Kubernetes Hardening Tutorial Part 2: Network

In the first part of this tutorial, we discussed how to enhance your Pod security in your K8s cluster. If you haven't read it yet, here's the link.

Today, we will walk you through networking-related security issues in a Kubernetes cluster and how to enhance them. After reading this tutorial, you will be able to:

help with phyton

Write a program that prompts the user to enter two integers, one per prompt. The program should then display the result of dividing the first number by the second number, using integer division so that the answer is an integer quotient, and a remainder.

Last minute interview tips to get the job

You may not have days or weeks to prepare for a job interview in some cases. Its possible that you may just have a few hours. Since youve been called in for a sudden interview, theres very little you can do to prepare in the hours and minutes before you go for your interview. This is why we bring you these last minute interview tips.
Even if youre looking for last minute interview tips for freshers, these are a few key preparations you can make during the end moments.
Last-minute Tips for a Successful Interview
Even if you just have a few hours, heres how to prepare and excel with these last minute interview tips:

  1. Practice and Prepare
    Practice and Prepare
    Going over the most essential pages on the organization, firm, or departments website is the quickest method to obtain a basic feel of the employer brand and what theyre all about.
  2. Develop a Connection With the Interviewer
    Develop a Connection With the Interviewer
    Almost every question may be answered by telling a tale. Are you a goal-oriented person? Yes would be a bad response. A fantastic response would be Yes, Im a goal-oriented person. In my previous position (Then tell a brief tale that demonstrates your ambition.)
    If youre still looking for work, youll need to update your resume to reflect the specific requirements of each job posting. If you need help with your CV,
  3. Research the Company, and Show What You Know
    Research the Company, and Show What You Know
    Ask the recruiter or the person who invited you to the interview for information if you dont know who the interviewees are. On LinkedIn, you can discover a lot about the interviewers, such as where they went to school, what other organizations they worked for, and so on.

Theres no justification for asking generic questions about a firm during an interview. Doing so demonstrates that you were uninterested in conducting any investigation.

FSE Outreach Round #12: Building a Site Header With Blocks

On Wednesday, Anne McCarthy announced Round #12 of the FSE Outreach Program. As always, everyone is free to join by testing features and providing direct feedback on problem areas with the design tools in WordPress. Anyone interested should respond by March 16.

For this round, volunteers are tasked with testing some oldies but goodies. Early in the program’s history, anyone who joined did a lot of site header and navigation work. Round #12 asks that users revisit some of these essential tools.

This was an exciting call for testing for me. In early 2021, I had my fair share of frustrations with the FSE experience. There were so many designs I wanted to tackle, but I far too often fell short of creating what I wanted.

Therefore, I hopped back in time and revisited a header design from Round #4 of testing in March 2021. At the time, the WordPress leads were weeks away from deciding whether some FSE-related components would land in WordPress. My conclusion of the tools at the time was:

I came to the realization that attempting to do anything remotely advanced with the site editor was simply not going to happen…As someone who prides himself on near-infinite patience, Round #4 sought to crack me.

I had wanted to recreate elements from the UK-based Pho Cafe page header during testing. It was a tall order that could not be filled.

Screenshot of the Pho Cafe website page header.
Pho Cafe header.

However, almost a year later now, how much has changed? Is it possible to create an exact replica of the site’s header from the block editor?

Yes and no. As usual, it depends.

As a developer and designer, I am confident that I could do it with custom code. Considering this would likely be a one-off design for a paying client, I would be comfortable with that.

Creating this as a part of a publicly-released, general-purpose theme would have a ton of roadblocks with that level of customization. However, it would be possible to capture much of the character, the essence, of the design.

As for building it directly from the block editor, there are still some severe limitations. However, that is what I challenged myself to do. I wanted to get a feel for where the site editor was at without writing CSS code.

The following is the result:

Pizza restaurant header with a logo, menu, and buttons at the top right. In the middle is a demo slogan followed by another button-like menu.
Pizza restaurant header.
Pizza photo credit: Jennifer Bourn

Technically, I did write a little code to load the KG Happy font. Outside of that, I just forked a block theme I had on hand and changed the “wide” size. I created everything else 100% from the site editor.

Here is a screenshot of the design from the editor itself:

Pizza restaurant header within the site editor.  The current view of the header template is selected.
Custom header template part in the site editor.

On the whole, this went surprisingly well. In a year, the site editor has become far more powerful.

As I said, it still has its limitations. Anyone who has worked with block themes will likely tell you the issue with the layout in the above screenshot. The problem area is the Columns block used for the Site Logo, Navigation, and Buttons across the top. You might as well hang up any hope of that working well on smaller screen sizes.

Mobile view of a restaurant header. Menu area is out of alignment.
Mobile view of header.

Is it entirely unusable? No, but it is not anywhere near close to ideal.

Without responsive controls on layout-type containers like the Columns block, designing anything complex with the site editor can sometimes feel like one giant hack. At this point, this is not a revelation of any sort.

There are tons of improvements with block design tools in comparison to last year. The core block gap, margin, and padding controls are a godsend for adjusting vertical and horizontal spacing. Back then, even the thought of having any control over this was a headache-inducing affair. Except for a few blocks still missing these options, it is now [mostly] stress-free.

I hit no spacing-related problems in this experiment. That feels gratifying to say after over a year of testing FSE features.

However, I did hit some other roadblocks. The Navigation block may be my least favorite thing about the site editor. I have yet to see how it will offer a universal system that plays well with the 1,000s of design variations that theme authors will want to employ. Classic nav menus are still vastly superior for custom design.

I ran into two primary issues with this experiment. One of the problems I had a year ago with FSE Outreach #4 was creating a menu that had button-like links. This basic design is still impossible with the Navigation block, at least with the core design tools:

Four button-like links with red backgrounds and white text.
Button-like navigation items.

Users can add a background to the entire Navigation block but not to the individual menu items. How did I do it? I used a Buttons block instead.

The more I think about it now, the more I like the Buttons block alternative. However, there is no way to wrap this in a <nav> tag to define it as a navigation element.

One missing piece of the header I was attempting to replicate was a mobile menu at the far right of the layout. WordPress’s mobile Navigation menu icon provides no customization options. Users can customize the overall background and text color but not target the button directly. I faked it a little by narrowing down the column:

WordPress site editor with a mobile-only Navigation block highlighted.  It is aligned to the right of a Buttons block.
Mobile Navigation menu icon next to Buttons.

There was no way to make the mobile icon larger or give it any padding to align its size with the Button blocks next to it.

The Navigation block, despite its progress, is still one of the weakest links in FSE. It only covers a handful of simple use cases out of the box. Anything beyond that requires a deep level of customization and the hope that an end-user does not break the delicate balance struck to make it work.

Twice during testing, my Navigation block disappeared on the front end. I suspect it had something to do with me trying to adjust the outer Column block’s width. However, I was unable to replicate the issue at will.

Testing is all about finding problems to solve. I did not run into any crashes or the types of bugs that I would have seen long ago. The experience of designing from within the site and template editors feels pretty smooth these days. The holdups are more about missing capabilities than anything. Making the leap from an impossible header layout to an almost possible one in 11 months is significant.

Unpacking MySQL Semi-Synchronous Replication: Durability, Consistency and Split-Brains

MySQL semi-synchronous is a plugin mechanism on top of asynchronous replication that can offer better durability and even consistency. It helps in high availability solutions, but can in itself reduce availability. In this article, we will look at some basics and follow up to present scenarios requiring higher-level intervention to ensure availability and avoid split-brains.

Overview

As a quick recap, semi-synchronous replication is a mechanism where a commit on the primary does not apply the change onto the internal table data and does not respond to the user until the changelog is guaranteed to have been persisted (though not necessarily applied) on a preconfigured number of replicas. We limit our discussion to MySQL 5.7 or equivalent.

Trailing Slashes on URLs: Contentious or Settled?

A fun deep dive from Zach. Do you have an opinion on which you should use?

1) https://website.com/foo/
2) https://websites.com/foo

The first option has a “trailing slash.” The second does not.

I’ve always preferred this thinking: you use a trailing slash if that page has child pages (as in, it is something of a directory page, even if has unique content of its own). If it’s the end-of-the-line (of content), no trailing slash.

I say that, but this very site doesn’t practice it. Blog posts on this site are like css-tricks.com/blog-post/ with a trailing slash and if you leave off the trailing slash, WordPress will redirect to include it. That’s part of the reason Zach is interested here. Redirects come with a performance penalty, so it’s ideal to have it happen as infrequently possible.

Performance is one thing, but SEO is another one. If you render the same content, both with and without a trailing slash, that’s theoretically a duplicate content penalty and a no-no. (Although that seems weird to me, I would think Google would smart enough not to be terribly concerned by this.)

Where resources resolve to seems like the biggest deal to me. Here’s Zach:

If you’re using relative resource URLs, the assets may be missing on Vercel, Render, and Azure Static Web Apps (depending on which duplicated endpoint you’ve visited).

<img src="image.avif"> on /resource/ resolves to /resource/image.avif

<img src="image.avif"> on /resource resolves to /image.avif

That’s a non-trivial difference and, to me, a reason the redirect is worth it. Can’t be having a page with broken resources for something this silly.

What complicates this is that the site-building framework might have opinions about this and a hosting provider might have opinions about this. As Zach notes, there are some disagreements among hosts, so it’s something to watch for.

Me, I’d go with the grain as much as I possibly could. As long as redirects are in place and I don’t have to override any config, I’m cool.

To Shared LinkPermalink on CSS-Tricks


Trailing Slashes on URLs: Contentious or Settled? originally published on CSS-Tricks. You should get the newsletter.

Introduction to DevSecOps

With DevSecOps, you can reach higher security standards while following DevOps principles. This Refcard will show you how to get started with DevSecOps with key themes, crucial steps to begin your journey, and a guide to choosing security tools and technologies to build your DevSecOps pipeline.

The Kyiv Independent Seeks Donations to Continue Critical Ukrainian News Coverage

photo credit: The Kyiv Independent

The Kyiv Independent, a new English-language media outlet powered by WordPress, is seeking donations to continue their reporting at this critical time in Ukraine’s struggle against Russian invasion.

The fledgling publication is just three months running and its staff is already plunged into what may be some of the most important reporting of their lifetimes.

The Kyiv Independent was created by 30 journalists who were previously employed at the Kyiv Post but fired for what they say was retaliation for exercising their editorial independence. The publication, led by Olga Rudenko, its new editor-in-chief, tells the story of its values and origins on the website:

The Kyiv Post, Ukraine’s global voice, went silent on Nov. 8, 2021, days after celebrating the 26th year of its uninterrupted run.

The publication was shut down by the owner in his attempt to take full control of the newsroom that has always followed the principle of editorial independence. 

Yet, the editorial team of the independent Kyiv Post refused to be silenced. If we couldn’t save the Kyiv Post brand, we could save its values.

At the moment the publication reports they are “dealing with increased volumes of traffic, attacks, and an unpredictable situation on the ground.” Rudenko gave a brief update from Kyiv via video yesterday:

The Kyiv Independent is running a gofundme campaign to raise funds for their new publication and continued reporting efforts during this critical time. The campaign was set up by Kyiv Independent’s London-based CFO Jakub Parusinski. Their cause is resonating with free press supporters from around the world and so far they have raised £233,494. The publication also has a Patreon account which is bringing in $24,173/month from more than 2,000 patrons.

“It is crucial to bring credible news from Ukraine to the world,” Parusinski said. “Especially when Russian forces are working hard to distort the perception of Ukraine abroad.

“We are asking you to stand up to it together with us. We are not backed by a rich owner or an oligarch. We will rely first and foremost on fundraising from our readers and donors, and later on commercial activities.”

Patchstack is one of the first companies to reach out to The Kyiv Independent with an offer to help.

“Patchstack not only wants to offer them our WordPress security services free but  we are actively looking to help Ukrainian organizations at this time,” Patchstack Security Advocate Robert Rowley said. He also signed up to support the organization through the fundraiser.

“I personally like to support independent journalists and their background tells the story of the type of journalism I want to support,” Rowley said.

Patchstack is in the process of setting up a site called UA Cyber Help, an effort led by their CEO Oliver Sild and four employees with an average of 15+ years in security. They are volunteering their time to bring resources to organizations like The Kyiv Independent and others affected by the war in Ukraine.

I have reached out to The Kyiv Independent’s news team to inquire about their needs and how the WordPress business and hosting community can help. We will publish a followup when we hear more from their team.

DataWeave Tip #8: The write Function

Originally published February 26, 2019

Recently I have been working on a really simple case. When an HTTP server returned an error and a non-empty body, I needed to embed this body into an error structure. Although this is a simple case, I got a problem with implementing it in Mule 4. In the previous Mule edition, it was a little bit simpler. So let's see what it is all about.

Case

First, we have a look at the case that I have to implement. I have a mule application that is calling an external HTTP server via an HTTP request component. When the server responds with an error like 4xx, 5xx, and the returned body will is not empty, we would like to forward that response to the calling application.

Using Google Analytics: Universal Analytics Enhanced Ecommerce to Analyze User Interactions

Using traditional e-commerce data analysis tools, we can only analyze the order sales data of products, and cannot have a global understanding of product conversion. Google Analytics: Universal Analytics Enhanced e-commerce provides great convenience for developers to understand customer behavior and sales results, thus exploring many new opportunities.

With the enhanced e-commerce function, developers can easily track user interactions with your product during their shopping journey. Such interactions include product displays, product clicks, viewing product details, adding the product to the shopping cart, checking out, transactions, and refunds.

When to Avoid the text-decoration Shorthand Property

In my recent article about CSS underline bugs in Chrome, I discussed text-decoration-thickness and text-underline-offset, two relatively new and widely-supported CSS properties that give us more control over the styling of underlines.

Let me demonstrate the usefulness of text-decoration-thickness on a simple example. The Ubuntu web font has a fairly thick default underline. We can make this underline thinner like so:

:any-link {
  text-decoration-thickness: 0.08em;
}
Showing two links, a default and one that decreases the text-decoration-thickness.

/explanation Throughout this article, I will use the :any-link selector instead of the a element to match hyperlinks. The problem with the a tag as a selector is that it matches all <a> elements, even the ones that don’t have a href attribute and thus aren’t hyperlinks. The :any-link selector only matches <a> elements that are hyperlinks. Web browsers also use :any-link instead of a in their user agent stylesheets.

Hover underlines

Many websites, including Google Search and Wikipedia, remove underlines from links and only show them when the user hovers a link. Removing underlines from links in body text is not a good idea, but it can make sense in places where links are more spaced apart (navigation, footer, etc.). With that being said, here’s a simple implementation of hover underlines for links in the website’s header:

header :any-link {
  text-decoration: none;
}

header :any-link:hover {
  text-decoration: underline;
}

But there’s a problem. If we tested this code in a browser, we’d notice that the underlines in the header have the default thickness, not the thinner style that we declared earlier. Why did text-decoration-thickness stop working after we added hover underlines?

Let’s look at the full CSS code again. Can you think of a reason why the custom thickness doesn’t apply to the hover underline?

:any-link {
  text-decoration-thickness: 0.08em;
}

header :any-link {
  text-decoration: none;
}

header :any-link:hover {
  text-decoration: underline;
}

The reason for this behavior is that text-decoration is a shorthand property and text-decoration-thickness its associated longhand property. Setting text-decoration to none or underline has the side effect of re-initializing the other three text decoration components (thickness, style, and color). This is defined in the CSS Text Decoration module:

The text-decoration property is a shorthand for setting text-decoration-line, text-decoration-thickness, text-decoration-style, and text-decoration-color in one declaration. Omitted values are set to their initial values.

You can confirm this in the browser’s DevTools by selecting one of the hyperlinks in the DOM inspector and then expanding the text-decoration property in the CSS pane.

DevTools screenshot showing text-decoration styles on the :any-link pseudo-selector.

In order to get text-decoration-thickness to work on hover underlines, we’ll have to make a small change to the above CSS code. There are actually multiple ways to achieve this. We could:

  • set text-decoration-thickness after text-decoration,
  • declare the thickness in the text-decoration shorthand, or
  • use text-decoration-line instead of text-decoration.

Choosing the best text-decoration option

Our first thought might be to simply repeat the text-decoration-thickness declaration in the :hover state. It’s a quick and simple fix that indeed works.

/* OPTION A */

header :any-link {
  text-decoration: none;
}

header :any-link:hover {
  text-decoration: underline;
  text-decoration-thickness: 0.08em; /* set thickness again */
}

However, since text-decoration is a shorthand and text-decoration-thickness is its associated longhand, there really should be no need to use both at the same time. As a shorthand, text-decoration allows setting both the underline itself and the underline’s thickness, all in one declaration.

/* OPTION B */

header :any-link {
  text-decoration: none;
}

header :any-link:hover {
  text-decoration: underline 0.08em; /* set both line and thickness */
}

If this code looks unfamiliar to you, that could be because the idea of using text-decoration as a shorthand is relatively new. This property was only subsequently turned into a shorthand in the CSS Text Decoration module. In the days of CSS 2, text-decoration was a simple property.

Unfortunately, Safari still hasn’t fully caught up with these changes. In the WebKit browser engine, the shorthand variant of text-decoration remains prefixed (-webkit-text-decoration), and it doesn’t support thickness values yet. See WebKit bug 230083 for more information.

This rules out the text-decoration shorthand syntax. The above code won’t work in Safari, even if we added the -webkit- prefix. Luckily, there’s another way to avoid repeating the text-decoration-thickness declaration.

When text-decoration was turned into a shorthand, a new text-decoration-line longhand was introduced to take over its old job. We can use this property to hide and show the underline without affecting the other three text decoration components.

/* OPTION C */

header :any-link {
  text-decoration-line: none;
}

header :any-link:hover {
  text-decoration-line: underline;
}

Since we’re only updating the line component of the text-decoration value, the previously declared thickness remains intact. I think that this is the best way to implement hover underlines.

Be aware of shorthands

Keep in mind that when you set a shorthand property, e.g., text-decoration: underline, any missing parts in the value are re-initialized. This is also why styles such as background-repeat: no-repeat are undone if you set background: url(flower.jpg) afterwards. See the article “Accidental CSS Resets” for more examples of this behavior.


When to Avoid the text-decoration Shorthand Property originally published on CSS-Tricks. You should get the newsletter.

Manuel Matuzovic’s CSS Specificity Demo

If you’re looking for a primer on CSS specificity, we’ve got that. And if you’re trying to get ahead of the game, you should be aware of CSS Cascade Layers as well.

Screenshot of the CSS Specificity Demo.

One of the ways to help get a grasp of CSS specificity is thinking terms of “what beats what” or how strong the specificity is. Manuel Matuzovic has a helpful interactive step-by-step demo. You keep clicking the “Add selector” button, and the CSS shown (and applied to the page) changes with ever-increasingly-strong selectors applied to the body that change the background-color. At the end, it veers into not-really-selectors trickery, like using @keyframes to override things.

More specificity practice

If you enjoyed the trickery at the end, check out Francisco Dias’ A Specificity Battle!, an article we published a few years back that does a back-and-forth styling battle with nineteen steps “selecting” the same element to re-style it. CSS is cray sometimes.

To Shared LinkPermalink on CSS-Tricks


Manuel Matuzovic’s CSS Specificity Demo originally published on CSS-Tricks. You should get the newsletter.

API Security Weekly: Issue 158

This week, we have news on a breach affecting 400 000 users of a popular German school app, and another vulnerability in a popular WordPress plugin. In addition, there’s a thought-provoking opinion piece on the value of GraphQL on public interfaces, and an article featuring nine useful API testing tools.

Breach: Sensitive Data of 400 000 German Students Exposed by API Flaw

Last week, the news broke of a breach on a popular German student community app, Scoolio, discovered by security researcher Lilith Wittmann. Conservative estimates put the number of affected students to 400 000 students, but how Scoolio creates user accounts throws some uncertainty to the exact figure here.