Basis Lab

Answers

One question, answered the whole way through, with the arithmetic actually done rather than named. Every one of them ends at the page of a course that carries it further, because an answer you cannot build on is a fact you will look up again next month.

300 questions so far, page 6 of 6

Where the data lives

6 to 24 of 24
  1. Why does my count come out doubled after the job restarts?Your count doubled because the restart replayed events the saved counter already held: the state and input position were not saved as one snapshot.
  2. How does the database estimate how many rows a WHERE clause will return?It does not scan the table: it uses stored summary statistics to turn each filter into a fraction of rows and multiplies the fractions.
  3. Why doesn't 0.1 plus 0.2 come out as 0.3?A tenth cannot be stored exactly in binary, so the two stored values are already slightly wrong before they are added.
  4. Why can't a hash index handle a range query like created_at > '2024-01-01'?A hash index finds only exact keys: it scrambles key order to pick a bucket, so there is no way to seek to the start of a range and walk forward.
  5. Why can't I just average the old average with the new number to get a running average?Averaging the old average with the new number gives that single new value half the weight, when it deserves one share out of however many values came before.
  6. Why is it actually bad to store the same value in two different tables?Because once two copies disagree, nothing in the database says which one is correct, and fixing it needs information you no longer have.
  7. How does a B-tree find one row among millions in just a few reads?A B-tree finds a row by reading only a few pages: each page holds hundreds of pointers, so the tree stays three or four levels deep.
  8. Should I use a sliding window or a fixed window?Use a fixed window when the question names a period that must add up, and a sliding one when it asks about the recent past as of now. Questions about episodes want neither.
  9. How can I prove nothing was lost without comparing every single row?Sample a few thousand rows drawn from the source, look each one up in the destination, and add one total row count. That proves loss and duplication without reading every row.
  10. If SQL is declarative, who decides how the join actually gets run?The database's query planner chooses the join method and order; your SQL only says which rows the answer must contain.
  11. Why does the planner underestimate rows when I filter on two columns that are related?It multiplies the two filter shares as if the columns were unrelated, so when one column already implies the other the estimate comes out far too low.
  12. How do you count unique visitors without remembering every visitor?Turn each visitor identifier into a random-looking code, keep only a small summary of the rarest pattern seen, and scale it up; repeats change nothing and memory stays fixed.
  13. How does a streaming system know when a window is finished?It cannot know. It guesses: it takes the latest event time it has seen, subtracts an allowance you choose, and treats every window ending before that point as finished.
  14. Why does the order I join tables in matter if joins are commutative?The final result is the same, but the rows carried between joins are not, and that is what the work is paid on.
  15. Will refreshing statistics fix a bad query plan?Only if the summary was taken before the data changed; otherwise refreshing re-measures the same assumptions and the plan stays wrong.
  16. Why is a log-structured store faster for writes than a B-tree?Because a B-tree finds a page and then rewrites it in place for every insert, while a log-structured store only appends, and appending in order is far cheaper than jumping about the disk.
  17. What does it mean for an index to cover a query?A covering index holds every column a query needs, so the database can answer from the index without reading the table row.
  18. Why does inserting a single row sometimes cost many page writes?A row insert usually writes one page, but when the target page is full it splits in half and the split can climb to the root, so rare inserts write several pages for each index.
  19. Why do new rows show up when I run the same query twice inside one transaction?The transaction is not holding one fixed set of rows: a later run of the same range query can see rows another transaction inserted and committed in between.

The network and the web

20 answers
  1. Where should a session ID be stored so JavaScript can't read it?Store it in an HttpOnly cookie set by the server; that is the only browser storage JavaScript running on the page cannot read.
  2. What does it mean for an API method to be safe?A safe method is one that changes nothing on the server when it is called, so a caller may repeat it freely and a cache or a crawler may use it without anything being altered.
  3. Does signing out actually invalidate my token on the server?No. Signing out clears your browser's copy of the token, but the server keeps accepting that token until it expires.
  4. Why does the TLS handshake take so many round trips before any data is sent?It is not one key exchange. The handshake agrees a secret, proves the server's identity and checks for tampering, and modern TLS fits those into one round trip; a fresh connection still needs three before the page starts.
  5. If a website has HTTPS, can someone on the same Wi-Fi read my password?No. HTTPS encrypts the form contents and cookies, so someone on the same Wi-Fi cannot read the password itself; they can still see the site, timing and packet sizes.
  6. Why does a DNS lookup sometimes have to ask several servers before it gets an answer?Because when no cache already holds the address, the resolver has to ask one server at a time down the hierarchy, and each reply only tells it who to ask next.
  7. How can another site make a request as me if it can't read my cookies?A foreign page does not need to read your cookie. It makes your browser send a request to the site that owns the cookie, and the browser attaches the cookie automatically.
  8. Why does opening a connection take three messages instead of two?Three messages are needed because the server must also learn that its own reply arrived; the third message is that proof, not a formality.
  9. How can two computers agree on a secret key when anyone can listen?Each computer sends a scrambled number made from a private number; the shared key is made by scrambling the other computer's number with one's own private number, and a listener cannot unscramble it.
  10. What's wrong with naming an API endpoint after an action like /getUser?Naming an endpoint after an action bakes one operation into its address, so every new operation needs a new endpoint and the thing being acted on never gets a stable name.
  11. Why isn't a password plus a security question really two-factor authentication?A security question is another thing you know, so it is the same kind of proof as a password, not a second kind.
  12. How does a man-in-the-middle attack still work if the key exchange is secure?A key exchange proves only that you share a secret with whoever answered. An attacker on the path answers you themselves and opens a second exchange to the real server, so both halves look secure.
  13. How do I design an error response that a client can actually handle?Give every failure a fixed code a program can branch on and say plainly whether trying again could help, then put the human explanation last.
  14. What's the difference between safe and idempotent in HTTP methods?Safe means the call changes nothing; idempotent means repeating the call leaves the same result, even if the first call changed something.
  15. Why do I need an idempotency key if my operation is already idempotent?You need the key because repeating an operation safely still leaves the caller unsure what happened, and the key returns the first answer.
  16. What does a CDN actually change about my request?A CDN puts a machine near the reader that answers the request itself, so your origin often never sees it and the address it logs is not the reader's.
  17. Does HTTPS hide the domain name of the site I'm visiting from my ISP?Usually not: the site's name is sent in readable form twice, once when your computer looks up its address and once when the secure connection opens.
  18. Why does a <script> tag stop the rest of the page from being parsed?A script tag stops the parser because the script can change the page being built, so the browser must fetch and run it before it knows what comes next.
  19. Why is animating width so much slower than animating transform?Animating width is slower because each change forces layout and repaint, while a transform on a promoted element skips both and only reassembles the frame.
  20. Why does a download start slow and then speed up?The sender starts with about fourteen kilobytes in flight and doubles that each round trip until something is lost, so the opening round trips measure the path rather than move data.

Keeping it safe

11 answers
  1. How does text I saved in a comment end up running as JavaScript in someone else's browser?The comment stayed text in storage; a page that later pasted it into its own markup made the browser read it as code.
  2. Why does escaping the quotes in user input not stop SQL injection?Escaping quotes only cleans one context; SQL injection stops only when query text and values travel separately, so the value is never parsed as code.
  3. Why isn't encrypting the password enough to keep it safe if the database leaks?Because encryption can be undone by your own login code, so the key that lets you check a password usually sits near the database, and anyone who copies both can read every password.
  4. How do I stop one service from reading another service's password?Give every service its own identity, grant only the credentials it uses, and test that it cannot read another service's password.
  5. Is it actually OK to look at a risk and decide not to fix it?Yes, if the decision not to fix it is written down with a reason, a named owner and a date or trigger for looking again; otherwise it is just an oversight.
  6. Why does storing a random salt with each hash stop rainbow tables?Because the salt is different for every account, a table built once from common passwords matches at most one row, so the work has to be redone account by account.
  7. Isn't threat modelling just brainstorming what could go wrong?No. It is a fixed checklist of six questions asked at every boundary, which gives a list with a known shape and a record of what was examined.
  8. Are environment variables safe for storing passwords?No: environment variables are convenient, but they are inherited by child processes, visible to process inspection and crash reports, and no record is kept when a password is read from them.
  9. Is a TLS certificate itself a secret?No. The certificate is public and is sent to every client that connects. The private key kept beside it is the secret, and it is one of the highest value credentials you hold.
  10. How do I pick the iteration count or cost factor for password hashing?Pick a time budget for one login, measure what setting meets it on your own hardware under load, and store that setting in each stored record.
  11. How fast can an attacker guess passwords after stealing a hash database?About ten thousand million guesses a second on one rented graphics card against a fast hash, so most of a stolen table falls in under a second.

If you want the whole thing

Behind every answer here is a course that works through its subject from the beginning, with problems under each idea and a reason rather than a tick when one is marked. An answer settles the question you came with; the course is what makes the next one easier.

The libraryAsk for a course