💻 Stuff Every Technology Expert Should Know: Training Guide

Bits, Bytes, and Binary Prefixes

A single bit can be 0 or 1. With 8 bits, the number of possible patterns is 2 to the 8th, which is 256. An unsigned 8-bit integer uses those patterns for the values 0 through 255, so 255 is not the highest pattern count.

The prefix kilo usually means 1,000, but in computing a kibibyte (KiB) means 2 to the 10th bytes, or 1,024 bytes. Larger binary prefixes follow the same idea: a mebibyte (MiB) is 2 to the 20th bytes.

Text Encodings

A hexadecimal digit has 16 possible symbols, so it represents exactly 4 bits. One byte of 8 bits therefore fits into two hex characters, like FF for the number 255.

Base64 encoding takes 24 bits at a time, which is 3 bytes, and splits them into four 6-bit groups. Each group becomes one of 64 printable characters, so 3 bytes become 4 text characters. The equals sign at the end is padding.

Standard ASCII uses 7 bits per character, giving 128 codes. It is usually stored in an 8-bit byte with the top bit set to 0.

UTF-8 is a variable length Unicode encoding. One Unicode scalar value takes 1 to 4 bytes; common English letters take 1 byte. Plain ASCII text is also valid UTF-8 because UTF-8 preserves the one-byte ASCII values.

Unicode allows code points up to U+10FFFF. U+FEFF is a zero width no-break space that is sometimes used as a byte order mark at the start of a text file.

Integers and Floating Point

Nearly all computers store negative whole numbers in two's complement. This system has only one zero and allows the same adder circuit to handle both addition and subtraction.

In two's complement, an 8-bit signed integer ranges from -128 to 127. Zero takes one of the non-negative slots, so the positive side is one short.

Computers store floating point numbers as binary fractions. Just as 1/3 never ends in decimal, 1/10 never ends in binary, so 0.1 cannot be stored exactly. This is why Python reports 0.1 + 0.2 == 0.3 as false.

A standard 64-bit double has 53 bits of precision. Integers above 2 to the 53rd can no longer all be stored exactly. When exact equality is not needed, compare floating point results within a small tolerance, like Python's math.isclose().

Processor Trends

Moore's law observes that the number of transistors on a chip doubles about every two years with minimal rise in cost. It is about transistor count, not clock speed.

Around 2004, Dennard scaling ended, so raising clock speeds used far too much power. Chipmakers shifted to putting several slower cores on one chip instead of one very fast core.

Intel Hyper-Threading lets one physical core appear as two logical processors. The two logical processors share one core's execution resources.

A phone chip that mixes fast, power-hungry cores with slow, efficient ones has a heterogeneous design. Light tasks can run on efficient cores to save battery, while heavy tasks wake the fast cores.

A GPU spends more of its transistors on data processing units than a CPU does. It runs many simple math operations in parallel, suited to doing the same work on lots of data.

Memory Hierarchy

DRAM stores each bit as charge on a tiny capacitor. The charge leaks away, so built-in circuits refresh every cell every few milliseconds. This is the dynamic in dynamic RAM.

SRAM is fast and needs no refresh, but each bit needs four to six transistors. A DRAM bit uses one transistor and one capacitor, so DRAM packs far more bits into the same area.

On a cache miss, a modern CPU pulls in a whole 64-byte block from memory. That block is called a cache line and can hold sixteen 4-byte integers.

CPUs stack cache levels: L1 is small and fast, then L2, then L3. A miss in one level checks the next before going to slow main memory.

Locality and Volatility

Temporal locality means reusing the same data again soon, so it stays in cache. Spatial locality means using data stored next to what you just used, like walking through an array. Good locality gives more cache hits.

SRAM cache and DRAM main memory are volatile, so they lose contents when power is off. SSDs and hard drives are non-volatile and keep data without power. Unsaved work disappears in a power cut because it lives only in volatile memory.

Storage Media

A hard disk drive is much slower than RAM or an SSD because it uses mechanical movement. The read/write head must swing to the right track and wait for the platter to spin to the right spot.

Flash memory cells wear out after many writes. An SSD stretches its life by spreading writes evenly across all cells through its translation layer, rather than wearing out one location early.

Overwriting a file with zeros is not reliable on an SSD because old copies can remain in unmapped flash. NIST recommends media-specific sanitize methods that bypass normal read and write abstractions.

Operating System Core

The operating system kernel is the core program that is always running. It manages memory, schedules processes, and talks to hardware through drivers. Apps ask the kernel for services through system calls.

In Windows, user-mode apps each get a private address space, so one crash stays contained. All kernel-mode code shares one address space with the OS, so a bad kernel driver can crash the entire operating system.

With virtual memory, every memory access needs an address translation. The CPU's translation lookaside buffer, or TLB, stores recent virtual to physical address translations so it can skip extra trips to main memory.

The kernel keeps page tables that map each virtual page a program uses to a physical page frame. Virtual memory also allows demand paging, so only the parts of a program actually needed are kept in RAM.

File Systems and Boot

On Linux ext4, an inode stores a file's metadata like size, owner, time stamps, and block locations. The file's name is stored in the directory entry, which maps names to inode numbers. This lets one file have several names through hard links.

FAT32 stores file sizes in 32 bits, so no single file can reach 4 GiB. A 6 GB video will not copy to a FAT32 USB stick even if there is plenty of free space. exFAT or NTFS removes that limit.

A classic MBR partition table holds only four partition entries. The newer GPT scheme drops that limit, and Windows allows 128 GPT partitions.

With UEFI Secure Boot turned on, the firmware checks each boot component's digital signature against trust databases. Trusted software can run, while untrusted or revoked software is blocked before the operating system loads.

Virtualization and Containers

A bare metal hypervisor, also called type 1, runs directly on hardware without a host operating system beneath it. A hosted hypervisor runs on top of a host OS.

A virtual machine includes a guest operating system with its own kernel. A container is an isolated process with needed files, but it uses the host's kernel, which reduces overhead.

Cloud Service Models

Infrastructure as a Service, or IaaS, provides fundamental resources like processing, storage, and networks. The consumer can install operating systems and applications while the provider manages the underlying infrastructure.

Platform as a Service, or PaaS, lets a consumer deploy applications using provider-supported tools. The provider manages the servers, operating systems, storage, and network, while the consumer controls deployed applications and some settings.

Software as a Service, or SaaS, gives consumers access to applications running on the provider's cloud. The provider manages the network, servers, operating systems, and storage. A web browser is a common access method.

Data centers use redundant power and network systems so service can continue through component failures. They also control temperature and humidity to protect equipment.

From Source to Running Program

When a C program is spread over several source files, the linker joins the object files and needed libraries into one executable. An undefined reference commonly appears during linking when no object file or library supplies a required symbol.

CPython compiles Python source code into bytecode, an internal set of instructions. Its virtual machine executes that bytecode. Cached .pyc files can let later runs skip recompilation.

Java source is compiled into class files containing JVM bytecode. The Java Virtual Machine knows only that binary format, not the Java language itself, so other languages like Kotlin can also run on the JVM.

ARM processors use RISC, a reduced instruction set architecture. RISC favors simpler decoding than CISC, which can help deliver strong performance per watt in battery-powered devices.

Availability, Redundancy, and Failover

Availability describes how much time a service is expected to work. A 99.9% monthly availability target leaves a 0.1% down fraction. For a 30-day month, that works out to about 43.2 minutes of downtime. A target of 99.99% (four nines) allows about 4.3 minutes, and 99.999% (five nines) allows about 26 seconds.

Redundancy means keeping spare parts or replicas so one failure does not stop the whole service. The goal is to remove single points of failure. A redundant replica must avoid shared dependencies that would fail together. Redundancy can be as small as a spare part or as large as a full copy of an application stack.

Failover is the action that moves work to a healthy resource after a failure. Redundancy only provides the spare capacity. Health checks and traffic switching are part of the design. A database replica may need to be promoted before it can accept primary writes.

Models and IP

IP treats each datagram as an independent unit. It does not require one packet's handling to depend on an earlier packet, so higher layers handle ordering and reliability when needed.

The Internet protocol suite is commonly described as four layers: application, transport, internet, and link. Each layer offers services to the layer above and relies on the one below.

The OSI reference model divides network communication into seven layers, from physical at Layer 1 to application at Layer 7. It gives engineers a shared vocabulary for locating functions and problems.

An IPv4 address is 32 bits long, made of four octets. A 32-bit field has 4,294,967,296 possible bit patterns.

IANA made its final recovered-pool IPv4 allocations in 2019, which effectively exhausted its allocatable space. IPv4 did not switch off, but the central pool of fresh allocations ended.

Addressing and Translation

RFC 1918 reserves 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 for private internets. Different organizations may reuse these addresses because they are not globally unique.

Network Address Port Translation, or NAPT, lets many private hosts share one public address. It rewrites both an address and a TCP or UDP port so return traffic can be matched to the correct internal connection.

Ethernet most commonly identifies interfaces with a 48-bit MAC address. That identifier operates at the link layer, unlike an IP address at internet layer.

DHCP confirms a client's configuration parameters with a DHCPACK message. A DHCP address is normally leased for a period, not permanently owned.

Name Resolution and Transport

A DNS resolver may receive a referral to another name server when the first server lacks the final answer. Following referrals one server at a time is called iterative resolution.

A DNS record's time to live, or TTL, controls how long it may stay cached, measured in seconds. After the TTL expires, a cache should discard the record instead of treating it as current.

DNS uses port 53 for both UDP and TCP. Standard queries commonly use UDP for low overhead, while TCP is used when reliable stream transport is required.

TCP presents a reliable in-order byte stream to applications. It numbers, acknowledges, and retransmits data, so an application does not see packet boundaries.

UDP sends self-contained datagrams and does not guarantee delivery or duplicate protection. Unlike TCP's byte stream, UDP preserves message boundaries.

HTTP and Web Protocols

HTTP uses TCP port 80 by default when a URI does not specify a port. SSH normally listens on port 22, while DNS uses port 53.

The HTTP GET method requests a current representation of a resource. A successful GET response usually carries that representation in its content.

The HTTP POST method asks the target resource to process the enclosed representation according to its own rules. POST is not defined as a safe method.

An HTTP 301 status code indicates that the target resource has a permanent new URI. The response normally supplies the new URI in a Location header.

An HTTP status code starting with 5, like 500, means the server failed on a valid-looking request. A 201 Created means a request made a new resource, a common reply to a successful POST.

TLS, Certificates, and Network Performance

TLS is designed to resist eavesdropping, tampering, and message forgery during communication. Its handshake establishes keys and authenticates at least the server in typical HTTPS use.

A TLS 1.3 key exchange establishes shared secrets and traffic keys. Derived traffic keys then protect handshake records and application data.

A public-key certificate binds together a public key and a subject. A trusted certificate authority digitally signs the certificate to assert that binding.

Network bandwidth is the maximum theoretical transfer rate, usually measured in bits per second. Latency is the time data takes to travel, commonly in milliseconds. Throughput is the actual amount of data successfully transmitted over time.

Network Diagnostics and Infrastructure

Ping uses ICMP Echo Request and Echo Reply. The Echo Reply returns the data carried in the Echo Request, and the round-trip timing can reveal reachability and delay. Filtering can prevent replies.

The 2.4 GHz Wi-Fi band typically travels farther than 5 GHz because lower frequency waves generally experience less path loss. Actual coverage depends on power, antennas, walls, and interference.

Wi-Fi 6E is Wi-Fi 6 technology extended into the 6 GHz band. Only 6 GHz capable devices can use that band, so older, slower devices do not crowd it. Wi-Fi 7 can also use 6 GHz plus 2.4 and 5 GHz.

A router forwards packets between networks by examining network-layer addressing. Its forwarding table maps destination prefixes to next hops or outgoing interfaces.

An Ethernet switch dynamically learns addresses from each received frame's source MAC and associates that MAC with the incoming port. If a destination is unknown, the switch can flood the frame.

A CDN serves cached content from edge locations to serve content closer to users. When content is absent from an edge cache, the CDN may fetch it from an origin server.

BGP is an inter-Autonomous System routing protocol. It exchanges reachability information between autonomous systems so each can apply policy when selecting routes.

Fiber-optic cabling uses light through glass or plastic, so it is less susceptible to electromagnetic interference than copper. Fiber also commonly supports greater bandwidth and longer distances.

Web APIs and Browser Performance

JSON has four simple types: string, number, boolean, and null, plus object and array containers. It has no date type, so dates are usually sent as strings.

REST APIs are stateless: each request must carry all the information needed to understand it, such as a login token. The server does not remember earlier requests between calls.

GET, HEAD, OPTIONS and TRACE are safe and idempotent. PUT and DELETE are idempotent, but POST is not: repeating the same POST can create duplicates.

Frontend code runs in the browser and shapes how a page looks and acts. Backend code runs on the web server, checks requests, reads databases, and chooses what to send back.

After DNS finds the server's IP address, the browser opens a TCP connection with a three-way handshake: SYN, SYN-ACK, ACK. For HTTPS, a TLS handshake follows to agree on encryption and verify the server.

A classic script without async or defer pauses HTML parsing while it is fetched and executed. The critical rendering path builds the DOM and CSSOM, makes the render tree, runs layout, then paints.

Cache-Control: no-cache stores the response but forces a revalidation with the server before reuse. If the cached ETag matches, the server replies 304 Not Modified and the browser reuses the cached copy.

Data Structures and Algorithms

Looking up a key in a hash table like a Python dict usually takes O(1) average time. A hash function turns the key into a slot number, so the table jumps right to the item. A bad collision pattern can make the worst case O(n).

Python lists store slots side by side, so adding at the front forces every other item to shift one spot, which is O(n). Appending at the end is usually fast and amortized O(1). collections.deque is built for fast adds at both ends.

A stack is last-in, first-out: the most recently added item comes off first. A queue is first-in, first-out. Function calls live on a call stack, so the last function called is the first to finish.

Stable sorting keeps items with equal keys in their original order. Python's sorted() and list.sort() are stable and use Timsort, which takes advantage of order already in the data.

Python has a recursion limit to stop runaway recursion from crashing the interpreter. Every function call uses a frame of stack memory, so infinite recursion would overflow the stack. You can read or change the limit but too high can crash.

Git and Version Control

Git thinks of project history as a series of snapshots of the whole project. At each commit, it records tracked files and reuses unchanged files by reference.

Git names stored objects with a cryptographic hash. Traditional repositories use 40 hex SHA-1 digits, while SHA-256 repositories use 64. Git accepts an abbreviated ID only if the prefix is unique.

A Git branch is a movable pointer to one commit. When you commit on that branch, the pointer moves forward, so branching is nearly instant. HEAD points to the current branch.

Git does a fast-forward merge when there is no divergent work to combine. It simply moves the branch pointer forward to the newer commit. If both branches have new commits, Git uses a three-way merge with their common ancestor.

The staging area, also called the index, stores what will go into your next commit. Files move through modified, staged, and committed states. Staging lets you commit only some changes.

git bisect binary searches commits to find which one introduced a bug. You mark one commit good and one bad, and it checks out the middle one, halving the range each time.

The MIT License lets almost anyone reuse code. Its main condition is to keep the original copyright and license notice in all copies or substantial portions. It is permissive, not copyleft.

Databases and Query Languages

A primary key enforces uniqueness and not null for a table's rows. A foreign key can reference a primary key or another unique key to maintain referential integrity.

Database indexes speed up searches like a book index, but they add overhead to every insert, update, and delete. Adding indexes everywhere can backfire.

A transaction bundles multiple steps into one all-or-nothing operation. A bank transfer needs a transaction so both debit and credit happen, or neither does. ROLLBACK cancels everything if something goes wrong.

Durability in ACID promises that committed changes survive a system failure or crash. Isolation means a transaction's changes stay invisible to other transactions until it commits.

NoSQL databases often use flexible, non-tabular schemas, unlike relational tables with defined columns. Document, key-value, and graph are three NoSQL data models.

SQL is declarative: you describe the result you want, and the database engine decides whether to scan or use an index and in what order. Procedural languages specify exact steps.

A pure function has no side effects and its output depends only on input. The same input always gives the same output, making it easy to test and safe to run in parallel. Python supports procedural, object-oriented, and functional styles.

Testing, Debugging, and History

Unit tests check one module in isolation, while integration tests check modules combined. Running all tests after every change is regression testing and catches old bugs that sneak back.

When hunting a bug, first find a small, repeatable case that triggers it. Then study the data, form a hypothesis, test it, and repeat. Explaining code out loud line by line to an object is called rubber-duck debugging.

The Y2K problem happened because programmers stored years as two digits to save memory, assuming the century was 19. When 2000 arrived, 00 could look like 1900, breaking date math.

Security Goals and Access Control

The CIA triad names three security goals: confidentiality, integrity, and availability. Confidentiality limits disclosure, integrity guards against improper change, and availability keeps information reliably accessible.

The principle of least privilege requires giving each entity the minimum system resources and authorizations needed to perform its function. This narrows what a compromised account or faulty process can reach.

Patch management includes identifying, prioritizing, acquiring, installing, and verifying updates. Verification catches failed deployments that still leave systems exposed. Organizations often test patches first because updates can affect availability.

A zero-day attack exploits a previously unknown hardware, firmware, or software vulnerability. Existing patches cannot remove a flaw that has not yet been discovered and fixed, so behavior monitoring and isolation can reduce risk.

Passwords, Authentication, and Phishing

Password length is a primary factor in resisting guessing. Adding more unpredictable characters expands the search space. A passphrase can make a password longer while remaining easier to remember.

Current NIST guidance says verifiers should not impose composition rules. Instead, services should compare new passwords against a common-password blocklist, allow password managers, and use rate limiting.

A unique salt is added before hashing each password to separate otherwise identical hashes. NIST requires each salt to be at least 32 bits long and stored with the hash.

bcrypt's work factor controls the cost of each hash. A larger work factor makes every guess slower, including an attacker's guesses, but must remain low enough for legitimate verification.

True multi-factor authentication requires two distinct authentication factors, such as something you know plus something you have. Two passwords are two steps but one factor type.

A WebAuthn passkey resists lookalike sites because it works only for its relying party identifier. A different domain cannot ask the authenticator to use that credential, and the private key stays on the authenticator.

Phishing is social engineering that tries to trick people into disclosing sensitive information through deceptive messages or counterfeit verifiers. Perfect spelling does not make a request genuine.

Malware, Cryptography, and Network Security

A classic virus attaches to host programs and commonly becomes active when a person opens the infected file or runs the infected program. A worm is self-contained and can spread through a network without user action. A Trojan horse pretends to be benign while hiding a malicious purpose.

File-encrypting ransomware encrypts an organization's data and demands payment to restore access. Some operators also steal data and threaten disclosure, called double extortion.

Symmetric encryption uses the same secret key to encrypt and decrypt, and AES is widely used. Asymmetric cryptography uses a public and private key pair for complementary operations.

A digital signature uses the private key to sign data and the public key to verify. A signature provides authenticity and integrity, but not confidentiality by itself.

A remote-access VPN tunnel's protection ends at the VPN gateway. Traffic beyond the gateway and data stored on the client need their own protections. Split tunneling sends ordinary internet traffic outside the VPN tunnel.

A packet-filtering firewall ruleset commonly uses protocols, addresses, ports, interfaces, and direction. A stateful firewall also remembers connection state in a state table and can reject packets that claim to belong to an unobserved session.

Parameterized queries block SQL injection by separating code from data. The developer defines the SQL statement first and binds input values separately, so an attack string is treated as a literal value. XSS output encoding must match the browser context, like HTML, JavaScript, CSS, or URL.

Backups, Incident Response, and Logging

At least one backup should be isolated from production systems to block ransomware spread. A continuously reachable backup may be encrypted or deleted by the same compromised credentials. Isolation can be physical, logical, or immutable.

A restore test proves that recovery actually works. A backup job can report success while files are incomplete, corrupt, or missing configuration. Restore tests also measure whether recovery meets the required time.

A mirrored RAID array is not a backup. It is not an independent copy and will quickly copy mistaken deletions or encrypted files. RAID mainly improves availability during certain disk failures.

Every logging host should use a common time source to correlate event timelines. A SIEM adds cross-source analysis, collecting logs and normalizing different vendor formats so weak signals can be connected.

Incident response is a lifecycle: preparation, detection and analysis, containment, eradication, and recovery. Containment limits spread, while eradication removes the incident's foothold like malware, breached accounts, or exploited vulnerabilities.

Data minimization helps privacy: a service can request only an over-threshold result instead of an exact birth date to verify an age threshold. Collecting less personal data reduces what can be exposed in a later breach.

MLS end-to-end encrypted group messages can only be decrypted by group members. The delivery service can route ciphertext but cannot read payloads, though it may still learn which devices share a message.