Nalar / independent articles for builders

Think clearly.
Build better.

A place to share practical knowledge and experience in programming and technology, with useful resources for software development, technology innovation, and real-world engineering problems.

Explore latest Browse tools

About this space 01

Practical writing about software, systems, and the small details that make products feel solid.

01 / Latest

Fresh from the notebook

Cybersecurity 24 Sep 2026 6 min read

TLS Delegated Credentials Limit Certificate Key Exposure

Large TLS deployments often need signing capability on many serving machines. Copying the certificate private key to every endpoint expands the set of systems whose compromise can expose a long-lived credential. Keeping that key in one tightly controlled location reduces exposure, but remote signing for every handshake can add an operational dependency to the serving path. Delegated Credentials for TLS, standardized in RFC 9345, provide a narrower option for TLS 1.3. A certificate holder can use its certificate private key to authorize another public key for a limited period. The endpoint receives the corresponding delegated private key and can authenticate TLS handshakes without holding the certificate private key itself.

Cybersecurity TLS

Artificial Intelligence 24 Sep 2026 5 min read

Temperature Scaling Recalibrates Classifier Confidence Without Changing Class Order

A classifier can rank the correct class above every alternative yet attach probabilities that are systematically too concentrated or too diffuse. Temperature scaling addresses that mismatch after training by applying one scalar to the logits before softmax. It changes reported confidence without changing the underlying classifier parameters. The mechanism is narrow. It does not repair incorrect class rankings, add information to the representation, or make every individual probability accurate. Its target is the relationship between confidence and observed outcomes on data representative of deployment.

Artificial Intelligence Calibration

Artificial Intelligence 24 Sep 2026 6 min read

Tanh Logit Soft Capping Bounds Extreme Scores Before Softmax

A softmax can accept logits of any finite magnitude, but large score gaps make its output increasingly concentrated. Tanh logit soft capping inserts a bounded nonlinear transform before softmax so that no transformed logit exceeds a configured magnitude. For a positive cap c, a common form is: softcap(z; c) = c * tanh(z / c) The operation does not clip at a hard threshold. It behaves almost linearly near zero and gradually compresses larger magnitudes as they approach -c or c.

Artificial Intelligence Transformers

Artificial Intelligence 24 Sep 2026 5 min read

SwiGLU Gates Transformer Feed-Forward Channels with a Second Projection

SwiGLU splits a transformer feed-forward input into two projected paths, applies SiLU to one path, then multiplies the two results element by element. The second projection is not an auxiliary statistic: its values directly gate the activated path before the output projection. For hidden state x, a common structural form is: g = SiLU(x W_gate) u = x W_up h = g * u y = h W_down Bias terms, projection orientation, intermediate width, and parameter names vary across architectures. The defining boundary is the element-wise product between a nonlinear projected branch and another projected branch.

Artificial Intelligence Transformers

Cybersecurity 24 Sep 2026 6 min read

SSHFP Anchors SSH Host Key Fingerprints in DNSSEC

An SSH client has to decide whether the host key presented by a server belongs to the intended host. A previously stored key can provide that reference on later connections, but the first connection needs another basis for authentication. SSHFP places a fingerprint of an SSH host public key in DNS so a client can compare the server key with independently retrieved data. The DNS record alone is not a trust anchor. RFC 4255 ties trusted SSHFP verification to authenticated DNS data. DNSSEC protects the lookup path and lets a validating client distinguish signed data from an unauthenticated DNS answer. The useful security property comes from that combination: SSH supplies the host key, SSHFP carries its fingerprint, and DNSSEC authenticates the DNS record used for comparison.

Cybersecurity SSH

Artificial Intelligence 24 Sep 2026 6 min read

Speculative Decoding Verifies Draft Tokens Without Changing the Target Sampling Distribution

Autoregressive decoding normally commits one token after each target-model evaluation. A sequence of K generated tokens therefore creates a serial dependency chain: token t+1 cannot be sampled until token t is fixed and becomes part of the prefix. Speculative decoding changes the amount of useful work obtained from a target-model call without removing that causal dependency. A cheaper draft model first proposes several continuation tokens. The target model then evaluates those candidate positions together. Tokens whose draft probabilities are compatible with the target distribution can be accepted, while the first rejected position is corrected using a residual distribution. The resulting samples follow the target model’s distribution when the acceptance and correction procedure is implemented as specified.

Artificial Intelligence LLM Inference

02 / Topics