Nalar / independent articles for builders

Think clearly.
Build better.

A place to share practical knowledge and experience in programming and technology, with useful resources for software development, technology innovation, and real-world engineering problems.

Explore latest Browse tools

About this space 01

Practical writing about software, systems, and the small details that make products feel solid.

01 / Latest

Fresh from the notebook

Cybersecurity 20 Sep 2026 6 min read

Webhook HMAC Signatures Need Replay Controls

Webhook HMAC Signatures Need Replay Controls A webhook receiver often needs to decide whether an HTTP request came from a configured sender and whether the payload changed in transit. A keyed message authentication code can support that decision when both sides share a secret and compute the tag over the same bytes. That property does not make a captured request single-use. If an attacker records a valid request and submits the same authenticated material again, the tag can remain valid. Replay resistance therefore has to be part of the webhook protocol around the MAC, not an assumption attached to the MAC itself.

Cybersecurity Webhooks

Software Engineering 20 Sep 2026 6 min read

Visibility Timeouts Turn Message Delivery into a Renewable Lease

A queue consumer often needs time to perform work before it can safely acknowledge a message. Removing the message at receive time would make a consumer crash capable of losing work. Keeping it immediately available would let several consumers process the same item at once. A visibility timeout occupies the middle ground. Receiving a message makes it temporarily unavailable to competing consumers. The consumer gets a bounded interval to finish and acknowledge it. If that interval expires first, the queue can expose the message for another delivery.

Software Engineering Message Queues

Cybersecurity 20 Sep 2026 7 min read

Trust Forwarded Headers Only from Known Proxies

Trust Forwarded Headers Only from Known Proxies A reverse proxy often knows facts that an application server cannot observe directly. It may terminate TLS, accept the public hostname, and receive the client connection before opening a separate connection to the backend. Forwarding fields carry those facts across the second hop. That arrangement is safe only when the backend can distinguish proxy-supplied metadata from client-supplied HTTP fields. A header name does not create trust. The trust comes from the network path, the proxy configuration, and a rule that defines which hop may set or replace each field.

Cybersecurity Reverse Proxy

Software Engineering 20 Sep 2026 6 min read

Transactional Outbox Keeps Database State and Events Aligned

A service often needs one operation to change database state and emit an event. An order may move to paid while OrderPaid must reach a message broker. Those two writes cross different systems, so a normal database transaction cannot make both commits atomic. Writing the database first leaves a gap: the process can stop after commit but before publishing. Publishing first creates the opposite gap: consumers can observe an event for a database change that later fails.

Software Engineering Transactional Outbox

Software Engineering 20 Sep 2026 7 min read

Tombstones Preserve Deletes Across Replicas Until Safe Garbage Collection

Tombstones Preserve Deletes Across Replicas Until Safe Garbage Collection Deleting a value from one copy of replicated data is not enough to delete it from the system. Another replica may be offline, delayed, or partitioned when the delete occurs. If the active replica simply removes the record, it also removes the evidence that a deletion happened. A stale replica can later return with an older value and make that value visible again.

Software Engineering Distributed Systems

Software Engineering 20 Sep 2026 6 min read

Token Buckets Separate Sustained Rate from Burst Capacity

A rate limit expressed only as “100 requests per second” leaves an important policy question open. Can a client send 100 requests at the first instant of each second, or must those requests be spread evenly? A token bucket makes that distinction explicit by separating sustained rate from burst capacity. The limiter maintains a balance of tokens up to a fixed capacity. Tokens arrive at a configured refill rate. An operation is admitted only when enough tokens are available, and admission deducts its cost from the balance. Idle time accumulates capacity for a later burst, but never beyond the bucket limit.

Software Engineering Rate Limiting

02 / Topics