This post is part 1 of a series. We spent a chunk of May and June 2023 working through the PortSwigger Web Security Academy labs, mostly the SQL injection track, and taking notes on our wiki as we went. This post is the setup - what the Academy is, why we picked it, and how it fits together. The posts that follow will cover the specific techniques.

What the Academy Is

PortSwigger makes Burp Suite, which is the standard tool for web application security testing. They also run a free online academy at portswigger.net/web-security, which consists of written lessons plus hands-on labs. The labs are hosted for you - you get a URL, you attack the app running at that URL, and the Academy tracks whether you succeeded.

The labs are organized roughly by the OWASP Top 10, which is the standard catalog of web application vulnerability categories. SQL injection, XSS, XXE, access control issues, authentication bugs, and so on.

The reason to pick this Academy over the other options is that the labs are real vulnerable web apps, not multiple-choice questions. You are using actual Burp Suite against actual HTTP requests. When you finish a lab, you have practiced the thing, not read about the thing.

Our Setup

The setup is not complicated:

• Burp Suite Community Edition (free, sufficient for most labs, painful for a few of the automation-heavy ones)
• A PortSwigger account (also free)
• A browser configured to proxy through Burp on port 8080
• A wiki page to take notes on, so you remember what you learned a week later

That last one is the whole point. The Academy is good, but if you finish a lab and move on without writing anything down, you will forget the technique inside a month. Writing up each lab in your own words - the setup, the attack, the trick that made it work - is what turns lab practice into retained knowledge.

The OWASP Top 10 as a Scaffold

We use OWASP Top 10 as the organizing scaffold for our security notes on the wiki. It is not the only way to slice web security, but it is the way that most people talk about web security, and it is what you'll see referenced in bug bounty programs and pentest reports. Learning to recognize each category is a solid foundation.

The list has changed over the years - the 2021 version reorganized things significantly - but the SQL injection, XSS, and XXE categories that we focus on in this series have been fixtures since the beginning.

What This Series Will Cover

Rough plan for the next few posts:

• SQL injection fundamentals - the four attack shapes that cover most cases
• UNION attacks specifically, and how to use them to dump data from tables you don't have direct access to
• Blind SQL injection with conditional responses - inferring data from page behavior
• Blind SQL injection with conditional errors - the more advanced Oracle-flavored variant
• A short post on two Burp Suite extensions that are worth installing before you start

Everything is grounded in a specific PortSwigger lab. Everything has a corresponding page on our wiki. If the summary here is not enough detail, the wiki page is the deep version.

References

• Web Security Academy
• Our wiki notes: Burp Suite, SQL Injection, OWASP

We spent the tail end of 2022 reading Italo Calvino's Six Memos for the Next Millennium, which is a set of Norton Lectures Calvino was preparing to give at Harvard in 1985-1986. He died before he could deliver them, and only five of the six memos were finished. The published book contains those five: Lightness, Quickness, Exactitude, Visibility, and Multiplicity.

The book is short. It is also incredibly dense. These are lectures about what Calvino thought literature needed to carry into the next thousand years, and they read less like a set of essays and more like an attempt to name and preserve a handful of properties before they slip out of the culture.

This post is a small selection of notes on the first two memos - Lightness and Quickness - which are the two that hit hardest for us on this reading.

Lightness

Lightness, as Calvino uses the word, is not the same as frivolity. He is very careful about this. It is closer to what Valéry meant when he wrote about being "light like a bird, and not like a feather" - a chosen agility of thought, as opposed to weightlessness by default.

The image Calvino returns to over and over is Perseus and the Gorgon. Perseus cannot look directly at Medusa without being turned to stone. He has to look at her reflection in his polished shield. Then, once he has beheaded her, her blood gives birth to Pegasus - the winged horse. The heaviness of stone transforms into flight. Even the winged sandals that let Perseus fly came from the world of monsters, from Medusa's sisters the Graiae, who shared one tooth and one eye between the three of them.

The point Calvino is making is that lightness is not the absence of weight. It is a response to weight. Perseus does not pretend the monster is not there. He looks at it sideways, in a mirror, and finds a way to carry it that does not destroy him.

There is a passage in the Lightness lecture that we have thought about often since reading it:

Whenever humanity seems condemned to heaviness, I think I should fly like Perseus into a different space. I don't mean escaping into dreams or into the irrational. I mean that I have to change my approach, look at the world from a different perspective, with a different logic and with fresh methods of cognition and verification.

Calvino also has a very unexpected riff on software. Remember, this is 1985. He writes about the second industrial revolution not producing the "crushing images" of rolling mills and molten steel, but bits traveling along circuits as electronic impulses:

The iron machines still exist, but they obey the orders of weightless bits.

For a set of lectures written in 1985 by an Italian novelist, that reads as unsettlingly current. Substitute "large language model" for "bits" and it barely changes.

The lecture ends with a memorable image, which we will just quote:

Were I to choose an auspicious image for the new millennium, I would choose that one: the sudden agile leap of the poet-philosopher who raises himself above the weight of the world, showing that with all his gravity he has the secret of lightness, and that what many consider to be the vitality of the times - noisy, aggressive, revving and roaring - belongs to the realm of death, like a cemetery for rusty old cars.

Quickness

The Quickness lecture is the one that made us laugh out loud a few times.

Calvino's central paradox in this memo is that quickness in literature is often produced by slowing down. He talks about Laurence Sterne's Tristram Shandy - a novel that is essentially all digression, and which Diderot then took as a model - and argues that digression is one of the main techniques literature has developed for slowing time down:

In practical life, time is a form of wealth with which we are stingy. In literature, time is a form of wealth to be spent at leisure and with detachment. We don't have to be first past a predetermined finish line. On the contrary, saving time is a good thing because the more time we save, the more we can afford to lose.

He follows this with a wonderful line about digressions as a hiding place:

If a straight line is the shortest distance between two fated and inevitable points, digressions will lengthen it; and if these digressions become so complex, so tangled and tortuous, so rapid as to hide their own tracks, who knows - perhaps death may not find us, perhaps time will lose its way, and perhaps we ourselves can remain concealed in our shifting hiding places.

And then his personal motto, which is now our personal motto too:

From my youth on, my personal motto has been the old Latin tag, festina lente, hurry slowly.

The best story in the Quickness lecture, though, is the one about Chuang-tzu and the crab. Here is Calvino's telling in full:

Among Chuang-tzu's many skills, he was an expert draftsman. The king asked him to draw a crab. Chuang-tzu replied that he needed five years, a country house, and twelve servants. Five years later, the drawing was still not begun. "I need another five years," said Chuang-tzu. The king granted them. At the end of these ten years, Chuang-tzu took up his brush and, in an instant, with a single stroke, he drew a crab, the most perfect crab ever seen.

This is the whole book in a paragraph. Quickness is the payoff of an enormous investment of slowness. The single stroke exists because of the ten years of preparation. Speed is a property that expensive preparation lets you buy, and cheap speed is not the same thing at all.

Why We Wrote This Down

Our reason for keeping notes on this book is that Calvino is doing something we recognize from our own attempts to build a zettelkasten - he is trying to name properties of thought that are useful, so they can be carried forward and returned to.

Lightness. Quickness. Exactitude. Visibility. Multiplicity. Those are five words to keep on the wall.

References

• Calvino, Italo. Six Memos for the Next Millennium. Translated by Patrick Creagh. Harvard University Press, 1988.
• Our wiki notes: https://charlesreid1.com/wiki/Six_Memos_for_the_Next_Millennium

Bums: An Oral History of the Brooklyn Dodgers by Peter Golenbock is exactly what it says on the tin. It is an oral history, which means the book is stitched together mostly out of firsthand accounts - players, managers, executives, sportswriters, and fans - with Golenbock providing just enough connective tissue to keep the timeline moving.

We read it in the fall of 2022 and it turned out to be one of the better baseball books we have picked up. Below are our notes, chapter by chapter.

The Setup

The Brooklyn Dodgers were, until 1957, one of the two National League teams in New York (the other being the Giants), and the Dodgers are one of the great tragic love stories in American sports. They lost, and lost, and lost, and then finally won a championship in 1955, and then two years later Walter O'Malley moved the team to Los Angeles and the borough of Brooklyn never really recovered.

The nickname "Bums" was affectionate. Sort of.

Chapter-by-Chapter

Prologue. Sets the stage. Establishes why Brooklyn and its baseball team had a relationship that was different in kind from other city-team relationships. Introduces the oral history format and the "Bums" nickname.

Chapter 1 - The Daffiness Boys. Covers the pre-WWII years. This is the era of Babe Herman getting hit on the head with fly balls, Casey Stengel managing the team into and out of trouble, and the general reputation of the Dodgers as lovably incompetent. Ebbets Field is the third character.

Chapter 2 - MacPhail. Larry MacPhail arrives as general manager in the late 1930s. He is the person who brings night baseball to Ebbets Field, brings radio broadcasts (with Red Barber calling games), and generally drags the Dodgers into professional respectability. Team gets competitive. Wins the 1941 pennant. Loses the World Series to the Yankees, which is the beginning of a pattern.

Chapter 3 - Rickey. Branch Rickey arrives after MacPhail leaves for war service (and then, later, jumps to the Yankees). Rickey builds out a minor-league farm system, which was a serious strategic innovation at the time. The chapter sets up the next one.

Chapter 4 - The Noble Experiment. The Jackie Robinson chapter. It is the emotional center of the book. Golenbock gets voices from Robinson himself (via earlier interviews), teammates like Pee Wee Reese, opponents, Rickey, and observers. The abuse Robinson faced is described directly, not softened. His talent and his composure both come through. This chapter is worth the price of the book on its own.

Chapter 5 - The Boys of Summer. The core roster that would define the 1940s and 1950s Dodgers: Duke Snider, Gil Hodges, Roy Campanella, Carl Furillo, Carl Erskine, Preacher Roe, Pee Wee Reese, Billy Cox. The chapter is mostly personalities and clubhouse chemistry, and it is a lot of fun.

Chapter 6 - Wait 'Til Next Year. The heartbreak chapter. Repeated losses to the Yankees in the World Series. The 1951 playoff loss to the Giants on Bobby Thomson's "Shot Heard 'Round the World." The rivalry with the Giants, which was intense in a way that modern baseball rivalries mostly are not. And the perennial fan slogan that names the chapter.

Chapter 7 - Nineteen Fifty-Five. The one year they won it all. After all the near-misses, the Dodgers beat the Yankees in the 1955 World Series. Johnny Podres's Game 7 shutout gets the spotlight. The chapter captures a level of borough-wide joy that is very hard to imagine now.

Chapter 8 - The End. The move. Walter O'Malley consolidates power after Rickey leaves, decides he wants a new stadium, runs into Robert Moses in the process, and eventually decides Los Angeles is a better bet than Brooklyn. Players, sportswriters, and fans express shock, betrayal, and grief in that order. The 1957 season is the last one in Brooklyn.

Epilogue. Reflections on what the team meant, what the borough lost, and what the departure symbolized about postwar American cities in general.

What Makes the Book Good

The oral history format works because so many of the primary sources were still alive when Golenbock did the interviews. You get Pee Wee Reese talking about Jackie Robinson in his own voice. You get Ebbets Field vendors and ticket-takers remembering what it smelled like. You get sportswriters talking about deadlines and games they covered from the press box.

If you want a synthesized, analytical baseball history, this is not that book. Golenbock's editorial hand is light. He is stitching, not arguing.

If you want to hear what it was like to be there, this is that book.

Recommended If

• You like baseball history.
• You like New York history.
• You have ever wondered why Brooklyn is the way Brooklyn is.
• You want a Jackie Robinson chapter that treats him as a person and an athlete instead of an icon.

References

• Golenbock, Peter. Bums: An Oral History of the Brooklyn Dodgers. Contemporary Books, 1984.
• Our wiki notes: https://charlesreid1.com/wiki/Bums