Backend Software Engineer

Colombo, Sri Lanka

Pulathisi Kariyawasam

Backend engineer who builds APIs, integrations, and automation, with a focus on security and hands-on work across Linux, cloud, and IoT.

Pulathisi Kariyawasam, backend software engineer

01 About

I'm a backend engineer in Colombo. Most of my work is designing APIs and integrations for internal services and automating workflows, often with web scraping and scripting. I like getting hands-on with what runs underneath: Linux servers, deployments, cloud infrastructure on Azure and Oracle, and IoT devices and microcontrollers.

Security is a constant interest. I review systems for weaknesses and have a basic hands-on background in penetration testing. I also write about how the internet's cryptography works at randhana.com.

PHP · Python · Node.js · FastAPI · SQL Server · MySQL · Redis · Docker · Linux · CI/CD

BSc in Physical Science & ICT, University of Sri Jayewardenepura (2023)

02 Featured work

  1. Fixed-deposit rate comparison

    Tracks fixed-deposit rates across banks and finance companies in Sri Lanka. Scraping pipeline, FastAPI API, Next.js frontend.

    Live

  2. Pixelgate image tools

    Image conversion tools, live on the web.

    Live

  3. Server Monitor

    An agentless Linux server monitor that works over plain SSH.

    Write-up

  4. JWT decoder

    Paste a token to read its header and claims. It runs in your browser, and nothing is sent anywhere.

    Tool

  5. Drowning Detection System

    Final-year university project, 2023. Detects drowning in recorded video with computer vision and pre-trained models. 47 stars on GitHub.

    Open source

03 Writing

04 Handshake

Every HTTPS connection starts with a handshake. Here is what each message reveals, and what it hides from someone watching the network.

What someone watching the network can see.

TLS 1.3 handshake between a client and a server Six steps from ClientHello to application data. Each step is described in the list below the diagram. Client Server ClientHello + key_share plaintext: server name (SNI), key share ServerHello + key_share plaintext: chosen cipher, server key share Encrypted: Certificate, Finished ciphertext: certificate and Finished verify certificate local check, not on the wire Client Finished ciphertext: client Finished application data, encrypted ciphertext: data; size and timing visible
  1. ClientHello. The client sends a random value, the TLS versions it supports, and its own X25519 key share.
  2. ServerHello. The server picks a cipher and returns its key share. Both sides can now compute the same shared secret. This message is not encrypted.
  3. Encrypted flight. The server sends its certificate and a signature over the handshake, encrypted with keys derived from the shared secret.
  4. Verification. The client checks the certificate chain and hostname against trusted roots, then verifies the signature with the certificate's key.
  5. Client Finished. The client proves it derived the same keys. The handshake is complete after one round trip.
  6. Application data. Data flows under the derived traffic keys. Nothing on the wire is readable without them.

05 Now

Building a rate limiter in Go and studying for AZ-104.

Updated