HTTP

Small but clean.

Leave out the HTTP and the WWW.

You just need the actual URL.

And this is your brand marker.

Small but clean.

Leave out the HTTP and the WWW.

You just need the actual URL.

And this is your brand marker.

And so it had its own web server built in Lisp from the ground up.

So back in the day, HTTP was very simple, right? So it wasn't, you know, when you say, oh, had its own embedded web server, it sounds like this huge effort, but in fact, it was a very sort of like limited amount of code necessary to do that.

So yeah, the front end was HTML and JavaScript and CSS, just like we'd expect today.

Um, and the backend was Lisp and somehow it all worked together.

Oh, I see.

If you don't understand the underlying HTTP mechanics powering that framework, you simply can't debug complex issues or optimize for massive scale.

Go approaches this very differently.

Right.

Because of its standard library.

Exactly.

Specifically, a package called Net slash HTTP.

It is so exceptionally robust that it essentially eliminates the need for a massive bloated framework.

There are a few other changes worth mentioning.

The behavior of the JDK built-in HTTP server implementation when matching an incoming request path to an HTTP context path is switched from string prefix matching to path prefix matching.

This means the request path must begin with the context path and all matching path segments must be identical.

For instance, the context path slash foo would previously match on slash foo slash bar as well as slash foobar.

They realized that the Wiki software running on this obscure German server allowed page edits through standard HTTP GET requests.

We need to explain this mechanically because it is the key to the whole escape.

For those of us who don't spend our weekends building web servers, what is the difference between a Git request and a Puest request? And why does it matter here?

Think of a web browser interacting with a server like a patron interacting with a librarian.

A geek request is when you ask the librarian to retrieve a specific book for you to read.

There are a few other changes worth mentioning.

The behavior of the JDK built-in HTTP server implementation when matching an incoming request path to an HTTP context path is switched from string prefix matching to path prefix matching.

This means the request path must begin with the context path and all matching path segments must be identical.

For instance, the context path slash foo would previously match on slash foo slash bar as well as slash foobar.

But then even deeper than that, they've launched some features by working with the AI providers and also their own forensics and reverse engineering to inspect even the MCP calls.

So when you have their proxy enabled with their agent on endpoints, It will see the HTTP request body that is falling to an MCP server, right? So like when you link up Gmail to your chat GPT, it's using an MCP server to make those API requests, the Gmail to read your email and everything.

So they figured out a way to filter those out and then they can scan for PII or sensitive information or things that you've set as words to flag, things like that.

So the tech stack is catching up in terms of catching people.