Is my network — and my password — up to the job?

254. The prefix leaves 8 host bits, which is 256 total addresses, and two of them are reserved: the all-zeros address identifies the network itself and the all-ones address is the broadcast. The general rule is 2^(32 − prefix) − 2, so a /25 gives 126, a /26 gives 62 and a /30 gives 2.

Because it has just 2 host bits, for 4 total addresses, and the network and broadcast addresses take two of them. That leaves exactly two usable, which is why /30 became the traditional prefix for point-to-point links. RFC 3021 later allowed /31 for the same purpose with no broadcast address, halving the waste.

100 metres, about 328 feet, for Cat 5e through Cat 6A — and that is the full channel, including the patch cords at both ends, which is why the in-wall permanent link is limited to 90 metres. Cat 8 is the exception at 30 metres. Beyond those distances you need a switch in the middle or fiber.

Only for short runs. Cat 6 is rated for 10 Gbps up to roughly 37 metres; past that it falls back to 1 Gbps. Cat 6A is rated for 10 Gbps across the full 100 metres, and since the labour of pulling cable dwarfs the price difference, Cat 6A is the sensible choice for any new installation you expect to keep.

1, 6 or 11, at 20 MHz width — those are the only three that do not overlap each other in the band. Picking anything in between does not find an empty gap; it partially interferes with two networks at once. Scan your specific location and take whichever of the three is least crowded.

DFS channels, 52 through 144 on 5 GHz, are shared with weather and military radar. The router is legally required to vacate them the instant it detects a radar pulse, which users experience as an abrupt disconnection with no visible cause. They are often less congested, so they are worth using — unless you get unexplained drops, in which case move to 36–48 or 149–165.

Light in fiber travels at roughly 200,000 km/s, two-thirds of its vacuum speed, and a ping is a round trip. So the floor is 2 × distance ÷ 200,000 km/s: about 10 ms for 1,000 km, 26 ms for 2,600 km, and around 58 ms across the Atlantic. Real fiber routes are longer than the straight line, so measured figures are always higher.

It is on the high side but not alarming. Two to two-and-a-half times the floor is normal once you account for routing, switching and the path not being a straight line. Above roughly three times, the extra latency is coming from your ISP’s routing or your local connection rather than from distance, and a traceroute will usually show exactly where.

Largest Contentful Paint at 2.5 seconds or less, Interaction to Next Paint at 200 ms or less, and Cumulative Layout Shift at 0.1 or less — all measured at the 75th percentile of real users. INP replaced First Input Delay in March 2024, so if your dashboard still reports FID it is showing a metric Google no longer uses.

Against pure brute force at a billion guesses per second, a 12-character mixed-case alphanumeric password has 62¹² combinations and would take on the order of 100,000 years to exhaust. That figure collapses if the password is a dictionary word with predictable substitutions, because real attacks try those first rather than counting through every combination.

Almost always, yes. Each additional character multiplies the search space by the size of the alphabet, so length compounds far faster than symbol variety. A 16-character passphrase of ordinary lowercase words beats an 8-character string of mixed symbols by an enormous margin, and it is far easier to type correctly.

12 is a reasonable default today; 10 is the practical floor. Each increment doubles the computation, so roughly 65 ms per hash at cost 10 becomes 260 ms at cost 12 on a typical modern core. Measure on your own hardware against your latency budget rather than copying a number, and revisit it every couple of years as hardware gets faster.

Because it is fast, and speed is the attacker’s advantage. A GPU can compute billions of SHA-256 hashes per second, so a stolen database falls quickly regardless of the salt. bcrypt, scrypt and Argon2 are deliberately slow and, in the case of the latter two, memory-hard — which removes most of the benefit of specialised cracking hardware.