Chapter 1 — Computing and service architecture
Lesson map
Lesson 01 published. Map, example, EX001.
flowchart TD
N0["Learning outcomes"]
N1["1.1 The opening case"]
N2["1.2 Parts of a hosted site"]
N3["1.3 Shared responsibility"]
N4["1.4 The supply chain behind a site"]
N5["1.5 Requests and responses"]
N6["1.6 Why this course"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX001"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["1.1 The opening case"]
N2["1.2 Parts of a hosted site"]
N3["1.3 Shared responsibility"]
N4["1.4 The supply chain behind a site"]
N5["1.5 Requests and responses"]
N6["1.6 Why this course"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX001"]
[Learning outcomes]
|
v
[1.1 The opening case]
|
v
[1.2 Parts of a hosted site]
|
v
[1.3 Shared responsibility]
|
v
[1.4 The supply chain behind a site]
|
v
[1.5 Requests and responses]
|
v
[1.6 Why this course]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX001]
Learning outcomes
You will (1) describe how a hosted customer website is built from servers, web software, databases and plugins; (2) identify who is responsible for each part; (3) place the opening case in that picture; (4) name the supply chain behind a site.
1.1 The opening case
Tomás Rivera is a technical course student at the fictional Eastbank Technical College, working part-time as a support technician at the fictional Pinecrest Hosting under supervisor Grace Okafor. A customer, Ferncroft Books, asked support to install an image-resize plugin. A previous technician had downloaded it from a mirror site because the vendor's page was slow. Weeks later the shop began showing strange redirects. The mirror copy turned out to differ from the official release. The case gives every later chapter its starting point and its first piece of evidence.
1.2 Parts of a hosted site
A customer site runs on a server managed by Pinecrest. Web server software receives requests, the shop application builds pages, a database stores products and orders, and plugins add features such as image resizing, contact forms and galleries. Each part comes from somewhere: an operating system vendor, a web server project, the shop application's maintainers and plugin authors. For Ferncroft Books, the resize plugin is the part that touched product images, which is why its source later matters so much.
1.3 Shared responsibility
Pinecrest is responsible for servers, operating system updates and the hosting control panel. Customers choose plugins and content. Support staff who install plugins for customers take on part of that responsibility, which is why their installation steps matter. In Ferncroft's case, the customer chose the resize plugin, but a Pinecrest technician downloaded and installed it. That split makes the mirror download a support problem, not only a customer choice. Grace treats it that way, which is why the later rules on sources and hashes apply to every plugin support installs, whoever requested it.
1.4 The supply chain behind a site
Everything a site runs was written by someone else and delivered through downloads, updates and registries. NIST SP 800-218 (SSDF) and SLSA v1.0 describe how software producers should protect that chain; consumers like Pinecrest must check what they receive. Ferncroft's site shows how short the gap can be between a producer's good practice and a consumer's mistake. The resize plugin's vendor published an official release, yet the copy installed came from a mirror. No producer practice can help a consumer who never fetches the producer's file or compares it with the published hash.
1.5 Requests and responses
A visitor's browser sends a request; the web server passes it to the application, which may call plugins and the database, then returns a page. Problems in any plugin can affect every page it touches. At Ferncroft, the resize plugin runs whenever a product image page is requested, so a change in that plugin shows up on exactly those pages. That is why customers saw redirects on image pages while other pages loaded normally. Tracing a request through its parts tells Tomás which component to suspect first.
1.6 Why this course
The course teaches Tomás to check what is installed, where it came from, how it is configured and how to notice when something goes wrong. Each of those four questions became a gap in the Ferncroft case: nobody had a list of installed plugins, the source was a mirror, the plugin folder was writable, and redirects ran for weeks before anyone noticed. The chapters that follow take those gaps one at a time and turn each into a routine.
Worked example
Tomás draws Ferncroft's site as boxes: server, web server, shop application, database, and four plugins with their sources. Only the resize plugin's source is marked "mirror, unverified". Grace pins the drawing above the support desk as a reminder that every box has a source worth checking.
Synthetic case. Ferncroft Books, Pinecrest Hosting and all events are synthetic.
Errors and limits
A diagram simplifies; real sites often hide extra parts such as scheduled tasks or old plugins.
Exercises
- EX001 — Site parts. List the main parts of a hosted customer site. Rubric: 3 = server, web server, application, database, plugins; 2 = three; 1 = one; 0 = none.
- EX002 — Pinecrest's share. What is Pinecrest responsible for? Rubric: 3 = servers, OS updates, control panel; 2 = two; 1 = one; 0 = none.
- EX003 — Support's share. Why do support staff's installation steps matter? Rubric: 3 = they take on part of responsibility for plugins; 2 = partial; 1 = vague; 0 = none.
- EX004 — Unverified box. Which box in Tomás's drawing was marked unverified? Rubric: 3 = the resize plugin from a mirror; 2 = partial; 1 = vague; 0 = none.
Synthesis
Every part of a site has a source; know them all.