Cheatsheets
The numbers, models, and trade-offs a senior engineer is expected to have on reflex — not definitions, but the figures you reach for mid-design and the note on when each one changes a decision. Glanceable, version-dated, and framed for the interview.
Reviewed August 30, 2026. Every value is an established engineering fact — order-of-magnitude where hardware-dependent.
Order-of-magnitude latencies from L1 cache (~1 ns) to a cross-continent round trip (~150 ms). The point isn't the exact figure — it's the ratios: memory is ~100× faster than SSD, and a network hop dwarfs everything local.
4 min readThe powers of two, time constants, and object sizes that turn “design for 100M users” into concrete QPS, storage, and bandwidth in your head — deliberately order-of-magnitude, not false precision.
5 min readThe read/write patterns (cache-aside, read/write-through, write-back), eviction policies (LRU/LFU/TTL), and the two hard problems — stale reads and the thundering herd — with the mitigations that actually work.
5 min readA load balancer spreads traffic across healthy backends. Layer 4 routes on IP/port — fast and protocol-agnostic; Layer 7 understands HTTP and can route on content, terminate TLS, and retry, at higher cost. Pick the algorithm for your traffic shape, and make the balancer itself redundant — a lone LB is just a relocated single point of failure.
4 min readNot the full list — the codes with design consequences: 201 + Location for creation, 304 for conditional GETs, 409 for optimistic concurrency, and 429/503 + Retry-After as the backpressure signals that drive client retries.
4 min readAuthentication proves who you are; authorization decides what you can do — separate concerns, enforced separately. Server-side sessions are stateful and instantly revocable; JWTs are stateless and scale, but are hard to revoke, so keep them short-lived with refresh tokens. Encrypt in transit and at rest, and hash passwords with bcrypt or argon2 — never plaintext or MD5.
4 min read