The returned certificate is the public certificate (which includes the public key but not the private key), which itself can be in a couple of formats.
this is a container format that may include just the public certificate (such as with Apache installs, and CA certificate files /etc/ssl/certs), or may include an entire certificate chain including public key, private key, and root certificates
Privacy Enhanced Mail (PEM), a failed method for secure email but the container format it used lives on
This is a PEM formatted file containing just the private-key of a specific certificate and is merely a conventional name and not a standardized one.
The rights on these files are very important
/etc/ssl/private
OpenSSL can convert these to .pem
.cert .cer .crt A .pem (or rarely .der) formatted file with a different extension
there are four different ways to present certificates and their components
used preferentially by open-source software
It can have a variety of extensions (.pem, .key, .cer, .cert, more)
The parent format of PEM
a binary version of the base64-encoded PEM file.
PEM on it's own isn't a certificate, it's just a way of encoding data
X.509 certificates are one type of data that is commonly encoded using PEM.
With configuration management systems, you write code that describes how you want some component of your systems to be installed and configured, and when you execute the code on your server, it should end up in the desired state.
building a hosting platform that is capable of a lot of things that system administrators used to do manually
build modules on deployment via bundler or npm or similar, it can be incredibly slow to run, taking minutes or longer in some cases
deploying with configuration management tools is a pain in the ass and error prone.
Support for containers has existed in the Linux kernel since version 2.6.24 when cgroup support was added
All of the logic that used to live in your cookbooks/playbooks/manifests/etc now lives in a Dockerfile that resides directly in the repository for the application it is designed to build
All of the dependencies of the application are bundled with the container which means no need to build on the fly on every server during deployment.
Containers bring standardization which allows for systems like centralized logging, monitoring, and metrics to easily snap into place no matter what is running in the container.
Dockerfiles do not give you the same level of control over configuration as your application transitions between environments, like dev, staging, and production.
You may even need to have different Dockerfile’s for each environment in certain cases.
configuration management systems now have hooks for docker integration.
Config management will only be used to install Docker, an orchestration system, configure PAM/SSH auth, and tune OS sysctl values.
"With configuration management systems, you write code that describes how you want some component of your systems to be installed and configured, and when you execute the code on your server, it should end up in the desired state."
The broker and MQTT act as a simple, common
interface for everything to connect to
Messages in MQTT are published on topics
no need to
configure a topic, publishing on it is enough
Topics are treated as a
hierarchy, using a slash (/) as a separator.
Clients can receive messages by creating subscriptions
A
subscription may be to an explicit topic
Two
wildcards are available, + or #.
# can be used as a wildcard for all remaining levels of
hierarchy
+ can be used as a wildcard for a single level
of hierarchy
Zero length topic levels are valid, which can lead to some
slightly non-obvious behaviour.
The QoS
defines how hard the broker/client will try to ensure that a message is
received.
Messages may be sent at any QoS level, and clients may
attempt to subscribe to topics at any QoS level
the
client chooses the maximum QoS it will receive
if
a client is subscribed with QoS 2 and a message is published on QoS 0,
the client will receive it on QoS 0.
1: The broker/client will deliver the message at least once, with confirmation required.
All messages may be set to be retained.
the
broker will keep the message even after sending it to all current
subscribers
useful as a "last known good" mechanism
If clean session is set
to false, then the connection is treated as durable
when the client disconnects, any subscriptions it has will remain and
any subsequent QoS 1 or 2 messages will be stored until it connects
again in the future
If clean session is true, then all subscriptions
will be removed for the client when it disconnects
nginx "fails fast" when the client informs it that it's going to send a body larger than the client_max_body_size by sending a 413 response and closing the connection.
Because nginx closes the connection, the client sends data to the closed socket, causing a TCP RST.
Most clients don't read responses until the entire request body is sent.
Client body and buffers are key because nginx must buffer incoming data.
The clean setting frees up memory and consumption limits by instructing nginx to store incoming buffer in a file and then clean this file later from disk by deleting it.
"Flood fill, also called seed fill, is an algorithm that determines the area connected to a given node in a multi-dimensional array. It is used in the "bucket" fill tool of paint programs to fill connected, similarly-colored areas with a different color, and in games such as Go and Minesweeper for determining which pieces are cleared. When applied on an image to fill a particular bounded area with color, it is also known as boundary fill."
"We present a realtime approach for multi-person 2D pose estimation that predicts vector fields, which we refer to as Part Affinity Fields (PAFs), that directly expose the association between anatomical parts in an image. The architecture is designed to jointly learn part locations and their association, via two branches of the same sequential prediction process."
"This quote (sometimes attributed to Leonardo da Vinci), applies to many types of creative work including software development. Unfortunately perfection is never achieved, only approached, as we close in bit-by-bit to its asymptote . "