d.license_key . I had this bug in 17 files. localStorage: Wrap in try-catch . Uncaught throws crash the whole page. CDN scripts: Always <script defer> . Without it, slow CDN blocks rendering. Gumroad publish: curl returns false every time. Use PowerShell. Buy button: Popup connects the page to Gumroad. Redirect breaks postMessage . Packed 5 templates with everything pre-configured: Browser Tools Starter Kit ($19)

MD5 Is Broken — Stop Using It for Passwords (Use SHA256 Instead) MD5 was invented in 1991. It's 2026, yet I still see developers using MD5 for password hashing in production systems. Let’s break down why this is dangerous and what you should use instead. What Is a Hash Function? A hash function takes any input and produces a fixed-length output called a digest or hash . It is a one-way function , meaning you cannot reverse it to get the original input. Example: ```text id="hash1" Input: "password123" MD5: 482c811da5d5b4bc6d497ffa98491e38 SHA256: ef92b778bafe771e89245b89ecbc08a44a4e166c06659911881f383d4473e94f Even a small input change completely changes the output. --- # Why MD5 Is Broken MD5 generates a **128-bit hash**, which was considered secure decades ago. Today, it's extremely weak. Modern GPUs can compute **billions of MD5 hashes per second**, making brute-force attacks trivial. --- ## The Rainbow Table Problem Attackers use precomputed databases called **rainbow tables**. These tables map common passwords → their hash values. So if you hash: ```text "password123" → MD5 → known value An attacker can instantly look it up. Collision Vulnerabilities Researchers have demonstrated that two different inputs can produce the same MD5 hash . This breaks the core security guarantee of hash functions. SHA256 — The Better Choice SHA256 produces a 256-bit hash and is part of the SHA-2 family. It is currently considered cryptographically secure. Example: ```text id="sha1" "hello" → 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824 Even tiny changes completely change the output: ```text "hello" → 2cf24dba... "Hello" → 185f8db3... But Wait — Don’t Use SHA256 for Passwords Either This is where many developers make a mistake. SHA256 is not suitable for password hashing . Why? Because it is too fast . Fast hashing allows attackers to brute-force passwords quickly using GPUs. What You Should Use Instead For password storage, use: bcrypt scrypt Argon2 (recommended

A visual, beginner-friendly Java 25 experiment that explains virtual threads, blocking work, carrier threads, and the production rules that matter.