Recommended Reading by Phase
Read alongside the daily exercises — not before. Open the book when the exercise raises a question you can't answer from godoc alone.
Phase 1: Go Fundamentals (Days 1–30)
Primary — read in this order:
| # | Book | Author | Why |
|---|---|---|---|
| 1 | The Go Programming Language | Donovan & Kernighan (Addison-Wesley, 2015) | The definitive Go reference. Chapters 1–5 (syntax, types, functions, interfaces) map directly to Weeks 1–2. Chapter 8 (goroutines/channels) maps to Week 2. Chapter 11 (testing) maps to Week 2. Read a chapter per week alongside the exercises. |
| 2 | Learning Go (2nd ed.) | Jon Bodner (O'Reilly, 2024) | Modern companion to TGoPL. Covers generics (Week 4), idiomatic error handling (Day 7), and context (Day 15) with more contemporary examples. Read after TGoPL for a second perspective on the same topics. |
| 3 | Concurrency in Go | Katherine Cox-Buday (O'Reilly, 2017) | Read during Week 2 (Days 12–14) and Week 4. Deep treatment of goroutine patterns, channel pipelines, sync primitives, and the context package. Directly backs the exercises on worker pools, fan-in/out, and cancellation. |
Supplementary:
| Book | Author | When to Read | Why |
|---|---|---|---|
| 100 Go Mistakes and How to Avoid Them | Teiva Harsanyi (Manning, 2022) | After Week 4 | Catalog of real production bugs (slices, goroutine leaks, error wrapping, benchmarks). Read as a code review checklist for your Phase 1 projects. |
| Go in Practice | Butcher & Farina (Manning, 2016) | During Week 3–4 | Pattern-focused. Covers I/O composition, JSON streaming, and middleware patterns with concrete examples. |
Free references (keep open daily):
- Go specification:
go.dev/ref/spec— the authoritative source for language behavior - Standard library docs:
pkg.go.dev— read the package source, not just the API docs - Go blog:
go.dev/blog— official articles on generics, memory model, profiling
Phase 2: L4 Networking + TLS (Days 31–60)
Primary — read in this order:
| # | Book | Author | Why |
|---|---|---|---|
| 1 | Network Programming with Go | Jan Newmarch (Apress, 2020) | The only Go-specific networking book. Covers net.Dial, net.Listen, TCP/UDP servers, TLS in Go, and HTTP from first principles. Read Chapter 1–4 during Week 5, Chapter 8–9 (TLS) during Week 6. |
| 2 | TCP/IP Illustrated, Volume 1: The Protocols (2nd ed.) | W. Richard Stevens & Gary Wright (Addison-Wesley, 2011) | The definitive TCP/IP reference. Language-agnostic. Read Chapter 12–18 (TCP) during Week 5. Chapter 2–4 (IP, ARP) for context. You won't read this cover-to-cover — use it as a reference when an exercise raises a "but why does TCP do this?" question. |
| 3 | Bulletproof TLS and PKI (2nd ed.) | Ivan Ristić (Feisty Duck, 2022) | The definitive TLS and certificate reference. Author runs SSL Labs (ssllabs.com). Read Part 1 (TLS protocol) during Week 6 (Days 38–41). Part 2 (PKI, certificates) during Days 40–41. Essential background for the mTLS gateway project. Updated to cover TLS 1.3. |
Supplementary:
| Book | Author | When to Read | Why |
|---|---|---|---|
| Cryptography Engineering | Ferguson, Schneier & Kohno (Wiley, 2010) | During Week 6 (Days 42–44) | Deep dive on AES, HMAC, ECDSA, and random number generation from first principles. Explains why specific constructions (GCM vs CBC, ECDSA vs RSA) are chosen. Read chapters on symmetric encryption, MACs, and public-key crypto. |
| Computer Networks: A Top-Down Approach (8th ed.) | Kurose & Ross (Pearson, 2021) | Before Week 5 if networking feels shaky | The standard university networking textbook. Chapters 3 (transport layer, TCP) and 4 (network layer) fill gaps if OSI/TCP feels abstract. More accessible than Stevens. |
| Unix Network Programming, Vol. 1 (3rd ed.) | W. Richard Stevens (Prentice Hall, 2003) | During Week 7 (connection pooling, SO_REUSEPORT) | The reference for socket programming. Chapter 7 (socket options), Chapter 16 (non-blocking I/O), and Appendix B (TCP state machine) are most relevant. |
Free references:
- RFC 793 (TCP), RFC 9293 (updated TCP) — the actual spec for what TCP does
- RFC 8446 (TLS 1.3) — read Section 2 (overview) and Section 4 (handshake) alongside Day 38
- RFC 5280 (X.509 certificates) — read Section 4 alongside Day 40
Phase 3: L7 Networking + WAF + API Security (Days 61–90)
Primary — read in this order:
| # | Book | Author | Why |
|---|---|---|---|
| 1 | HTTP: The Definitive Guide | Gourley, Totty, Sayer et al. (O'Reilly, 2002) | Still the most comprehensive HTTP reference despite its age (HTTP/1.1 is unchanged). Read Chapter 1–4 (HTTP basics, connections, messages) before Week 9. Chapter 11 (proxies) before Day 64. Chapter 14 (security) before Week 11. Chapter 7 (caching) and 8 (integration points) for context. |
| 2 | The Web Application Hacker's Handbook (2nd ed.) | Stuttard & Pinto (Wiley, 2011) | Attack techniques that map directly to WAF rules. Read Chapter 9 (SQLi) before Day 69. Chapter 12 (XSS) before Day 70. Chapter 10 (code injection) before Day 71. Chapter 4 (mapping the application) for the attacker's perspective on WAF bypass. This is the offensive side of what you're building defensively. |
| 3 | API Security in Action | Neil Madden (Manning, 2020) | Deep treatment of API authentication and authorization. Chapter 3 (token-based auth) maps to Day 75. Chapter 4 (OAuth2) maps to Phase 3 week 11. Chapter 8 (rate limiting) maps to Day 76. Chapter 11 (mTLS) ties back to Phase 2. The best single book covering Week 11's topics. |
Supplementary:
| Book | Author | When to Read | Why |
|---|---|---|---|
| The Tangled Web | Michal Zalewski (No Starch Press, 2011) | During Week 9 (Days 67, 81) | Browser security model from first principles. Same-origin policy, CORS, XSS, and clickjacking explained from the attacker's perspective. Read before Day 67 (security headers) and Day 81 (CORS). Explains why CORS misconfigs are critical, not just that they are. |
| OWASP Testing Guide (v4.2) | OWASP Foundation (free PDF) | During Week 10 (Days 68–74) | Free. The reference for web application vulnerability testing. Use as a checklist when writing WAF rules — for each category you implement, the OWASP guide shows the full attack taxonomy and bypass techniques. Download at owasp.org. |
| Web Application Security | Andrew Hoffman (O'Reilly, 2020) | During Week 10 | More modern than WAHH. Good coverage of encoding bypasses and modern XSS variants. Chapters on recon and offense inform how you write defensive rules. |
Free references:
- RFC 9110 (HTTP Semantics) — the 2022 consolidation of all HTTP/1.1 RFCs
- RFC 9113 (HTTP/2) — read Section 5 (streams) alongside Day 65
- RFC 6455 (WebSocket) — read alongside Day 66
- OWASP Cheat Sheet Series (cheatsheetseries.owasp.org) — one cheat sheet per attack type
Phase 4: DDoS + Bot Detection + Production (Days 91–120)
Primary — read in this order:
| # | Book | Author | Why |
|---|---|---|---|
| 1 | Security Engineering (3rd ed.) | Ross Anderson (Wiley, 2020) | Free online at cl.cam.ac.uk/~rja14/book.html. Comprehensive security engineering textbook by a Cambridge professor. Chapter 21 (network attack and defense) maps to Week 13 (DDoS). Chapter 22 (telecom) covers amplification attacks. Chapter 3 (psychology of security failures) is essential EM reading. Dip in by chapter, don't read linearly. |
| 2 | Site Reliability Engineering | Beyer, Jones, Petoff & Murphy (Google/O'Reilly) | Free online at sre.google/books. The production hardening bible. Chapter 8 (release engineering / zero-downtime), Chapter 13 (emergency response), Chapter 21 (managing load), and Chapter 29 (dealing with interrupts) map directly to Week 15. Read during Days 106–112. |
| 3 | The Practice of Network Security Monitoring | Richard Bejtlich (No Starch Press, 2013) | Traffic analysis and anomaly detection from a practitioner. Chapter 1–3 (NSM concepts) and Chapter 8–9 (analysis) inform the DDoS anomaly detection work in Week 13 (Days 95–96). Bejtlich's mental model of "collect, detect, respond" maps well to the ThreatIntel store design. |
Supplementary:
| Book | Author | When to Read | Why |
|---|---|---|---|
| Silence on the Wire | Michal Zalewski (No Starch Press, 2005) | During Week 14 (Bot Detection) | Passive fingerprinting and traffic analysis. The chapter on TCP/IP stack fingerprinting is the conceptual foundation for JA3 TLS fingerprinting (Days 101–103). Zalewski's approach to behavioral inference informs the session scoring design. |
| The Art of Intrusion | Kevin Mitnick (Wiley, 2005) | During Week 14 | Case studies of real attacks. Read for attacker mindset — not for technical depth but to understand how determined attackers think around bot detection and rate limiting controls. Useful context before Day 113 (attack simulation). |
| Accelerate: The Science of Lean Software and DevOps | Forsgren, Humble & Kim (IT Revolution, 2018) | During Week 16 | The data behind deployment frequency, MTTR, and change failure rate. Connects Phase 4's production hardening work (graceful shutdown, zero-downtime deployment) to organizational outcomes you care about as an EM. |
| The Phoenix Project | Kim, Behr & Spafford (IT Revolution, 2013) | Anytime | A novel about DevOps transformation. Not technical — but it provides narrative context for why operational characteristics (observability, graceful shutdown, fast deployments) matter at the organizational level. |
Free references:
- Google SRE Workbook (sre.google/workbook) — companion to the SRE book, more prescriptive
- NIST SP 800-38D — AES-GCM specification (relevant to Day 43 and the audit log)
- Cloudflare blog (blog.cloudflare.com) — articles on DDoS mitigation, JA3, bot detection written by people who operate these systems at scale
- IETF RFC 8941 (Structured Field Values for HTTP) — context for rate limit headers
Cross-Phase Reading (All 120 Days)
These span multiple phases and are worth reading alongside the entire plan:
| Book | Author | Read When | Why |
|---|---|---|---|
| Designing Data-Intensive Applications | Martin Kleppmann (O'Reilly, 2017) | Chapters as relevant | Chapter 1 (reliability, scalability) for all phases. Chapter 8 (distributed systems) for rate limiting and state management in Phase 3–4. The mental model of "what can go wrong" improves every design decision in this plan. |
| The Pragmatic Programmer (20th anniversary ed.) | Hunt & Thomas (Addison-Wesley, 2019) | One tip per week | Craft principles (DRY, orthogonality, design by contract) that apply throughout. Read one section per week as a metacognitive complement to the technical exercises. |
| A Philosophy of Software Design | John Ousterhout (Yaknyam Press, 2018) | During Phase 3–4 integration weeks | Deep modules, shallow interfaces, and designing systems that are easy to reason about. Directly applicable when integrating WAF + DDoS + Bot + API into a coherent middleware chain. |
Reading Schedule (Integrated with Daily Workflow)
The daily 1-hour budget is for coding. Read books separately — 20–30 minutes before bed or during commute.
Phase 1 (Days 1–30)
Week 1–2 The Go Programming Language, Ch 1–5, 8
Week 3–4 Learning Go (modern patterns) + Concurrency in Go
Phase 2 (Days 31–60)
Week 5 Network Programming with Go, Ch 1–4
TCP/IP Illustrated Vol. 1 (TCP chapters, as reference)
Week 6 Bulletproof TLS and PKI, Part 1–2
Cryptography Engineering (AES, HMAC, ECDSA chapters)
Week 7–8 Unix Network Programming (socket options, as reference)
Phase 3 (Days 61–90)
Week 9 HTTP: The Definitive Guide, Ch 1–4, 11
Week 10 The Web Application Hacker's Handbook (SQLi, XSS, injection chapters)
OWASP Testing Guide (as checklist)
Week 11–12 API Security in Action, Ch 3–4, 8, 11
The Tangled Web (CORS, XSS model)
Phase 4 (Days 91–120)
Week 13 Security Engineering, Ch 21–22
Practice of Network Security Monitoring, Ch 1–3, 8–9
Week 14 Silence on the Wire (fingerprinting chapters)
Week 15 Site Reliability Engineering, Ch 8, 13, 21, 29
Week 16 Accelerate (production metrics and org outcomes)