>> Cache, stack, heap, process, thread, socket, file, tcp, http, tls, websocks, socks, soc2???, deadlock, stack, queue, race, atomic, event loop, coroutine, async, database, transaction, index, replication, sharding, consistency, serialization, DNS, load balancer, container, namespace, and so on.

... communication protocol, method signatures, web components, ssh, CSS media queries, HTTP headers, WebSockets, timeouts, ETag, iterables, async iterables, middleware, CI/CD, build, consistent hashing, signatures, JWT, SSO, OAuth, SAML, XML, YAML, JSON, block cipher, ETL pipeline, SQL, SQL transactions (atomic), relational databases, foreign keys, schema normalization, referential integrity, 1-to-1, 1-to-n, n-to-n, document databases, compound indexes, idempotency, offset-based pagination, cursor-based pagination, P2P, Kademlia, structured vs unstructured network topology, message routing, frontend router, message storm, reconnect storm, locality, encapsulation, cohesion, coupling, design patterns, modularity, Big O notation, raytracing, shaders, VPN, VPC, data schema, schema validation, CORS, preflight-requests, CSRF, ASCII, UFT8, CSP, CPU context-switching, BIOS, bootloader, interrupt controller, ports, BIND protocol, BGP protocol, assembly language, big endian, little endian, register, signals, embarrassingly parallel, serial processing, event loop, binary trees, tree rebalancing, graph traversal algorithms, sorting algorithms, string character escaping and encoding, blob, base64, UUID, timestamp, CLI, Bash, unit tests, integration tests, e2e tests, TDD, stateful, stateless, proxy, nginx, haproxy, config, helm file, k8s, staging, git, push, commit, merge, rebase, cherry-pick, pub/sub, diff, honeypot, buffer overflow, pointer, file descriptor, authentication, certificates, TLS certificates, DNS Zone files, A record, CNAME, TXT record, SMTP, POP3, SOCKS5, Sha256, HMAC, Merkle trees, Merkle Signature Trees, Lamport OTS, Winternitz OTS, SPHINCS, lattice-based cryptography, pg-vector, vector embeddings, API, rate limiting, cookies, sameSite, httpOnly, localStorage, XSS attack, SQL injection, fetch API, module preloading, bundling...

Barely scratching the surface. I think I could probably keep typing all the technical terms I know for at least 24 hours straight. For most of the topics above, I could probably give a 1 or 2 hour lecture on each one from memory. Some I could give a day-long lecture each.

To explain all the terms I know to a basic degree, I would probably need to give a whole year of lectures back-to-back from 9am to 5pm. And I'm just a rank-and-file senior engineer with 15 years of experience.

It's also why the vast majority of software systems are insecure. The average senior software engineer doesn't know everything that they need to know to build secure software. Last time I poked around Coinbase APIs on HackerOne, I found a DoS vulnerability in less than 30 minutes. That's Coinbase, not some startup built by a bunch of recent graduates.

AI cannot avoid vulnerabilities either since it is trained on average engineer code. There's not enough high quality code available on the entire internet to train AI to implement secure code IMO. As impressive as Mythos may be, it's not enough. I don't even think formal verification would provide protection since sometimes issues with the spec itself can provide an opening for a vulnerability.

Nice list. I like it how you also included some made up terms. For completeness, those are not real:

ETag, SAML, CSP, BGP, haproxy, helm file, k8s, SOCKS5, Lamport OTS, Winternitz OTS, SPHINCS, lattice-based, pg-vector, sameSite, httpOnly. (Or, at least, i have no idea what those are ::)

Coinbase not a startup built by recent graduates...

You overestimate Coinbase's engineering rigor.

But yes security in modern software systems is a joke. I don't even get paid to fix security bugs everytime I raise them the answer is to slap a sandbox and proxy and call it done.

a janitor could do the same though