Nalar / independent articles for builders

Think clearly.
Build better.

A place to share practical knowledge and experience in programming and technology, with useful resources for software development, technology innovation, and real-world engineering problems.

Explore latest Browse tools

About this space 01

Practical writing about software, systems, and the small details that make products feel solid.

01 / Latest

Fresh from the notebook

Cybersecurity 16 Sep 2026 7 min read

WebSocket Origin Checks Keep Browser Sessions Inside an Explicit Trust Boundary

A user can be signed in to a WebSocket-backed application while browsing an unrelated site in another tab. JavaScript on that unrelated site can attempt a WebSocket connection to the application’s endpoint. If the browser attaches credentials applicable to the handshake and the server upgrades the connection without checking the initiating origin, the new message channel can inherit authenticated authority that the page itself was never meant to receive. This boundary differs from ordinary cross-origin fetch() handling. WebSocket establishes its own protocol channel through an HTTP opening handshake, and the server has to decide whether the browser origin named in that handshake is permitted to create the channel. CORS response policy is not a substitute for that decision.

Cybersecurity WebSocket

Cybersecurity 16 Sep 2026 9 min read

WebAuthn RP IDs Bind Credentials to Domain Scope, Not a Single Origin

WebAuthn RP IDs Bind Credentials to Domain Scope, Not a Single Origin An authentication service at https://login.example.com can create a WebAuthn credential scoped to example.com rather than only to its own host. That choice permits eligible sibling origins under the same domain to request use of the credential, yet an assertion still carries the calling origin for server-side validation. WebAuthn deliberately separates these two identities. The split solves a practical architecture problem: one relying party can operate across multiple web origins without issuing an unrelated credential for every host. It also creates a security boundary that is easy to flatten incorrectly. The RP ID controls credential scope at the client and authenticator layers; the origin identifies the web context that initiated a ceremony. Treating either value as a substitute for the other can expand authentication authority beyond the intended deployment.

Cybersecurity WebAuthn

Artificial Intelligence 16 Sep 2026 5 min read

Version Embedding Spaces as Incompatible Interfaces

Two embedding models can emit vectors with the same number of dimensions and still produce similarity scores that have no useful cross-version meaning. A vector database accepts the shapes, the distance function runs normally, and retrieval returns ranked results. Nothing in that execution path proves that query and document vectors occupy a compatible representation space. This makes embedding model identity part of the retrieval interface. Replacing an encoder is not equivalent to swapping a serialization routine. Unless compatibility is explicitly established, vectors produced by separate model versions should be treated as belonging to separate spaces.

Artificial Intelligence Embeddings

Artificial Intelligence 16 Sep 2026 6 min read

Verify Speculative Decoding Without Changing Model Output

Autoregressive generation normally asks the target model to produce one next-token distribution at a time. Speculative decoding changes that execution pattern. A cheaper draft model proposes several tokens, then the target model evaluates those candidates in a batch and decides how much of the proposal can be accepted. The useful property is not merely that two models participate. The verification rule determines whether the optimization preserves the target model’s intended decoding distribution or silently changes it.

Artificial Intelligence LLM

Software Engineering 16 Sep 2026 6 min read

Vary Expands HTTP Cache Selection Beyond the URI

Two GET requests for the same target URI can require different cached responses. If an origin selects representation metadata or content from request headers such as Accept-Encoding, a cache keyed only by the URI can return a representation selected for a different request. HTTP’s Vary response field extends cache selection across nominated request fields. It does not merely document negotiation. For a stored response carrying Vary, those nominated fields constrain whether that response can satisfy a later request without revalidation.

Software Engineering HTTP

Tech 16 Sep 2026 5 min read

USB Selective Suspend Reduces Power for Idle Devices

USB does not require every attached device to remain fully active whenever the computer is running. A host can suspend an idle USB device while other devices continue transferring data. This behavior reduces unnecessary power use, especially on portable systems with several peripherals. The useful distinction is scope: selective suspend targets an idle device or interface rather than treating the entire USB controller as one power unit. Suspend applies to idle USB activity A USB host schedules transfers. When a device has no useful work pending, keeping all of its circuitry active can waste energy.

USB Power Management

02 / Topics