DEV Community: GoluScriptMage

🚀How Two Computers Create a Secret Without Ever Sharing It

GoluScriptMage — Tue, 21 Jul 2026 11:36:40 +0000

For quite a time, I was thinking: how does encryption really work?

Like, if I want to send a secret request (like an auth token) to a server, but the network channel is insecure. Thousands of people can see what we are sending.

We can't even share a secret password (key) to each other beforehand. Because if we send the password over the network, everyone else will see it and use it too.

So how on earth do we connect securely?

Then I researched and found out about the legendary minds who solved this. Let's break it down—this is going to be a fun topic.

🎨 The Paint Color Analogy

Imagine you and I want to agree on a secret color, but a spy is watching every single color we pass to each other.

Here is the color theory trick:

Public Agreement: We openly agree on a starting color, let's say Yellow. The spy hears this.
Private Secrets: I choose a secret color (Red). You choose a secret color (Blue). We keep these secret in our minds.
The Mix: I mix my secret Red with the public Yellow to get Orange. You mix your secret Blue with the public Yellow to get Green.
The Exchange: We send our mixed colors (Orange and Green) to each other. The spy intercepts them. But the spy cannot easily separate the mixed colors to find our private Red or Blue.
The Match: I take your Green (Blue+Yellow) and add my secret Red to it. You take my Orange (Red+Yellow) and add your secret Blue to it.

Result: Both of us now have the exact same color mixture: Red + Blue + Yellow (Brown).

We just agreed on a shared secret color without ever sending our private secret colors over the network!

🗺️ The Connection Flow

Here is the exact step-by-step lifecycle of how this handshake and data encryption works under the hood:

================================================================================
PHASE 1: THE TLS HANDSHAKE (Color Exchange) - Tunnel Building
Goal: Agree on the "Brown Key" without hackers reading our private colors.
================================================================================

 GOLU (Browser)                                                 SIA (Web Server)
 [Private Color: RED]                                         [Private Color: BLUE]
          |                                                             |
          | ----- 1. ClientHello (Agree on public color: YELLOW) -----> |
          |                                                             |
          | <---- 2. ServerHello (Confirm public color: YELLOW) ------- |
          |                                                             |
          | 3. Golu mixes:                                              |
          |    RED + YELLOW = ORANGE                                    |
          |                                                             |
          | ----- 4. Golu sends mixed ORANGE -------------------------> |
          |                                                             |
          |                                           5. Sia mixes:     |
          |                                              BLUE + YELLOW = GREEN
          |                                                             |
          | <---- 6. Sia sends mixed GREEN ---------------------------- |
          |                                                             |
          | 7. Golu computes key:                                       |
          |    RED + GREEN (Sia's mix)                                  |
          |    = BROWN KEY                                              |
          |                                           8. Sia computes key:
          |                                              BLUE + ORANGE (Golu's mix)
          |                                              = BROWN KEY
          |                                                             |
================================================================================
RESULT: Both have the same "BROWN KEY". Secure tunnel is OPEN!
================================================================================

          |                                                             |
          |                                                             |

================================================================================
PHASE 2: SECURE APPLICATION SESSION (Sending the Auth Token)
Goal: Send the sensitive token encrypted so only Golu & Sia understand it.
================================================================================

 GOLU (Browser)                                                 SIA (Web Server)
 [Token: "XYZ"]                                               [Database Check]
          |                                                             |
          | 1. Encrypt with BROWN KEY:                                  |
          |    "XYZ" + BROWN = "x&9#p"                                  |
          |                                                             |
          | ----- 2. Sends Encrypted Request ("x&9#p") ---------------> |
          |                                                             |
          |                                           3. Decrypts with BROWN KEY:
          |                                              "x&9#p" + BROWN = "XYZ"
          |                                                             |
          |                                           4. Database Lookup:
          |                                              Is "XYZ" valid? YES!
          |                                                             |
          | <---- 5. Sends Encrypted Status ("Logged In") ------------- |

In computers, we don't mix paint. We use a mathematical trick called Modulo Arithmetic.

Because finding the private key from the public key is mathematically impossible for computers in a reasonable timeframe (known as the Discrete Logarithm Problem), the spy is completely locked out.

🛡️ The Major Limitation: Man-in-the-Middle (MITM)

While Diffie-Hellman is legendary, it has one critical vulnerability: It does not verify identity.

If a hacker sits in the middle of our connection, they can intercept Golu's public key, establish a secure tunnel with Golu pretending to be Sia, and establish another secure tunnel with Sia pretending to be Golu.

This is the Man-in-the-Middle (MITM) attack. Diffie-Hellman encrypts the traffic, but it doesn't prove who you are talking to.

To solve this, modern HTTPS combines Diffie-Hellman with Digital Certificates (SSL). The server must provide a cryptographic certificate signed by a trusted authority to prove that "Sia" is actually Sia, not a hacker in the middle.

💬 What is the single systems concept that blew your mind when you first learned it? Let me know in the comments!

If you liked this simple breakdown, follow me for more interesting systems engineering topics.

— Golu

📝 Error Never Lies: A Systems Programmer's Guide to Truth

GoluScriptMage — Mon, 20 Jul 2026 12:19:08 +0000

"My code is correct, but it's not working."
If you have ever said this, you have told the single biggest lie in software engineering.

⚡ The Illusion

We have all been there. You look at a block of TypeScript code, check it with your eyes, and swear to the coding gods that the logic is flawless without any problems. Yet, the terminal is telling the error line, or the process is hanging indefinitely, mocking you.

Your brain goes through the five stages of debugging grief:

Denial: "This is impossible. The code is literally perfect."
Anger: "Express/Node/Git is broken. It's a bug in the runtime."
Bargaining: "Maybe if I restart the server, it will fix by itself."
Depression: "I don't know what I'm doing. I should just choose a different career."
Acceptance: Looking at the error trace.

Here is the cold, hard systems reality: The computer is a machine of pure logic. It does not have an ego, it does not have fatigue, and it does not make random assumptions. It executes exactly what you wrote, not what you intended to write.

🔎 Case Study: The Double Response Kalesh(fight)

Let's look at a classic real-world bug that drove me crazy for 20 minutes today.

I was building a deployment reverse proxy engine. When deploying a project, the client CLI kept hanging on the fetch call. The server terminal was spitting out a massive traceback:

Error [ERR_HTTP_HEADERS_SENT]: Cannot set headers after they are sent to the client
    at ServerResponse.setHeader (node:_http_outgoing:642:11)
    ...

I checked my route handler. I checked my if blocks. I was returning the response. I was sure.

But the error trace pointed to a single line:

res.send(200).json({ status: 'success', subDomain })

The epiphany: I had chained .json() onto .send(200). In Express, .send() instantly finishes the response cycle and flushes the headers to the client. The subsequent .json() call tries to send data again over a closed channel.

I was looking for complex logical bugs, but the error traceback was pointing directly at the boundary. It wasn't lying. I was.

🏆 The Rules of the Debugging Arena

If you want to survive the systems grind, you must live by these three rules:

1. Trust the Trace over your Eyes

Your eyes read what your brain wants to see (the intended logic). The stack trace reads what the CPU actually executed. Never skip reading the traceback. The file path and line number in the logs are the exact coordinate of your mistake.

2. Audit the Boundaries (I/O)

Most bugs happen at interface boundaries—where the client talks to the server, where the code reads the filesystem, or where arguments are passed to a git command. If your client is expecting an array and you wrap it in an object, the system will crash. Check the data shape at the borders.

3. Savour the Error

A clean terminal that hides silent failures is a time-bomb. A red error stack is a roadmap. It is telling you exactly where the system is weak. Every error you debug is a micro-lesson that hardens your systems knowledge.

🏁 Outro

The next time a terminal prints a massive traceback, don't get frustrated. Don't close the terminal.

Take a deep breath, wash your hands in cold water, and read the trace line by line.

Because the compiler doesn't hate you. And the Error never lies.

💬 What is the single dumbest debugging mistake that cost you hours? Let me know in the comments!

If you liked this post, follow for more deep-dives into backend systems and DevOps pipelines.

— Golu