Blog
Notes on making things and what we learned along the way. Subscribe by RSS
178 posts
Validating DPoP proofs: which replays jti, htm, htu and nonce stop, and which they don't
What a server must check when it receives an OAuth 2.0 DPoP proof JWT, and how far jti, htm, htu, iat and nonce go in limiting replay, based on RFC 9449 alone.
Why a Go Pointer-Receiver Method Can Be Called but Doesn't Satisfy the Interface: Method Sets and Addressability
c.Inc() compiles, yet assigning c to an interface fails. This post uses the Go spec's method set and addressability rules to explain why, with map elements, embedding and method values.
Why a PostgreSQL Index Only Scan still reads the table: the visibility map and Heap Fetches
PostgreSQL index-only scan requirements, how the visibility map avoids MVCC heap checks, and INCLUDE covering index tradeoffs in PostgreSQL 18, plus diagnosis via Heap Fetches and relallvisible.
Project Euler 8: The Largest Product of 13 Adjacent Digits with a Zero-Counting Sliding Window
Largest product of 13 adjacent digits via a sliding window that tracks the zero count and nonzero-digit product separately. Why it never divides by zero, why 64-bit is needed, in C++17 and Python 3.
HTTP 421 Misdirected Request: when a reused HTTP/2 connection reaches the wrong server
HTTP/2 can carry several origins on one connection, yet a server may still answer 421. What RFC 9110 and 9113 say about authority, connection reuse and retrying on a new connection.
Holding a process by file descriptor instead of PID: Linux pidfds and PID reuse
kill(PID) can signal the wrong process once a PID is recycled. What pidfd_open, polling for exit, pidfd_send_signal and waitid(P_PIDFD) do and do not guarantee, per the man pages.
Range sums with a Fenwick tree: the ranges i & -i picks and where O(log n) comes from
How a Fenwick tree uses i & -i to give each cell a range, traced on 8 elements through update and prefix-sum loops, with index conventions, build cost, overflow and segment trees.
AP Subject A 38 — Management and strategy mixed diagnostic: KPI, procurement, EVM, risk, and investment
The final AP Subject A management and strategy diagnostic: five original case questions on KPI, procurement, EVM, ALE, NPV, and staged decisions.
AP Subject A 37 — Cross-domain technical diagnostic: performance, DB, networks, security, availability and retries
AP Subject A technical diagnostic: page-fault units, binary search vs B-tree I/O, CIDR and TLS/auth, shared-power availability and retry idempotency in 5 original questions.
AP Subject A 36 — Facility management: from power paths, UPS and N+1/2N to airflow, path diversity and physical access
AP Subject A supplement: utility-to-rack power paths, UPS runtime, N+1 vs 2N, cold/hot aisles, seismic isolation, surge and fire, MDF/IDF path diversity, physical access and 4 original questions.
AP Subject A 35 — Distributed databases and data warehouses: from partitioning, replication, CAP and two-phase commit to ETL and OLAP
AP Subject A supplement: partitioning and sharding, replication and consistency, CAP during a partition, two-phase commit, DWH, data marts, ETL/ELT, star schema, OLAP, 5 original questions.
AP Subject A 34 — Wireless LAN: from CSMA/CA, hidden terminals and channel design to WPA3 and 802.1X
AP Subject A supplement on wireless LAN: APs and SSIDs, CSMA/CA, hidden terminals and RTS/CTS, 2.4/5/6 GHz channels, Wi-Fi 4–6E, MIMO, roaming, HaLow, WPA2/WPA3, 802.1X, 5 original questions.
AP Subject A 33 — Compilers and language processing: from lexical, syntax and semantic analysis to optimization
AP Subject A supplement on compilers: lexical, syntax and semantic analysis, three-address code, safe optimization (constant folding, CSE), code generation, worked examples and 5 original questions.
Can you resend requests after an HTTP/2 GOAWAY? Last-Stream-ID, REFUSED_STREAM, and what changes in HTTP/3
GOAWAY's Last-Stream-ID marks the last stream a server may have processed; requests above it can be resent on a new connection, even POST. Plus the two-step shutdown, REFUSED_STREAM and HTTP/3.
2026 Applied Information Technology Engineer Examination, Subject A — Part 3: Probability, Expected Value, and Statistics
Counting, conditional probability and Bayes' theorem, expected value and variance, descriptive statistics, and p-values for AP Subject A, with worked examples and four original questions.
Applied Information Technology Engineer Exam, Subject A, Part 4: Queueing and Throughput
M/M/1 utilization, waiting and sojourn times, unit consistency and stability, Little's law, and bottleneck throughput for AP Subject A, with worked examples and four original questions.
Applied Information Technology Engineer Exam, Subject A — Part 5: Data Structures, Searching, and Sorting
Choosing data structures, linear vs binary search, and bubble, insertion and merge sort traces with complexity and stability for AP Subject A, with four original questions.
Applied Information Technology Engineer Exam, Subject A, Part 6: Pseudocode, Recursion, Complexity, and State Transitions
Pseudocode traces, loop termination and Euclid's algorithm, recursion traces, exact counts and complexity, and state transition tables for AP Subject A, with five original questions.
2026 Applied Information Technology Engineer Exam Subject A 007 — CPU, Cache, and Performance Calculations
CPU time and clock period, weighted CPI, cache hit rate and effective access time, and pipeline timing and hazards for AP Subject A, with worked examples and five original questions.
[2026 AP Subject A #8] RAID, Availability, and Reliability
RAID capacity and fault tolerance, RAID vs backup, series and parallel reliability, and MTBF/MTTR availability for AP Subject A, with worked examples and five original questions.
Applied Information Technology Engineer Exam, Subject A #9 — OS, Virtual Memory, and Deadlock
Processes, threads and state transitions, a round-robin trace, FIFO vs LRU paging, thrashing, and deadlock safe states for AP Subject A, with five original practice questions.
AP Subject A #10 — Cloud, Virtualization, and Distributed Processing
VMs vs containers, IaaS/PaaS/SaaS shared responsibility, scale-up vs scale-out, load balancing, partial failure and idempotency for AP Subject A, with five original questions.
Hardware, Circuits, Measurement, and Control
Combinational and sequential circuits, full adders, D flip-flops, memory types, sampling, quantization and feedback control with PWM for AP Subject A, with five original questions.
UI, Accessibility, and Media-Size Calculations
UI principles, accessibility, GUI controls and usability evaluation, plus raw image, audio and video size and compression calculations for AP Subject A, with five original questions.
AP Subject A #13: Database keys, functional dependencies, and normalization
Keys and attribute closure, full, partial and transitive dependencies, anomalies, 1NF to 3NF, lossless decomposition and the BCNF boundary for AP Subject A, with five original questions.
AP Subject A #14: SQL joins, aggregation, and NULL
SQL SELECT/WHERE, INNER vs LEFT JOIN, GROUP BY/HAVING and COUNT, NULL and three-valued logic, NOT IN pitfalls and DISTINCT for AP Subject A, with five original questions.
AP Subject A 15: Transactions, Concurrency, and Recovery
ACID, COMMIT/ROLLBACK, S/X locks and deadlock, isolation levels and anomalies, and WAL-based UNDO/REDO recovery for AP Subject A, with traced examples and five original questions.
AP Subject A 16: Network Layers, TCP/UDP, and Ports
OSI and TCP/IP layers, connection devices, MAC/IP/port roles, encapsulation, TCP vs UDP, and well-known ports for AP Subject A, with a traced HTTPS connection and five original questions.
AP Subject A 17: IPv4 Subnets, CIDR, and Routing Decisions
IPv4 masks and AND, subnet ranges, equal subnetting, CIDR aggregation, longest-prefix routing, and private address ranges for AP Subject A, with worked examples and five original questions.
AP Subject A 18: DNS, HTTP, TLS, and Mail Communication
DNS roles and TTL, HTTP status codes, cookies, sessions and caching, TLS in HTTPS, HTTP/3 over QUIC, and SMTP, POP3 and IMAP for AP Subject A, with a URL trace and five original questions.
AP Subject A 19: Symmetric Keys, Public Keys, Hashes, Digital Signatures, and PKI
Symmetric vs public-key key use, hash vs MAC vs signature, hybrid encryption, and PKI chain validation with CRL/OCSP for AP Subject A, with a worked flow and five original questions.
AP Subject A 20: User Authentication, MFA, Biometrics, Authorization, and Access Control
MFA factors, OTP and SSO, authentication vs authorization, least privilege, separation of duties and RBAC, and biometric FAR/FRR for AP Subject A, with five original questions.
AP21 — Major Attack Techniques and Layered Defenses
Separate SQL injection, XSS and CSRF by root cause, layer defenses for phishing, ransomware and DDoS, and compare firewall, WAF, IDS and IPS for AP Subject A, with five original questions.
AP22 — Requirements, UML, and Object-Oriented Design
Requirements and traceability, four UML diagrams, multiplicity, encapsulation, polymorphism, cohesion and coupling for AP Subject A, with a library-loan example and five original questions.
AP23 — Testing, Quality, and Development Methods
Test levels, boundary values, decision vs condition coverage, defect density and Agile, TDD and CI/CD for AP Subject A, with worked coverage math and five original questions.
AP24 — PERT, Critical Path, EVM, and Project Management
WBS, forward and backward passes for critical path and float, PERT three-point estimates, EVM SPI, CPI and EAC, and baseline change control for AP Subject A, with five original questions.
AP25 — SLA, Incident, Problem, Change, and Release Management
SLA, SLO and SLI, availability and allowed-downtime math, incident vs problem management, and change and release flow for AP Subject A, with an outage case and five original questions.
AP26 System Audit, Internal Control, Security Risk, and Incident Handling
System audit independence and evidence, internal control and segregation of duties, ALE risk math, and incident evidence preservation for AP Subject A, with five original questions.
AP27 — System Strategy, Process Improvement, Requirements, and Procurement
Information-system strategy, EA (BA/DA/AA/TA), ECRS and BPM/BPR, requirements definition, and RFI/RFP/RFQ with weighted proposal scoring for AP Subject A, with five original questions.
AP28 — Business Analysis, Marketing, Metrics, and Technology Strategy
PEST, Five Forces, SWOT and 3C, STP vs 4P, CSF/KGI/KPI funnel math, BSC perspectives, PoC/PoV/PoB/MVP and roadmaps for AP Subject A, with one case and five original questions.
AP29 — Accounting, Break-even Analysis, and Investment Appraisal
Financial statements and ratios, fixed vs variable costs, break-even point and safety margin, and NPV, IRR, payback and WACC for AP Subject A, with four original questions.
AP30 — AI Model Evaluation, Data, and Statistical Interpretation
Data splits, overfitting and leakage, confusion-matrix precision, recall and F-measure, imbalanced data, and sampling bias for AP Subject A, with four original questions.
AP Subject A 31 — Law and Standardization
Copyright, patents, trade secrets, personal data and unauthorized access laws, contracting vs worker dispatch, and JIS/ISO standards for AP Subject A, with four original questions.
AP Subject A 32 — AP1–32 core-map mixed diagnostic: closing the database gaps
AP Subject A diagnostic closing the AP1–32 core map on database gaps: B-tree, hash, bitmap and covering indexes, page-access cost math, GRANT/REVOKE and least privilege, with five original questions.
AP Subject A Essentials 2: Logic, Sets, Truth Tables, and De Morgan's Laws
Sets and Venn diagrams, logical operations and precedence, implication, truth tables, and De Morgan's laws for AP Subject A, with worked examples and original practice questions.
Project Euler 7: The 10001st Prime with a Sieve of Eratosthenes That Doubles in Size
Finding the n-th prime when the sieve bound is unknown: start small and double. We derive the sieve from trial division, show why doubling costs only a constant factor, with C++17 and Python 3 code.
Low average CPU, slow requests: diagnosing cgroup v2 cpu.max throttling
cgroup v2 cpu.max caps CPU time per period, so a multithreaded job can stall even when average usage is under the limit. How to confirm it read-only with cpu.stat.
HTTP Message Signatures (RFC 9421): what Signature-Input actually signs
What Signature-Input and Signature carry in RFC 9421, how the signature base is built, and what keyid, created, nonce and Content-Digest (RFC 9530) do not guarantee.
JavaScript Object Key Order: Why Object.keys Puts Numeric Keys First
Why integer-like keys jump to the front in Object.keys, per ECMA-262's OrdinaryOwnPropertyKeys: the array index range, symbols, deleted and re-added keys, and JSON.stringify order.
AP Subject A Essentials 1: Binary, Two's Complement, and Bit Operations
Learn radix conversion, two's complement, overflow, bit masks, and shifts for the AP Subject A exam through an official past question and original diagnostics.
HTTP 103 Early Hints: sending Link headers before the final response, and where clients must stop
What a 103 Early Hints response carries per RFC 8297 and RFC 9110, how far a client may act on the hints, what happens with several 103s, and why HTTP/1.1 needs care.
cgroup v2 memory.high vs memory.max: Throttling Versus OOM
In cgroup v2, memory.high throttles and adds reclaim pressure, while memory.max is the hard limit that can lead to OOM. Covers memory.events and memory.oom.group from the kernel docs.
Project Euler 6: The Square of the Sum Minus the Sum of the Squares in O(1)
Square of the sum minus sum of squares for 1 to 100, loop-free via n(n + 1) / 2 and n(n + 1)(2n + 1) / 6, both derived by pairing and telescoping, plus integer-range notes and C++17/Python 3 code.
HyperLogLog: How the Harmonic Mean Estimates Distinct Counts, and What 1.04/√m Assumes
How HyperLogLog, per the 2007 Flajolet et al. paper, estimates distinct counts with register index j and ρ, why it uses a harmonic mean, its range corrections, and what 1.04/√m assumes.
SSH StrictHostKeyChecking yes, accept-new, ask and no: how known_hosts handles new and changed host keys
How the OpenSSH client treats an unknown or changed host key under each StrictHostKeyChecking value, the known_hosts line format, and ssh-keygen -F, -R and -H, per OpenBSD manuals and RFC 4251.
Python attribute lookup order: why a data descriptor beats the instance __dict__, and when __set_name__ runs
obj.x checks data descriptors before the instance __dict__. How __set__ or __delete__ sets the order, why cached_property can be overwritten, and why late-added descriptors miss __set_name__.
PostgreSQL transaction ID wraparound: why VACUUM freezes rows and how to read age(datfrozenxid)
What happens when PostgreSQL's 32-bit transaction ID wraps: freezing, relfrozenxid/datfrozenxid, anti-wraparound autovacuum, warnings, write refusal and recovery, per the PostgreSQL 18 docs.
Why a QUIC connection survives a client IP change: connection IDs, path validation, and what the load balancer has to do
QUIC ties packets to a connection by connection ID, not address. From RFC 9000: path validation when the client address changes, why each path needs a new connection ID, and load balancers.
O_DIRECT alignment on Linux: ask statx instead of guessing
Linux O_DIRECT alignment of buffer address, offset and length varies by filesystem and kernel. Get it with STATX_DIOALIGN (6.1) and STATX_DIO_READ_ALIGN (6.14), and check stx_mask.
Project Euler 5: Building the Smallest Number Divisible by 1 to 20 from Least Common Multiples
Build the smallest number divisible by 1 to 20 by folding lcm(a, b) = a / gcd(a, b) × b with Euclid's algorithm, plus a correctness proof, overflow notes, and C++17 and Python 3 code.
Jump consistent hash: picking a shard number without a lookup table, and what it assumes
Growing from 10 to 12 shards, hash mod n moves 5/6 of the keys; only 1/6 has to move. Lamping and Veach's code, why it works, and what adding or removing buckets does.
TLS Certificate Name Mismatch: What a Client Actually Compares (RFC 9525)
What a TLS client compares with the certificate's SAN under RFC 9525: reference identifiers, DNS-ID and IP-ID, the Common Name ban, wildcards, mismatch handling, and a checklist.
Where does a Python generator's return value go? StopIteration.value and PEP 479
A generator's return value never shows up in a for loop; it rides on StopIteration.value. How yield from gets it, why StopIteration in a generator becomes RuntimeError, and what close() returns.
HTTP Expect: 100-continue: The Rules for Waiting Before Sending a Request Body
How Expect: 100-continue works under RFC 9110 and RFC 9112: rules for clients, origin servers, and proxies, what 417 Expectation Failed means, and closing the connection after an early rejection.
Why clock_gettime() may not show up in strace: the Linux vDSO
Your program calls clock_gettime(), yet strace shows no such call. A look at the vDSO the Linux kernel maps into each process, and how to read a syscall trace with it in mind.
Boyer–Moore majority vote: one candidate, one counter, and why you need a second pass
MJRTY (Boyer and Moore, 1980) picks a majority candidate with one value and one counter. Its rules, why it works, the wrong answer when no majority exists, and the second pass.
Project Euler 4: Searching Products from the Top for the Largest Palindrome
Find the largest palindrome product of two 3-digit numbers by searching big products first and pruning, with a proof the pruning is safe, the link to 11, and C++17 and Python 3 code.
What Referrer-Policy puts in Referer: the full URL, the origin, or nothing
Referrer-Policy decides what goes in Referer when a page loads an image or follows a link. The eight values, what is always stripped, where the policy is set, redirects and the Origin header.
How a Python with block swallows exceptions: __exit__ return values and return in finally
When __exit__ returns a true value, the with statement suppresses the exception. How that differs from return in finally, and how to write a suppressor that catches only what you mean.
What PostgreSQL data checksums catch, and what they don't
PostgreSQL data checksums detect corrupted pages on read. Covers when checks run, enabling them offline with pg_checksums, pg_stat_database counters, and what amcheck and backups still cover.
Why small TCP writes stall: Nagle's algorithm, delayed ACKs and TCP_NODELAY
Split a request into two small writes and the second piece can wait for the peer's ACK. What RFC 896, 1122 and 9293 say about Nagle's algorithm and delayed ACKs, and what TCP_NODELAY changes.
Pinned to CPUs 0-7 but running only on 2-3: how Linux cpusets narrow your affinity mask
The kernel silently intersects your sched_setaffinity mask with the CPUs your cpuset/cgroup allows and the CPUs that exist. How to see the real set and diagnose EINVAL, per the man pages.
Union-find path compression and weighting: which implementation the α(n) bound belongs to
How size weighting, path compression and path halving change a union-find parent array, and which bound, worst-case Θ(log n) or O(m α(n)) per sequence, algs4 gives each implementation.
Project Euler 3: Finding the Largest Prime Factor by Dividing It Out
Find the largest prime factor of a 12-digit number by trial division. Covers why the leftover value is prime, the √n iteration bound, 64-bit integer range, and C++17 and Python 3 code.
The KMP failure function: where the pattern goes after a mismatch
How KMP string search picks the pattern position to compare after a mismatch: the f and next tables, how to build them, and why the search is linear, from the 1977 paper and Princeton's code.
What WebAuthn signCount tells you: the counter check and clone signals
Per WebAuthn Level 3: what signCount counts, when it stays at zero, the exact comparison an RP runs, why a lower or equal value is a signal rather than proof, and how the BE and BS flags relate.
Why a Go error holding a nil pointer is not nil
A Go interface value carries a dynamic type and a dynamic value. Why returning a nil pointer as an error makes err != nil true, safe return patterns, and the limits of checking.
SQLite BEGIN DEFERRED, IMMEDIATE, and EXCLUSIVE: Handling SQLITE_BUSY Mid-Transaction
Why a mid-transaction write in SQLite can fail with SQLITE_BUSY despite busy_timeout, how BEGIN IMMEDIATE moves contention to the start, and what to retry at each failure point.
Who sent WebSocket close code 1006? Close frames, 1000/1001/1011, and the codes you must never send
A 1006 in WebSocket logs isn't a code the peer sent; it means the connection ended without a Close frame. RFC 6455's closing handshake, how the code is set, code ranges, and reconnect backoff.
Finding false sharing with perf c2c: reading code that fights over one cache line
Adding threads but not getting faster? Find false sharing with Linux perf c2c: record and report options, reading offsets, CPU support differences and fixes, per the official docs.
Project Euler 2: Adding Only the Even Fibonacci Numbers
Prove every third Fibonacci term is even, derive the even-only recurrence E(k) = 4E(k−1) + E(k−2), and sum even terms up to four million, with C++17 and Python 3 code and a correctness proof.
Project Euler 1: Summing Multiples of 3 or 5 in O(1)
Add up every number below 1000 divisible by 3 or 5 without a loop, using inclusion–exclusion and the arithmetic series formula. C++17 and Python 3 code, a correctness proof and integer-range notes.
The Linux kernel rbtree: a red-black tree with embedded nodes and no stored comparator
Linux's red-black tree never stores a comparator. Embedded nodes, your own search loop, helpers taking per-call compare functions, colour bits, cached and augmented trees, lockless lookup in v6.17.
Rust drop order: locals, fields, temporaries, and why let _ drops right away
Rust drops locals in reverse order and struct fields in declaration order. Temporaries usually die at the end of the statement, and let _ binds nothing. Plus Rust 2024's scope changes.
What REA can do, what it can do only under conditions, and what it does not support
A capability matrix for REA from its docs at a pinned commit: built-in static paths, paths that need a provider or change state, unsupported targets, and how to read Evidence and its unknowns.
Getting started with REA safely: a first exercise, a team checklist and a 30/60/90-day path
What to know first, a low-risk first investigation on the official Notes fixture, a checklist for teams, proposed success gates and a 30/60/90-day pilot with conditions for stopping.
What recent REA write-ups actually tested: runs, demos, news and opinion
Eight third-party pieces on REA, sorted by who ran what: two independent runs, two author-claimed demos, three news or opinion pieces and one discussion thread, and what each one can support.
REA's strengths and their costs, and five scenarios for the next 12 to 24 months
Each REA strength comes with a cost from the same design. Six pairs, who gains, and five conditional scenarios with counter-scenarios and signals to watch. Analysis, not a forecast.
MySQL InnoDB Gap Locks: What Gets Locked When the Row Doesn't Exist
Why InnoDB locks gaps between index records under REPEATABLE READ, why check-then-insert with FOR SHARE can deadlock, and what READ COMMITTED gives up. Based on the MySQL 8.4 manual.
REA (Reverse Engineer Anything): how it connects agents to analysis tools, what to learn, what to watch
What REA is and isn't, the agent-assisted investigation loop, the background worth having and a learning route, and the safety and rights boundaries, based on the project's official docs.
The Retry-After header: what it means on 429, 503, 413 and 3xx, and how clients should read it
Retry-After per RFC 9110 and RFC 6585: its two value formats, what it means with each status code, turning an HTTP-date or a seconds value into a wait, and handling invalid or huge values.
write() succeeded. Is the data on disk? Short writes, late errors and fsync on Linux
A successful write() does not mean the data is on disk. Handling short writes, Linux 4.13+ writeback error reporting, what fsync and fdatasync cover, and when the directory needs fsync too.
Skip lists: how coin-flip levels give O(log n) expected search
Why does adding random-level pointers to a sorted linked list make search O(log n) expected? Pugh's algorithms, what 'expected' covers, and what Java's ConcurrentSkipListMap docs promise.
What HSTS stops and what it doesn't: max-age, includeSubDomains, preload
What a browser does after receiving Strict-Transport-Security, per RFC 6797: the first-visit gap, the upside and risk of includeSubDomains, staged max-age, and why preload is no longer recommended.
Go defer: when arguments are evaluated, what order calls run in, and how results change
Go's defer evaluates arguments when the defer statement runs and calls deferred functions in reverse order just before the function returns. Here is why that lets them change named results.
PostgreSQL CREATE INDEX CONCURRENTLY: what you pay for not blocking writes
CREATE INDEX CONCURRENTLY's lock, two scans and transaction waits, INVALID index cleanup after failure, and transaction-block and partition limits, per PostgreSQL 18 docs.
HTTP ETags and Conditional Requests: If-None-Match and 304, If-Match and 412
ETags serve both cache revalidation and lost-update prevention. Per RFC 9110 and 9111: strong vs weak comparison, If-None-Match and 304, If-Match and 412, and precondition evaluation order.
Reading Linux Transparent Huge Pages settings: enabled, per-size controls, madvise and khugepaged
THP has a top-level enabled file and per-size hugepages-<size>kB/enabled files. It covers inherit, MADV_HUGEPAGE/MADV_NOHUGEPAGE and khugepaged, and how to check real use in /proc and sysfs.
Picking k random items from a stream of unknown length: reservoir sampling (Algorithm R)
Reservoir sampling picks k random items in one pass over data of unknown size. Why each item enters with probability k/i, proofs of k/n and uniform k-subsets, and a common off-by-one.
What breaks when you reuse an AEAD nonce: AES-GCM vs ChaCha20-Poly1305
What reusing a nonce under one key costs you in AES-GCM and in ChaCha20-Poly1305, and how to build nonces that never repeat, per RFC 5116 and RFC 8439.
Where does the close() exception go? Reading suppressed exceptions in Java try-with-resources
When both the try block and close() throw, which exception propagates and which ends up in getSuppressed()? Close order and multiple failures, per JLS 14.20.3.
When a PostgreSQL UPDATE needs no new index entries: HOT updates and fillfactor
PostgreSQL HOT (heap-only tuple) updates avoid new index entries when no indexed column changes and the page has room. Covers both rules, fillfactor, and pg_stat_user_tables counters.
Linux memory overcommit: overcommit_memory 0, 1, 2 and reading CommitLimit
What the three vm.overcommit_memory modes do, how to read CommitLimit and Committed_AS in /proc/meminfo, and what to check before switching to mode 2, based on the kernel documentation.
Median of Medians (BFPRT): Finding the k-th Smallest in Worst-Case Linear Time
How the PICK algorithm from the 1973 paper by Blum, Floyd, Pratt, Rivest, and Tarjan selects the k-th smallest value in worst-case linear time, and where the group size of five comes from.
TLS 1.3 0-RTT and HTTP 425 Too Early: Handling Replay on the Server
TLS 1.3 early data has no guarantee against replay across connections. Based on RFC 8446 and RFC 8470: what 0-RTT does not protect, how the Early-Data header works, and when to send 425.
Why JavaScript sort() Puts 100 Before 9: Default String Order and the Comparator Contract
[10, 9, 1, 100].sort() returns [1, 10, 100, 9]. The default string comparison, the comparator contract, in-place mutation, undefined and holes, and toSorted(), per ECMA-262.
Happy Eyeballs v2: how dual-stack clients race IPv6 and IPv4
How RFC 8305 clients query AAAA and A, sort addresses and stagger connection attempts to use whichever connects first when DNS returns IPv6 and IPv4, and what its recommended defaults mean.
Reading Linux PSI: some, full, avg and total in /proc/pressure
What some and full, avg10/avg60/avg300 and total in /proc/pressure measure, how PSI differs from iowait, and the limits on pressure triggers, based on the kernel documentation.
When is a hash table not O(1)? Collisions, O(n²) inserts and hash flooding
dict and HashMap are O(1) in expectation. Why n keys with one hash value need at least n(n−1)/2 comparisons. Python hash randomization and PYTHONHASHSEED, Rust's SipHash, Java's Comparable fallback.
Why a JWT verifier shouldn't trust alg: none, RS256→HS256 confusion and algorithm pinning
A JWT's alg header is chosen by the token's sender. Why alg none and RS256→HS256 confusion work, what RFC 8725 requires (one algorithm per key), and the iss, aud, exp, typ checks that follow.
Why L=[] as a Python default argument keeps growing: defaults are built once, at def time
Call def f(a, L=[]) three times and the list keeps growing. What the Python docs say about when defaults are evaluated, __defaults__, the None pattern and dataclass default_factory.
Using a PostgreSQL table as a job queue: FOR UPDATE SKIP LOCKED and when the lock is released
How FOR UPDATE SKIP LOCKED lets several workers share jobs in one PostgreSQL table, per the official docs: lock lifetime, LIMIT and OFFSET, ORDER BY, and locking clauses inside WITH.
HTTP Vary and Cache Keys: Reuse Rules, Vary: *, and Cache Fragmentation
Vary adds request headers to the cache key. Per RFC 9110 and 9111: when header values match, why Vary: * forces revalidation every time, and how content negotiation splits a cache.
Linux minor vs major page faults: what ru_minflt and ru_majflt count
On Linux, getrusage's ru_minflt and ru_majflt split page faults by whether I/O was needed. What the two counters measure, and why a major fault count is not a count of disk reads (man-pages 6.19).
Topological Sort and Cycle Detection: Ordering by In-Degree and Finding What Got Stuck
Implement topological sort by counting in-degrees, see what is left over when the graph has a cycle, and learn how Python's graphlib TopologicalSorter and CycleError behave.
OAuth 2.0 PKCE: Making an Intercepted Authorization Code Useless
How PKCE's code_verifier and code_challenge stop authorization code interception: S256 math, server checks, why plain and downgrades fail, where state matters, and what PKCE does not cover.
When does Python rebuild a .pyc? Timestamp vs hash-based invalidation
By default CPython trusts a .pyc if the source's mtime and size match. When that misses edits, how checked-hash and unchecked-hash pycs differ, and how to use compileall (Python 3.14.8 docs).
Why your SQLite -wal file keeps growing: checkpoints and read transactions that never end
Why an SQLite -wal file keeps growing: the 1000-page auto-checkpoint, open read transactions that stall checkpoints, PASSIVE/FULL/RESTART/TRUNCATE, and journal_size_limit, per the official docs.
Added a DNS record but it still says the name doesn't exist? NXDOMAIN, NODATA and negative caching
Why resolvers can keep saying "no such name" after you add a record: NXDOMAIN vs NODATA, the negative TTL from the SOA, the NXDOMAIN cut, and the 5-minute cap on failure caching.
aria-label or aria-labelledby: which accessible name wins?
Browsers compute an accessible name in a defined order. See how aria-labelledby, aria-label, label, and placeholder rank, with common mistakes checked against W3C documents.
Why a Bloom filter is only ever sure about "no"
Why a Bloom filter answers only "definitely not" or "possibly", the conditions behind its no-false-negative guarantee, the false positive formula, and why deleting bits breaks it.
When does a CORS preflight happen? The conditions that send OPTIONS first
When fetch() sends OPTIONS first, per the WHATWG Fetch Standard: safelisted methods and headers, why application/json and Authorization trigger a preflight, and the 5-second Max-Age default.
Why sort(() => Math.random() - 0.5) is not a fair shuffle, and what Fisher–Yates does instead
A random comparator doesn't shuffle evenly, and the ECMAScript spec says why. How Fisher–Yates makes every permutation equally likely, and the random-number pitfalls it still depends on.
git push --force-with-lease can still overwrite a teammate's commit: background fetch and --force-if-includes
What --force-with-lease compares when you force-push after a rebase, why a background fetch defeats it, and how --force-if-includes (Git 2.30) or an explicit expected value fixes that.
Getting commits back after git reset --hard with reflog
The reflog records where branches and HEAD pointed in your local repo. Find a lost commit, restore it as a branch, and learn the default 90/30-day expiry and when recovery fails.
Safe and idempotent HTTP methods: why retrying POST is risky and PUT isn't
What RFC 9110 means by safe and idempotent methods, which ones a client may resend after a dropped connection, why POST and PATCH need care, and how If-Match makes an update conditional.
Why NaN === NaN is false: how ===, Object.is and includes compare values in JavaScript
In JavaScript, NaN === NaN is false but [NaN].includes(NaN) is true. The ECMA-262 rules for how ===, Object.is, and includes, Map and Set treat NaN and -0, with code.
Is a load average of 4.0 high? What Linux load average counts and what 1, 5 and 15 minutes mean
Linux load average isn't CPU usage. It's a decaying average of runnable (R) and uninterruptible (D) tasks. How the kernel computes it, how to read it against CPU count, and how PSI differs.
Why encodeURIComponent throws URIError on a cut emoji: lone surrogates
Cut an emoji in half: encodeURIComponent throws URIError, TextEncoder writes EF BF BD. Lone UTF-16 surrogates and isWellFormed()/toWellFormed(), per ECMA-262 and Unicode 17.0.
Why two SELECTs in one transaction can disagree: PostgreSQL READ COMMITTED and snapshots
Under PostgreSQL's default READ COMMITTED level, two SELECTs in one transaction can see different data. Learn how statement snapshots, row rechecks, and transaction retries work.
real, user and sys in time output: wall-clock time vs CPU time
What real, user and sys in time output count according to POSIX, why user + sys can exceed real, and how the shell's time differs from /usr/bin/time on Linux.
How an authenticator app's 6-digit code is made: TOTP step by step
How your authenticator app's code matches the server without asking it, traced through the RFC test values: time steps, HMAC, dynamic truncation, server checks, and the phishing gap.
Why toLowerCase() Breaks Case-Insensitive Comparison: Unicode Case Folding
'straße' and 'STRASSE' differ after toLowerCase(). Case conversion vs case folding, the Turkish i, simple folding in regex /iu, and normalization, per Unicode 17.0 and ECMAScript 2026.
Linux free shows almost no free memory? Read available first
A small free column does not mean Linux is out of memory. How free derives buff/cache, available and used from /proc/meminfo, and why routinely dropping caches can hurt performance.
Why TIME-WAIT sockets pile up: TCP's 2×MSL, Linux's 60 seconds, and what tcp_fin_timeout doesn't change
Why the side that closes a TCP connection first sits in TIME-WAIT, RFC 9293's 2×MSL versus Linux's fixed 60 seconds, what tcp_fin_timeout actually controls, and tcp_tw_reuse's default.
Broken Unicode download names: filename vs filename* in Content-Disposition
How to send a Unicode download name with Content-Disposition: an ASCII filename fallback, a UTF-8 filename* value, percent-encoded bytes, precedence, and safe handling under RFC 6266 and RFC 8187.
How big should a touch target be: 24px, 44px, or 48dp?
WCAG 2.2 sets 24×24 CSS px at Level AA and 44×44 at AAA. Here is how those rules differ from Android's 48dp guidance.
Finding the commit that broke a test with git bisect run: exit codes 0, 125 and 127
How git bisect binary-searches for the first bad commit, and how git bisect run reads exit codes: 0 is good, 1–124 and 126–127 are bad, 125 skips, anything else aborts. From Git's docs.
HTTP Range requests, 206 and 416: how resuming a download works
How Range, Content-Range and If-Range work with 206 Partial Content and 416 Range Not Satisfiable, per RFC 9110, and why a server may ignore Range and send 200.
When does quicksort hit O(n²)? How standard sorts avoid the worst case
Sorted input, median-of-3 killers and adversarial comparators can push quicksort to quadratic time. This article explains introsort’s depth limit and what C++, Rust, Go and Java actually guarantee.
Why NOT IN returns no rows: SQL NULL and three-valued logic
One NULL in a subquery makes NOT IN return zero rows. Why, per the PostgreSQL, MySQL and SQLite docs: three-valued logic, how WHERE keeps rows, and fixing it with NOT EXISTS.
Why Dijkstra's algorithm fails with negative edge weights
The greedy assumption that a negative edge breaks, a three-edge counterexample, and when Bellman–Ford or a DAG shortest-path algorithm fits instead.
CSV and RFC 4180: commas, quotes and line breaks inside fields
Why a comma or newline inside a value breaks CSV columns, per RFC 4180, the IANA text/csv registration, the W3C tabular data Recommendation and Python/Go docs, and what RFC 4180 leaves open.
Two dots or three in Git: what A..B and A...B mean in log and diff
Which commits git log selects for A..B and A...B, which two points git diff compares for each, and which one pull request diffs use, from Git's own docs and a reproduced example.
401 vs 403: missing authentication or a refused request
How HTTP 401 Unauthorized and 403 Forbidden differ under RFC 9110 and the OAuth 2.0 Bearer Token spec: WWW-Authenticate, retry rules, and hiding a resource with 404.
What is 2147483647 + 1? Integer overflow in Java, Go, Rust, C and Python
In Java int, Go int32 and Rust i32, 2147483647 + 1 overflows: Java and Go wrap to a negative, Rust panics or wraps by Cargo profile, C's INT_MAX + 1 is undefined, Python gives 2147483648.
What chmod 755 and 644 mean: permission digits, rwx, and x on directories
What chmod 755 means, based on POSIX: how octal digits map to rwx, which permission class applies, directory permissions, umask, and recursive chmod.
A heap is not a sorted list: priority queue order and the 0-based index formulas
Why doesn't a printed heapq list or PriorityQueue look sorted? The heap invariant, 0-based parent/child formulas, costs versus a sorted list, and equal priorities.
^1.2.3 vs ~1.2.3 in package.json: npm version ranges and the 0.x trap
By default, ^1.2.3 accepts stable releases from 1.2.3 up to but not including 2.0.0; ~1.2.3 accepts 1.2.3 up to but not including 1.3.0. SemVer vs npm, 0.x, prereleases and lockfiles.
Is 1.0.0-rc.1 lower than 1.0.0? SemVer pre-release precedence and caret ranges
Why 1.0.0-rc.1 is lower than 1.0.0, and why ^1.2.3 does not select 1.5.0-beta.1, based on SemVer 2.0.0, node-semver and Cargo.
Why ZIP file names break: CP437 and the UTF-8 flag
Why a file named 한글.txt comes out of a ZIP as ╟╤▒█.txt: the CP437 default in PKWARE's APPNOTE, general purpose bit 11, the Info-ZIP 0x7075 field, and how Python and .NET read names.
Deleted a file but the disk space didn't come back? unlink and open files
Deleting a large file with rm doesn't always free space in df. The POSIX rules on link counts and open files, why du and df disagree, and how to find the cause and get space back on Linux.
no-cache vs no-store: which Cache-Control directive stops storage
no-cache doesn't mean "don't cache". Using RFC 9111, this post compares no-cache, no-store, max-age=0 and Pragma, and shows where behavior varies across CDNs and browsers.
Why -7 % 3 gives different answers in different languages
-7 % 3 is 2 in Python but -1 in JavaScript, Java, C and Go. Truncated, floored and Euclidean division explained, and how to get a non-negative remainder.
The UTF-8 BOM (EF BB BF): why three invisible bytes break some parsers and not others
Why EF BB BF at the start of a UTF-8 file is skipped by browsers but rejected by JSON.parse, following the rules in Unicode, RFC 3629, RFC 8259 (JSON) and the WHATWG Encoding and HTML standards.
X-Frame-Options vs CSP frame-ancestors: which clickjacking header wins when you send both
How the two headers that stop your pages being framed differ, per CSP Level 3 and the HTML Standard: which one wins when both are sent, why ALLOW-FROM is ignored, and why a meta tag won't work.
Binary search insertion points: what bisect, lower_bound and binarySearch return
What Python bisect, C++ lower_bound and Java Arrays.binarySearch return for missing and duplicate keys, and what each assumes about its input, per the official docs and the C++ standard.
Why every PNG starts with 89 50 4E 47: the signature and chunk layout
Why every PNG begins with 89 50 4E 47 0D 0A 1A 0A, how a chunk is laid out, what letter case in chunk names means, and the order of critical chunks.
What does @@ -1,7 +1,8 @@ mean? Reading a unified diff
How to read @@ in diff -u and git diff: start lines, line counts, empty ranges, the default three lines of context, and the function context Git adds, based on POSIX and official Git docs.
Why appending to a dynamic array is O(1): capacity, growth and amortized time
Append sometimes copies the whole array, yet it counts as O(1). Capacity, amortized cost, what the Java, C++, Rust and Go docs promise, and reserving space.
Git line endings: .gitattributes text and eol vs core.autocrlf
What to check when git diff shows ^M, based on Git's own documentation: what core.autocrlf and the text and eol attributes each decide, and how to fix files already committed with CRLF.
301, 302, 307 or 308? Permanent vs temporary redirects, and why POST turns into GET
The differences between HTTP redirects 301, 302, 303, 307 and 308, from RFC 9110 and the WHATWG Fetch standard: when POST becomes GET, and how caches and search engines treat each code.
What Base64 is and why we use it: how the encoding works
How Base64 turns 3 bytes into 4 characters, why the output is about 33% larger, what the trailing = means, URL-safe Base64, and handling non-ASCII text, based on RFC 4648.
What does the /24 in 192.168.0.0/24 mean? CIDR and subnets
What the /24 after an IP address means, how it relates to the subnet mask, how to work out the network and broadcast addresses and usable hosts, and the private IPv4 ranges.
Why pale gray text fails: working out WCAG color contrast
Why pale gray text on white fails accessibility checks: the WCAG 2 luminance and contrast formulas, the 4.5:1, 3:1 and 7:1 thresholds, and dark mode, with real hex values.
From domain name to IP address: how a DNS lookup works
What happens between typing a name and getting an IP address: stub and recursive resolvers, authoritative servers, caches, A and AAAA records and TTL, explained from the RFCs.
Why 0.1 + 0.2 isn't 0.3: how floating-point numbers work
Why JavaScript, Python and Java print 0.30000000000000004 for 0.1 + 0.2, explained with the IEEE 754 double format, and how to compare, round and handle money safely.
What a hash function does: SHA-256, checksums and password storage
Why SHA-256 is always 64 hex digits, why one changed letter changes everything, how hashing differs from encryption and encoding, checking downloads, and why fast hashes are wrong for passwords.
The JSON.parse error points one step past the mistake: common JSON errors
Trailing commas, single quotes, comments and NaN that JSON parsers reject, big integers and duplicate keys that change silently, and how to read an error position, based on RFC 8259.
Length beats symbols: measuring password strength in bits
Why a password that passes every uppercase-digit-symbol rule can still be weak, how to measure strength as entropy, passphrases, what NIST now recommends, and why a second factor matters more.
Why bücher.example turns into xn--bcher-kva: IDNs and Punycode
Why a domain with accents or non-Latin script shows up as xn--… in DNS settings and certificates, how Punycode spells it in ASCII, the mapping rules before it, and homograph phishing.
Why a torn QR code still scans: structure and error correction
What a QR code's corner squares, timing patterns and format info do, how version and error-correction level set its size, why a logo still scans, and checking links first.
What is a stable sort? Keeping ties in their original order
What stable sorting means, why it matters when you sort by more than one key, and what the standard sorts in Python, JavaScript, Java and C++ actually guarantee.
Why character counts disagree: bytes, code points and what you see
Why Word, a web form, an SMS and JavaScript's .length give different counts for the same text: UTF-8 bytes, UTF-16 code units, code points and grapheme clusters, and which one to use.
What time is 1790550000? Unix time, milliseconds and the 2038 problem
What a Unix timestamp counts, 10 digits versus 13, why a timestamp has no time zone, leap seconds, the year 2038 problem, and how to store times in a database.
Why URLs fill up with %C3%A9: percent-encoding explained
Why non-English characters in a link turn into %C3%A9 or %E3%81%82, how encodeURI, encodeURIComponent and URLSearchParams differ, %20 versus +, and the double-encoding bug behind %2520.
UUID v4 or v7? The 128-bit layout and the real collision odds
Where the version and variant bits sit in a UUID, what v4's collision risk actually is, and why time-ordered v7 is kinder to database indexes, based on RFC 9562.
Finding a meeting time across Seoul, Tokyo, London and New York
Why some city pairs have no shared working hours, how daylight saving moves the overlap twice a year, and a quick way to check.
No posts match. Try another word.