anchor.diff:  
   ### <a id='public-networks-example'></a>Public Networks ###
   
  -Apps often require public network connectivity to retrieve application dependencies, or to integrate with services available on public networks. Example application dependencies include public Maven repositories, NPM, RubyGems, and Docker registries.
  +Applications often require public network connectivity to retrieve application dependencies, or to integrate with services available on public networks. Example application dependencies include public Maven repositories, NPM, RubyGems, and Docker registries.
   
   <p class='note'><strong>Note</strong>: You should exclude IaaS metadata endpoints, such as <code>169.254.169.254</code>, because the metadata endpoint can expose sensitive environment information to untrusted applications. The <code>public_networks</code> example below accounts for this recommendation.</p>
   
  
positive.code: 
  ## <a id='binding-groups'></a>Binding Application Security Groups ##
  
  <p class='note'><strong>Note</strong>: Binding an ASG does not affect started apps until you restart them. To restart all of the apps in an org or a space, use the <a href="https://github.com/cloudfoundry-incubator/app-restarter">app-restarter</a> cf CLI plugin.</p>
  
  To apply an ASG to application containers, you must first bind it to a default set or a space.
  
  
negative.code: 
  ## <a id='updating-groups'></a>Updating Application Security Groups ##
  
  <p class='note'><strong>Note</strong>: Updating an ASG does not affect started applications until you restart them. To restart all of the applications in an org or a space, use the <a href="https://github.com/cloudfoundry-incubator/app-restarter">app-restarter</a> cf CLI plugin.</p>
  
  To update an existing ASG, run the following command, replacing `SECURITY-GROUP` with the name of your security group, and `PATH-TO-RULES-FILE` with the absolute or relative path to a rules file.
  <pre class="terminal">
  