Cascading Style Sheets in HTML

What is CSS and Why Cascading?

CSS is an old but gold technology, where styles can be defined in a central style sheet and used across multiple web pages. Cascading refers to the hierarchical logic implicit in the style sheet. A style applied to a parent element will also apply to all child elements of the parent.  For example, if body text of a paragraph is blue, any other elements in that paragraph also inherit blue unless explicitly overriden.

Alternatives to Separate Style Sheet (Inline CSS using style attribute)

A separate style sheet file is the preferred option for maintainability. However there are other ways of using CSS within a specific file. For example, an inline CSS can be used to apply a unique style to a single HTML element, using the style attribute.

<h1 style="color:blue;">Blue heading</h1>

<p style="color:red;">Red paragraph</p>

ssh -T

Recap on ssh, what it is and why it exists

Mastering ssh is essential to connecting into remote servers.

ssh is used to connect to a remote server using the syntax:

ssh [username]@[hostname or IP address]

Explanation of -T flag, and why it makes sense for testing GitHub logins

When you do:

ssh -T 

it means do not allocate a terminal (TTY), so you are asking to connect, but without the interactive shell. 

Connecting to some external services like GitHub operate in such a way that they do not provide shell access. You can still check/test SSH authentication:

ssh -T git@github.com

GitHub should respond with text like:

Hi your_username!  You've successfully authenticated, but GitHub does not provide shell access.

This proves your SSH key was accepted , GitHub recognised your account, future Git operations over SSH should work.

Some Technical Notes on TCP Ports for ssh

Technical note 1: Port 22 is the default TCP port used by SSH for encrypted remote login, command execution and file transfer, as registered by IANA and used by all major SSH implementations.

Technical note 2: IANA - Internet Assigned Numbers Authority

Design Patterns in the Cloud

There are a number of design patterns that have emerged and evolved in cloud computing. Microsoft Learn covers off quite a few of those.

Among the common ones you should know are Ambassador, Circuit Breaker, CQRS, Idempotent Consumer, Sharding and Sidecar.

The CQRS Pattern

CQRS aims to overcome certain challenges with implementing CRUD operations (the typical database operation: create, read, update and destroy).  It stands for Command Query Responsibility Segregration. 

Write operations are abstracted into Commands

Read operations are abstracted into Queries

The idea is, as applications scale, read and write operations often have different performance and scaling requirements. Traditional CRUD architectures do not take this asymmetry into account, which can result in challenges - such as:

Data mismatch - read and write representations of data often differ. Some fields needed during updates may be unnecessary during reads.

Lock contention - parallel operations on the same data set can cause lock contention.

Performance problems - the traditional approach can negatively impact performance due to load on the data store and the data access layer and the complexity of queries needed to retrieve information.

Security challenges - can be difficult to manage security when entities are subject to read and write operations.

Sidecar Pattern

Sidecar Pattern: Introduction

The sidecar pattern is a bit like "aspects" in aspect-oriented programming.  

So your primary application with core functionality runs in its own bubble, and your "sidecar" deals with peripheral tasks (like logging, performance measurement, proxying to remote services). 

Sidecars can be written in a different language to the primary application. 

The most common implementation of this pattern is in containers, where you have sidecar containers, also known as sidekick containers.

Sidecars in Kubernetes

Sidecars in Kubernetes are secondary containers that run along with the main application container within the same pod. These containers enhance or extend the functionality of the primary app container providing services like logging, monitoring, security or data synchronization without altering the main app code.

They can be started and stopped independently of the main container.

Further details, including notes on sidecars and pod lifecycle, can be found on the kubernetes docs website.

MSIX Architecture

For deploying applications to the Microsoft Store, the MSIX format is something you need to very familiar with. It is the wildly successful successor to the MSI format.

Start by reading the Overview on Microsoft Learn.  

For additional background you can read the Microsoft guide to packaging and deployment for Windows Applications. The latter will recommend Microsoft Store as the recommended distribution path for most developers.  Other avenues will require additional certificate signing obligations (and concomitant costs).

One of the first concepts the would-be MSIX master must learn is that of package identity. When your app is packaged as MSIX, Windows assigns an identity to it based on manifest information such as name, publisher, version, architecture and resource identifier (you find this in the AppManifest.xml).

One of the merits of MSIX usage is reliable install and uninstall. On the uninstall piece, it guarantees no leftover files or registry entries. On the install piece, it has a reported 99.96% install success rate.

Containerized execution is one of the more interesting aspects of MSIX. Apps run in a lightweight container with virtual file system and registry. An overview is here.

The Azure Tenant Concept

An Azure tenant is the security and identity boundary for an organization within Azure.

In AWS the Azure notion of tenant broadly corresponds to an AWS organization. 

Within the tenant you have subscriptions. You may bifurcate your subscriptions into production and non-production.

Tenants are endowed with a unique Tenant ID, a globally unique GUID that identifies your tenant across Microsoft services.

Set up Artifact Signing Quickly

 Quickstart: Set up Artifact Signing | Microsoft Learn

Useful Azure Shell Commands

 az account list --output table

will give you a list of subscriptions (the table command line flag tells the shell to convert scraggly-looking JSON to a smarter-looking tabular format).  Subscriptions will display their name, cloud name (e.g. AzureCloud), Subscription ID, Tenant ID, State (Enabled?) and the IsDefault flag.

Copilot Integrated into Azure (Portal)

Copilot is integrated into the Azure portal, and sports a number of agents to help you. 

For example, the Troubleshooting agent exists to help you diagnose problems. To some extent, having a natural language interface may appear liberating, but technical language is still required to operate/co-operate with the agent, for example providing context around Azure resources, resource groups or subscriptions. Azure VMs and Azure VM scalesets (VMSS) are supported.

Stacked PRs - Was Ist Das?

A crazy concept from GH fully detailed here.

Cloudflare on RAG - Hello AutoRAG

This came out in April 2025. Create an AutoRAG instance and point it at a storage location like R2. Simples. Don't craft RAG yourself.

ss (socket statistics) versus netstat

netstat is used in Windows with roots in Unix. In the Linux world, ss is more used than netstat.

ss displays "socket statistics" and is used to "dump socket statistics" as per its description. 

Unlike netstat, ss talks to the Linux kernel directly. 

Used without arguments, ss displays non-listening connections - so an nginx server simply listening for connections would not appear in the output, but an established connection (TCP for example) would appear.

To display listening connections also, do ss -l.

ss -lt
ss -lu

Restricts output to TCP and UDP connections.

Please note: using ss in a WSL shell will only give you the connections relating to the shell and not the wider Windows system in which the shell is running. 

You will still need netstat from a cmd.exe to see the networking connections in Windows. Note that WSL1 shared more of the Windows networking stack than WSL2.

The Markdown Guide

Here is the Markdown Guide, explaining why Markdown is popular. 

Markdown was created by John Gruber in 2004.

openssl rand

openssl rand is an OpenSSL command that generates cryptographically secure random bytes using the library's CSPRNG (cyptographically secure pseudorandom number generator) with options for raw, hex or Base64 output.

Example usage:

openssl rand -hex 16

openssl rand -base64 16

The number at the end states the number of bytes to generate. 

The GitHub location for OpenSSL can be found here. This also has extensive documentation in Markdown.

Learn more about OpenSSL here from the OSSL Guide. An interesting application of OpenSSL's capabilities is implementing systems using QUIC (a modern transport layer protocol built on UDP).

From "process containers" to control groups

The Linux feature of control groups (or cgroups) originated in what was originally called "process containers". cgroups are a Linux kernel feature.

Read the Kubernetes (K8s) Source Code

The Kubernetes source code is available on GitHub.

In addition to reading the source code, it is useful to consider the intellectual origins of K8s in "Borg".

It is often portrayed as the "spiritual" open source successor of Google's Borg, a cluster manager running hundreds of thousands of jobs, across thousands of applications, running on clusters each of tens of thousands of machines.

The Borg paper covers how shortcomings in Borg were addressed in the design of Kubernetes (this is worth understanding/being aware of). There is an overview here from ACM Queue called "Borg, Omega and Kubernetes" (Omega was an offspring of Borg).

(Historical note: Borg in turn was the successor of two internal Google systems, Babysitter and Global Work Queue, both of whose design predated the introduction of Linux control groups).

The Borg paper also mentions the Google Container Enginer (GKE), which is a Google-hosted version of Kubernetes.

What Linux version runs in your WSL shell?

lsb_release -a

LSB modules are components defined by the Linux Standard Base. They specify standard libraries, commands and runtime behaviours - ensuring compatibility across Linux distros. The LSB project is led by the Linux Foundation.

Does Devin Do The Trick

Devin (from Cognition) is billed as the world's first autonomous software agent. But does Devin do the trick? Can it solve some of the thorny problems in agentic programming?

Logos using or trialling Devin include (in banking) Citi, Goldman Sachs, Santander, itau (in tech) openrouter and servicenow, (in media and telco) Fox, AT&T and (in startups) Modal.

Control-Shift-Escape

This is your shortcut to Task Manager. Use it periodically to build intuition about system resource usage.

Protocol Downgrades

Protocol downgrades, also known as downgrade attacks, bidding down attacks and rollback attacks, is when a computer system is coaxed into abandoning a high quality mode of operation in favour of a lower quality mode of operation.

A historical example was a flaw in OpenSSL that enabled an attacker to use a lower version of TLS between client and server.

What is HSTS?

HSTS is HTTP Strict Transport Security. This is a web security policy defined under RFC6797 forcing browsers to use HTTPS only. This protects users from attacks like protocol-downgrade and cookie hijacking.

Internet Gateways (IGWs) In Depth

All WinJoes know what an internet gateway is. Many affectionally refer to these as IGWs. But few know what these gateways do in amazing depth.

We aim to bridge that gap and confer, dare we say it, in-depth knowledge. We educate the new generation of "gateway gurus", or "IGW gurus".

So one question for you - NAT. How do IGWs interact with NATs - if at all? Does this differ in AWS versus other clouds? Exercise for the reader.

Subnets are Routing Boundaries not Security Boundaries

AWS, as well as other cloud providers, use subnets to partition virtual networks (e.g. in AWS VPC - Virtual Private Cloud).  

These subnets divide up the IP address space into separate compartments for routing traffic.

In AWS, another way of saying this is "each subnet is a slice of your VPC's CIDR block".

Each subnet block in AWS is tied to a particular AZ, or Availability Zone. Subnets cannot span AZs and this preserves the availability pattern (e.g. one private subnet per AZ).

There are many types of subnet in AWS.  Examples are:

• Public subnet - subnet has a direct route to an internet gateway. Resources in the public subnet can access the public internet.
• Private subnet - subnet has NO direct route to an internet gateway. Resources in the subnet require a NAT device to access the public internet
• VPN-only subnet - the subnet has a route to a Site-to-Site VPN connection through virtual private gateway. The subnet has no route to an internet gateway
• Isolated subnet - not connected to the internet - in fact, no routes to destination outside its VPC
• EVS subnet - a type of subnet created by Amazon EVS (very specific to VMware)

(Sidebar: internet gateway - bridge ("network bridge","network component")  between private network and the internet,enabling traffic routing, protocol translation, NAT, DHCP and security filtering)

Choosing Network Size in AWS - Forward Slash Notation

Network size (in terms of IP address ranges) in AWS is specified using CIDR notation. 

(Sidenote: CIDR stands for classless interdomain routing, which replaced the now obsolete classful networking architecture which prevailed from 1981 to 1993, when CIDR was introduced.  If you are interested in the classful system have a look at RFC 791 which covers IP and describe the class system).

Example:

192.162.1.0/24

The forward slash 24 means the first 24 bits are fixed.  The rest (i.e. last 8 bits) are flexible.

From the AWS documentation: 

"When working with networks in the AWS Cloud, you choose your network size by using CIDR notation. In AWS, the smallest IP range you can have is /28, which provides 16 IP addresses (2^4). The largest IP range you can have is a /16, which provides 65,536 IP addresses (2^16)."

AWS Global Infrastructure and Services

AWS Regions and Availability Zones

AWS Service Endpoints

AWS Services by Region

Python secrets module

The secrets module in Python is used to generate cryptographically strong random numbers.

This should be used in preference to the random module, for modeling and simulation, not cryptography.

The background -

Random numbers are used in cryptographic applications e.g. in key generation, initialization vectors and nonces, and salts in certain signature schemes.

One-time pads also require a truly random source.

Hennessy and Patterson - The "HP" Book

You know if you know.

The "HP Book's" Take on Parallel Processing

Parallelism at multiple levels is a driving force of computer design.  

Belief in that driving force, in pushing it forward, in harnessing it for the progress of humanity - is essential for the computer-oriented changemaker.

Fundamentally applications have two types of parallelism - the data-level and the task-level. Data-level parallelism is what makes GPUs so powerful.

Computer Architecture: A Quantitative Approach

Computer Architecture: A Quantitative Approach is a constantly-updated "classic" of computer science. 

It is written by authors John Hennessy and David Patterson.  It is thus sometimes referred to in certain circles as the "HP book".

John Hennessy developed one of the first commercial RISC microprocessors. He received the Eckert-Mauchly award (IEEE Computer Society) in 2001 for contribution to RISC processors.

David Patterson has been teaching computer architecture at UC Berkeley since 1977 and has received a Distinguished Teaching Award from the University of California.

One of the reviews of the 5th Edition (published in 2012) praise its:

           "revised chapter on data-level parallelism, which demystifies GPU architectures".

James Hamilton of Amazon Web Services (Distinguished Engineer) compares the book to a "fine wine".

Making Programs Fast on Modern CPUs

A great GitHub resource on "making programs fast on modern CPUs".

HTTP 429

When a client request exceeds the number of requests allowed in a certain time frame.