Schema PH · Learn

How we keep software safe, fast and lawful

Short lessons on the rules we build by. Each one covers what the rule is, the real incident that made it a rule, how to apply it, and what it costs.

Start with lesson 1  

Security

Keeping a signed-in user, their session and their data out of the wrong hands.

  1. 01 HTTPS and HSTS Why having HTTPS is not enough, how one header stops a whole class of attacks, and why that header is hard to take back.
  2. 02 CSRF — cross-site request forgery How another website can act as your signed-in user, why cookies make it possible, and the three modern defences.
  3. 03 Sessions and cookies What a session cookie must carry, the flags that protect it, and the trade-off between signed cookies and server-side sessions.
  4. 04 Access control and tenant isolation The most common serious web flaw is not clever hacking but a server that forgets to ask "is this yours?". How to make that question impossible to skip.
  5. 05 Injection and escaping SQL injection and cross-site scripting are the same mistake in two places, data being read as code, and they have the same cure.
  6. 06 Third-party scripts and dependencies Every script you load from someone else runs with your page's full power. Real breaches that came in through a chat widget, a CDN and an npm package.
  7. 07 Size and rate limits A server with no limits can be knocked over by one request. How caps on body size, request rate and tracked state keep one visitor from taking everyone down.

Infrastructure

Caches, deploys, health checks, backups and secrets: the parts that run the code.

  1. 08 Edge caching A CDN can serve your pages from a city near the visitor in milliseconds, or serve one person's account page to thousands of strangers. The headers decide which.
  2. 09 Deploys and versioning Most outages start with a change. How to ship so that old and new code never mix, and why a bad release should reach a few machines before it reaches all of them.
  3. 10 Health checks and monitoring A green status page and a broken app can happen at the same time. What a health check can see, what it cannot, and how to count the failures real users hit.
  4. 11 Backups and secrets A backup you have never restored is a hope, and a password in a git repository is public. One company that nearly lost everything, one that did, and one that hid a breach for a year.
  5. 12 Redis, and when you need it Redis is a fast shared memory for many servers. What it is good at, the incidents that came from using it carelessly, and why a single server usually does not need it at all.

Performance

Doing the same work with less CPU, less RAM and less waiting, and proving it.

  1. 13 Memory in Node.js How V8 spends RAM, why short-lived garbage still costs you, and how to build caches that cannot grow forever on a small server.
  2. 14 CPU and the event loop Node.js runs your code on one thread. One slow regular expression can stop every user at once, and it has taken down two of the biggest sites on the web.
  3. 15 Streaming Send data as it is produced instead of building it all in memory first. How backpressure keeps a slow phone from filling your server's RAM, and what to do when a stream breaks halfway.
  4. 16 Measuring performance A change is faster only when a measurement says so, beyond the noise. How to run an optimisation loop that keeps real wins and never trades away correctness or security.

Compliance

What the law and the platforms expect of a public website.

  1. 17 Privacy and personal data What the Philippine Data Privacy Act asks of every website, from the privacy policy and cookie banner to the day someone asks you to delete them.
  2. 18 Honest selling online Hidden fees, fake reviews, tricky cancel flows and borrowed images. What consumer law and the regulators say, with the fines that made them famous.
  3. 19 Accessibility Alt text, colour contrast and keyboard navigation. Three habits that make a site usable for people with disabilities, and that courts have started to enforce.