Flashcards
306 - Internet applications engineering
Cards in this deck (200)
- 1how quickly should a rwebsite respond?around 2 seconds
- 2what is a web server?the primary function of a web server is to deliver web pages to network clients
- 3A web server is a piece of software that does what?- takes a HTTP request for a named resource over the network
- serves that resource back to tje client as payload to an HTTP response (HTTP/MIME formats) - 4whats changed since the creation of www?websites now have images, scripts, videos etc
- 5HTTP uses what protocol?TCP
- 6How do clients connect to servers?client initiates TCP connection (creates socket) to server, port 80
server accepts TCP connection from client
HTTP messages (application layer protocol messages) exchanged between browser (HTTP client) and web server (HTTP server)
TCP connection closed
steps are repeated for each object - 7what is RTT?Round Trip Time
time for a packet to travel from client to server and back again - 8What is HTTP response time?The time to receive a HTTP response
2RTT + file transmission time
1 RTT for TCP connection
1 RTT for HTTP request
+ file transmission time - 9what are the two types of HTTP messages?request and response
- 10some information that is kept in the response header(HTTP 1.1 formats)?date
version of server
keep-alive
content type
content length
last modified
E-tag - 11some HTTP response codes?200 - OK
301 - moved permanently
400 - bad request
404 - not found
505 - HTTP version not supported - 12what is latency?a measure of time delay experienced by a system
i.e. the time it takes for a packet of data to get from one designated point to another - 13difference between RTT and latency?RTT is the time it takes to get there and back, latency is the time to get there
- 14is there any way we can measure latency?over a network?ping
uses ICMP or UDP
e.g.
ping -c 10
will ping this address 10x - 15characteristics of latency?it always changes, its never fixed
- 16what is throughput?throughput is a synonym(cinnamon) for bandwidth
it is the amount of information that can be transmitted over a network in a given time
e.g. per second - 17what is the DOM content model?represents the internals of the page as the browser see's it
- 18why is the DOM content model important?it is critical to web page retrieval and how the web pages become rendered
- 19typically how many objects are there per web page?typically between 50 - 100
- 20what is TTFB?This is the time from the request to the server until the first byte of the response is received by the browser
- if this is over 100ms or so then this is a slow response - 21what is start render?this is when the content begins to display to the users browser
- 22what is DOM content loaded?this is when the initial HTML document has been completely loaded and parsed, sufficient to build the DOM tree
don't need every object(completely loaded) to start rendering - 23what is document complete time (load time, onLoad time)?when all of the document resourced has been fully loaded
- 24what are important resources that may b be required to render the page?CSS (render blocking)
JavaScripts - 25How can we improve web performance?Order content
Do less
Keep-alives
CSS sprites
makes things smaller
support caching
load after the fold - 26how can we improve download performance by ordering content?Ordering the content:
CSS goes in the head so that the browser receives it quicker, therefore the DOM can start rendering quicker
JavaScripts often go in the body since you don't need the scripts until the page is available - 27how can we improve download performance by doing less?a simpler DOM will be faster
- reduce the number of page elements to load and process
Combine files!
Remove duplicates - 28Improving performance: A small improvement on TCP in web performance?Keep-alives
- 29what are keep-alives?manages how often a TCP connection takes place
- determines if a TCP connection is still valid by sending a TCP packet and waiting for an ACK - 30Improving performance: What are CSS sprites?combining multiple images files into a larger image map
- 31advantages to CSS sprites?client is loading one larger image instead of many smaller ones - reducing overhead
- 32how can we make things smaller?enable compression
minify javascript files and CSS files
e.g. removing white spaces or reducing variable names - 33what is caching in a web performance context?content is stored by the web browser
when the content is needed, this can be retrieved locally instead of requesting it again - 34what is loading after the fold?Delay loading of components not visible to the user until theyre needed
the fold if the current view of the screen(viewport)
below the fold is when you scroll down - 35some self questions for understanding your web performance?1. What do we need to measure in order to understand performance bottlenecks on our web site?
2. How many times should we measure and where from?
3. What should we optimise first?
4. What tools can help us? - 36what is scaling?the ability to handle an increasing number (of possibly concurrent) requests
- 37what are some performance targets?low latency (short TTFB)
high throughput (short content download) - 38metrics for measure performance?number of requests served per second
latency
throughput in bytes/s - 39what is the cheapest option we can do to avoid server load?optimise before scaling
- reduce server load - 40what is vertical scaling?bigger/upgrades
bigger in terms of capacity e.g. i5 to an i9
keep number of servers the same but upgrade - 41advantages to vertical scaling?nothing is drastically changed
- 42what is horizontal scaling?more hardware!
- 43disadvantages of horizontal scaling?need to change the way software is built to accommodate the new hardware, things like request handling and how to spread them across the new hardware
- 44what is a load balancer?distributes the load on a server evenly across two or more servers
- 45how can web experience be personalised?through sessions
e.g. cookies - 46what is a user session?e.g. state of interaction, shopping basket, etc
sessions are states that is built up between the client and the server - 47what are flash crowds?content that has gone viral
- 48how are flash crowds dangerous?they can crash sites due to the making no provision for it in scaling
e.g. caching - 49How can we manage our servers to avoid blockings and increase performance?Different servers for different content
e.g. a web server can server small resources and another can serve large resources
- load balancer can organise this
e.g.
large images wont block small scripts from being sent - 50what is domain sharding?different server name = different connection
- 51advantages to domain sharding?additional resources being downloaded in parallel
faster page load time - 52disadvantages to domain sharding?increased DNS lookup times
website modifications
increased TCP overhead - 53what does it mean by caching exploits locality?moving content closer to the user increases performance
i.e.
less hops
less latency
less congestion - 54what is a CDN?Content Delivery Network
i.e. the cloud
distributes your content to servers geographically located in separate locations, with the aim of supplying your users content from servers that they are close to - 55what is IaaS?Infrastructure as a service
hardware, in software
i.e VM's
VM's are provisioned for various roles, e.g. serve front-end, run php scripts on backend - 56advantages to IaaS?can be re-provisioned (vertical scaling)
can be replicated (horizontal scaling)
can be created and destroyed almost instantly
can be connected however you want - 57what is PaaS?Platform as a Service
deploy services instead of servers
e.g. Google app/engine - 58advantages to PaaS?no need to worry about infrastructure
PaaS is on top of IaaS - 59what is cloud elasticity?in cloud computing, elasticity is defined as the degree to which a system is able to adapt to workload changes by provisioning resourced in an automatic manner
- 60advantages to IaaS and PaaS?Resilience to hardware and network failures
A run-time proportion of CPU, memory storage, network IO (specifiable configurability)
On-demand scalability - elasticity
low cost - pay per use
global evailability - 61disadvantages to IaaS and PaaS?interoperability issues (moving cloud providers)
Hidden costs
data recovery (can they recover data?) - 62what is the fire clown in the BBS?It means that the service has disspeared
- 63what is the cache's job in online architecture?Serve users and update
- 64advantages to using cache?reduces the load on web server
- web server can now format a response that will be cached and forget about it - 65what is stale-while-re-validate?serves the old page(from cache) back to the audience
then go back and get the fresh page - 66what does 'vary' mean in dev tools?allow variances in the cache
e.g. requesting a zipped copy
e.g. request a copy in a different language - 67what is 'X-Cache-Age: n'the cached object has been live for n seconds
- 68what is 'X-Cache-Hits: n'?n people have copied the cache whilst its been live
- 69what is a problem with cache age?say max-age = 30
and X-Cache-age = 20
when we download this, we are not storing this for 10 seconds, we are storing it for an additional 30 seconds - 70a problem with cache and number of pages a website may have?cache stops being effective
- cant keep a copy of them all, all the time - 71a solution to the above problem?change the architecture -
increase # of web servers
add secondary cache layer before API
(to protect them from the range of requests that are being made)
increase cache - 72can we increase cache further?add cache on the box, i.e. webserver and API boxes
- 73why do we do the above method?it is to protect it from too many requests
can be stale-while revalidate - 744 key areas to scaling websites?Scale
Caching
IO and CPU bounds
Architecture - 75what are I/O and CPU bounds?Memory
Processor
Network
Disk - 76what is the bottleneck in IO and CPU bounds?The Von Neuman architecture
- it can only perform one operation at a time - 77questions to ask while evaluating IO bounds?1. Are we using memory efficiently?
2. Are we pushing the network cards to the limit?
3. Where are the bottlenecks when it comes to processing? --?? - 78What does scaling mean in the 4 key areas?1. More hardware, i.e. vertical or horizontal
2. Virtualisation for efficient use of the current hardware - 79what is an advantages to virtual scaling?Portability of the systems youre running, so you can move them through the hardware without thinking about the migration
To get the most out of the hardware, e.g. if you have several processes in several systems that are under-using the box, then group them into one box, this relieves the other box to work on other stuff - 80what does architecture mean in the 4 key areas?Nano services:
- break the software down into functional bits
- can we break them down further?
- take a function and make it a service - 81general principles for architecting?Loose coupling
High complexity tasks
Database architecture - 82what is loose coupling?to build systems that are independent
have a single purpose that works on their own
e.g. a website that processes some image. The service that does the image processing that takes a while can be split off into a separate service, that can run independent from the rest, so the rest of the system is not waiting - 83what does the high complexity tasks principle mean?move high complexity tasks away from a particular area
but put them somewhere sensible??? wot - 84the database architecture principle?how they are used - wot?
- 85How do you think about the costs of the architecture?who uses the site and when?
e.g. do you really need the full architecture 24/7 - 86what is SaaS?third party hosts everything but your data
aka makes your application available over the internet - 87what are the three main categories of cloud computing?IaaS
PaaS
SaaS
- 88what is a response queue?when a request comes in, it gets put on a queue
when its time comes it will be forwarded to a server - 89advantages to response queuesthey are an indication if you need to scale
- 90what does cloud computing allow for us as system designers?allows us to stop thinking about the physical constraints of hardware
- 91what are the principles of cloud computing?Scalablity
Disposable resources
Automation
Loose coupling
No single point of failure
Services
Architect for cost - 92what does the principle scalability mean here?Growth
1. more boxes - more capacity
2. increase work load on boxes
have to think about the impact of one scaling event on another scaling event
e.g adding more boxes may mean adding more support for the database as well - 93what does disposable resources mean here?everything is removable
build your system with in mind that everything should be destroyed after say an hour - 94what does automation mean here?when should you decide to scale
the infrastructure should do this
i.e. grow as it needs
infrastructure should be all about the code not the hardware - 95what does loos coupling mean here?well defined interfaces between components
everything should be independent
queues help this
enables graceful failure - 96what does services mean here?do you need to spin up a server, or is there already something available to allow you to distribute it
a service that is available
SaaS - 97what does architect for cost mean here?can build the same infrastructure for a lot cheaper if you build for cost
- 98what is a nano-service?a loosely coupled service
e.g. BBC sport live scores box, that sits on some pages - 99what is Push?instead of having a regular service where the client requests content, Push just sends it anyway
- 100what is socket.io?provides real-time bi-directional event-based communciation channel between clients and servers
enables near real-time updates without caching
uses WebSockets where it can - 101responsive web...
- 102what are some differences in devices that can effect a website?Different screen resolutions
Different CPU's
Different hardware all round - 103What is TAL?TV application layer
- 104what are the foundations of a responsive website?Fluid grids
Responsive images
Media queries
Mobile first - 105what are fluid grids?website layouts are fluid and able to change based on the screen size
- 106what are responsive images?image sizes are fluid and able to change based on the grid size
- 107what are media queries?the ability to change layout based on the constraints of the device
- 108what is mobile first?building layout that work for mobiles first, then working up to larger desktops
all devices big and small are accommodated for - 109features of fluid grids?have a maximum width they can span
made up of 12-24 columns
have gutters spacing in between each column
have margins around the entire grid for breathing space in the browser - 110different front-end techniques to create grids?Floats - if you don't know what browser the users are using, use this
Flexbox
CSS grid
- if you know what browser the user is using, use this - 111what is the viewport?users visible area of the webpage
- 112how to implement responsive images?when defining the size of the image in CSS, define the size as a percentage, instead of a fixed size
- 113what is the meaning behind mobile first?the smallest, least powerful devices are the ones we should build our core experiences around and enhance it for everything else
- 114a technique for enabling Mobile First?load different CSS scripts according to device power
e.g. core CSS script and enhanced CSS script - 115what is GEL?Global Experience Language (GEL)
a common design framework and ideas across the BBC
e.g. BBC has loads of different areas, i.e. sport and news
they need to be consistent - 116GELS principles?1. Consider Context
e.g. home or train
2. Accessible content for everyone
3. Separate content from form
i.e. responsive
4. Design minimal first
5. Flexible grid
e.g. ghost columns
6. Responsive grid
7. Apply breakpoints at the limits of a design, not a device
8. behaviours and interactions should be native to touch
9. Design for modularity
e.g. small video on page than can grow to a bigger video located at the top
10. Strive for consistency across resolutions
e.g. going from laptop to mobile, the user should still understand how to use the site - 117HTTP/2...
- 118What is the three way handshake?agree sequence numbers and other connection variables
client initiates
SYN - client creates a random sequence number X, + flags, + options
SYN-ACK - server increments X by 1. creates random Y, + flags, + options
ACK - client increments X and Y by 1
Application data appended - 119what is TCP head of line blocking?Packets are held up by the previous packet
e.g. lost segments hold up all subsequent segments - 120HTTP 1.x performance issues?Poor TCP usage
- 3-way handshake
Drops connections once a response is recieved
Head of line blocking - 121what did HTTP 1.1 introduce to improve TCP?Pipelining
- 122what is pipelining?multiple requests without waiting
responses provided serially in order of requests
- 123disadvantage to pipelining?suffers badly from HOL
- 124what is HTTP parallelism?modern HTTP 1.1 browsers use multiple HTTP session in parallel to improve performance
- 125disadvantage to parallelism?Still effected by HOL
in each session
- 126domain sharding?e.g. the blue lines could represent images
images can be related to a specific domain, cache machine
- 127what is HTTPS?Hypertext Transfer Protocol Secure
adds TLS above TCP - 128features of TLS?Encrypts
Authenticates
Integrity
- data is really what was sent
i.e. it was not tampered with - 129What does TLS use to promote session reuse?Session ID's
Session Tickets - 130what is a session ID?Server stores negotiated TLS session configuration
Server creates a 32 byte session ID and sends to client
Client presents session ID at a later time to resume session
e.g. returning to the bank website a few days later, client can present ID and server can verify and then reconfigure with configuration stored from setup
- 131what is a session ticket?Server encrypts negotiated TLS session configuration as a ticket
Server sends ticket to client
Ticket is stored on client
Client presents ticket later on
- 132what does TLS bring to enable authentication?Certificates
- have a lifetime - 133Aims of HTTP/2?Improve web performance
- more efficient use of network resources
- reduced perception of latency - 134Characteristics of HTTP/2?Better resource usage
Promote uptake
Simplify parsing and permit multiplexing
Protection against pervasive monitoring - 135How does HTTP/2 make better usage fom web resources?One TCP connection per logical web server
- 136How does HTTP/2 promote uptake?Reuse of existing HTTP message semantics
Reuse of http:// and https:// URI schemes - 137How does HTTP/2 simplify parsing and permit multiplexing?Binary framing layer replaces legacy syntax
- 138How does HTTP/2 protect against pervasive monitoring?Optional use of TLS encryption for privacy
- 139what is binary framing?HTTP/2 uses a binary representation for transmitted data
request and response message split into one or more frames
easy and efficient to parse
- 140what are HTTP/2 binary streams?HTTP/2 frames are carried in streams
Logical bi-directional flow
Single request-response exchange
Initiated by client or server
multiple streams can be concurrently active in a connection (multiplexing)
Streams can be handled in any order - 141what is multiplexing?multiplex streams can be concurrently active in a session (multiplexing)
streams can be handled in any order
frames can be interleaved
- 142what is HTTP/2 prioritisation?HTTP/2 relies on the server to deliver the data in an optional way
prioritisation allows the client to hint to the server what it think its optimal
i.e. the best way to do something - 143what is HTTP/2 flow control?flow control ensures that multiplexed streams do not destructively interfere with each other
only effects data frames - 144what is HTTP/2 header compression?each request and response carries headers
headers are repeated everytime
header can be very large, e.g. cookies
and lots of duplication
uses HPACK - 145What is HPACK?method for compressing duplicated data
compressed context per-connection
- 146what is HTTP/2 server push?server can speculate send a client data that in anticipates the client will need
- 147advanatges to push?client wont need to request data
server has already sent it - 148disadvantages to push?wastes bandwidth
- server isn't aware of what client has in cache
- might not be aware of what client is capable of processing, e.g. enhances scripts or core scripts - 149what is adaptive media streaming?encoding a live or on-demand media stream at different qualities
- hence different bitrates
client decides when to switch between the different streams depending on locally measured network performance - 150advantages of Adaptive Media Streaming?avoids buffering
- 151what is MPEG/DASH?Dynamic Streaming over HTTP (DASH)
- 152what is QUIC?Quick UDP Internet Connections
brought up by increased performance in HTTP has highlighted dependencies in TCP - 153Security...
- 154Foundation of web security?Authentication
Authorisation
Availability
Confidentiality
Auditing - 155what do you need to think of when building a web application?User Management Model
Access Management Model
Identity Management Model (IDM) - 156what is meant by authorisation?Permission to a particular end user
e.g. access permissions
resource permissions - 157why is availability a security foundation?availability is the goal of attackers
DoS - 158why is confidentiality a foundation?also referred to as Privacy of Personal Data
its about protecting data
e.g. need a secure encrypted database
and secure access management - 159what do you need to think about with confidentiality?think about the data from the point of input, to the point when the data will be archived or deleted
must prevent access to personal data at rest
how you're going to handle the data in memory
how you're going to handle the data in logging - 160why is auditing a foundation?key to a secure web app
you need to have enough evidence to prove that a customer hasn't ordered 100 items instead of 10 - 161what is ACL?Access Control Lists
To say what access control leaks for each level of the data and how you treat this when build a web application
e.g. what will happen with the data after a user inserts a username and password - 162what is a disadvantage to auditing?it can be a security target
auditing can be a app on its own, so needs to be secure - 163techniques to secure the network layer?Routers
Switches
Firewalls
Network Security Scanner
WAF - 164some tips to secure your host?Patches
- patch holes so attacks cant access again
Don't run services you don't need
Close ports and disable protocols that you don't need - 165what is input validationa technique to secure your app
e.g. parameter handling - 166what is parameter handling?how you handle the input after its entered
e.g. when it goes to memory, when you call another API
e.g. when you have input from a user, e.g. username, handle this parameter and call another API, are you going to sanitise it? Encrypt it? etc - 167what is considered sensitive data?data at rest
data in memory
data in transit - 168what is exception handling?how you fail securely
how do you make sure that when you fail you don't release information - 169how to secure your app?input validation
parameter handling
configuration management
audits and logs
exception handling - 170what is meant by reduce the surface of attack?make sure the surface of attack is small, e.g. don't have all ports open when you don't need them
when the attack is small its easy to handle
when the attack is big its hard to identify where its coming from - 171what is the defence in depth strategy?when you do the segregation of security zones, when you go through a trust boundary to another trust boundary, make sure you do re-validation
e.g. how can we know that the input has come through the DMZ and not a web server that hasn't been validated
- 172what is the least privilege principle?Every account, service, API, user, etc should have the minimal privileges and access rights by default
- 1735 things to remember?Security is a cross functional concern
The foundations of security
Deny by default
i.e. dont trust anyone
i.e. give access when needed
Lock the door
Stay informed - 174what is meant by lock the door?as soon as you want to write important data on the system, think about NTFS laws, who can access this data etc
e.g. can admin access, or no one access? - 175SE....
- 176what is the software development life cycle?
- 177Steps in waterfall development?Start
Decide what you want to build
Design
Build
Test
Release - 178issues with waterfall?inflexible
fixed requirements
testing happens late in the process
users don't see the procedure until the end - 179what is meant by the only constant is change?user behaviour
- what they expect changes
Technology advancements
- broadband
- processing power - 180what is agile software development?building software that accommodates change
- 181what is the agile manifesto?a formal guide for software development, based on 4 key values and 12 principles
- 182what are the 4 key values to the agile manifesto?1. Individuals and interactions - over processes and tools
2. Working software - over comprehensive documentation
3. Customer collaboration - over contract negotiation
4. Responding to change - over following a plan - 183what is a scrum?a team of people working together
a framework for agile development
- agile scrum - 184how does scrum work?decides what the most important piece is to the least important piece
- release small pieces of software frequently - 185what is the MVP?Minimal Viable Product
its the fully functional product that has enough features to satisfy the user key requirements - 186how to use the MVP?Release it, and get feedback form the user to see what is missing or what can be improved
MVP should not be a prototype - 187what are the three scrum roles?Product owner
Scrum master
Team - 188who is the product owner?responsible for the build
manage the product backlog
interface between the customer and the team - 189who is the scrum master?facilitator
not directly involved with the build
Helps the team, reduces impediments
ensures scrum principles are followed - 190who are the team?software engineers
testers
designers
etc - 191what is the product backlog?lists of epics, tasks and bugs
prioritised (most to least)
estimated (time)
based on user stories - 192what are user stories?a way to use some framework around how we describe a piece of work what we want to do
- 193syntax to user stories?As a I want so that
- 194what should a good user story be: (INVEST)Independent
Negotiable
Valuable
Estimable
Small
Testable - 195who are the three amigos?Tester
Developer
Product Owner - 196what communication is the best form?face-to-face
- 197what do the three amigos do?take a product from the backlog
meeting
agree how its going to be tested
helps create a common understanding of whats going on
helps make sprint planning - 198what is sprint planning?a process ran as a team
tickets are estimated
sprint goal agreed
top priority tickets from backlog are taken into next sprint - 199what is a sprint?when the work is done
usually 2 weeks at the BBC
three amigos which is prep for next sprint - 200what is the sprint review?show casing and demoing the work done in the sprint
get feedback for stakeholders
whole scrum team
suggested improvements
Information
- Description
- Flashcards on 306 - Internet applications engineering, created by Lewis Stones on 26/03/2018.
- Created by
- Lewis Stones
- Views
- 8
- Rating