All articles

Cybersecurity / 19 Sep 2026 / 7 min read

SSH Host Key Continuity Is a Client Trust Boundary

SSH Host Key Continuity Is a Client Trust Boundary An SSH connection can negotiate strong encryption and still authenticate the wrong server. Encryption protects the transport after key exchange establishes its cryptographic context; it does not independently tell a client that the server key belongs to the intended host. That identity decision rests on host-key verification. For many interactive clients, the visible artifact is a known_hosts entry. The deeper security property is continuity: a client needs a trustworthy basis for accepting a host key now and for deciding whether a different key later represents legitimate rotation or an unexpected endpoint.

Cybersecurity SSH

Tech / 19 Sep 2026 / 7 min read

SMTP Does Not Grant Sender Identity: From Headers, SPF, DKIM, and DMARC

SMTP answers a transport question: which server accepts this message and relays it toward its destination? It does not, by itself, prove that the address displayed in the message’s From: header belongs to the system that opened the SMTP connection. That distinction explains a common surprise. A mail client can connect to an external SMTP service, authenticate successfully, and submit a syntactically valid message with From: user@gmail.com. The SMTP login proves that the client may use that service. It does not give the service authority over gmail.com.

SMTP Email

Linux / 19 Sep 2026 / 4 min read

signalfd Converts Linux Signals into File-Descriptor Events

A conventional POSIX signal can interrupt a thread at almost any instruction boundary and transfer control to a signal handler. That asynchronous control flow imposes strict limits on handler code and complicates programs whose main control plane already runs through epoll, poll, or select. Linux signalfd() provides a different delivery interface. A process blocks selected signals in the normal signal mask, creates a signalfd for that set, and receives pending signals by reading structured signalfd_siginfo records from the descriptor. The signal remains a signal at the kernel interface; only its consumption moves into ordinary file-descriptor I/O.

Linux System Calls

Cybersecurity / 19 Sep 2026 / 9 min read

Signal Protocol Is a Cryptographic Layer, Not a Transport Protocol

Signal Protocol Is a Cryptographic Layer, Not a Transport Protocol A Go service can deliver messages over WebSocket, HTTP, WebRTC, MQTT, or a store-and-forward queue without any of those transports providing end-to-end encryption. Transport encryption such as TLS protects a connection between network peers. Signal Protocol addresses a different boundary: message content is encrypted at one endpoint and remains ciphertext until the receiving endpoint processes the corresponding cryptographic session. That distinction determines where Signal Protocol belongs in an application. The relay can authenticate accounts, route envelopes, retain undelivered ciphertext, and enforce quotas, but it should not need the conversation keys required to recover message plaintext.

Cybersecurity Signal Protocol

Software Engineering / 19 Sep 2026 / 7 min read

Sequence Counters Detect Concurrent Writes Without Reader Locks

A sequence counter can let readers copy shared state without taking the writer’s lock. The reader samples a counter, copies the protected fields, then samples the counter again. A stable even value at both observations indicates that no writer overlapped the copy under the synchronization contract. A changed or odd value forces the reader to discard the snapshot and retry. This pattern moves work away from reader-side lock ownership, but it does not remove synchronization. Writers still need serialization, counter transitions need defined memory-ordering semantics, and the protected data must remain safe to access during an overlapping write. Those constraints make sequence counters suitable for some read-mostly snapshots and unsafe for data whose lifetime can disappear beneath a reader.

Software Engineering Concurrency

Linux / 19 Sep 2026 / 5 min read

seccomp User Notifications Move Selected System Calls to a Supervisor

seccomp User Notifications Move Selected System Calls to a Supervisor A seccomp filter can do more than allow a system call or reject it in the kernel. When a filter returns SECCOMP_RET_USER_NOTIF, Linux can suspend the calling thread and deliver a description of that attempted system call to a user-space supervisor. The mechanism creates an interposition boundary around selected calls. It is useful when a less-privileged process needs an operation mediated by another process, such as a container manager handling a call that the container cannot perform directly. The boundary is deliberately narrower than a general security-policy engine: notification state can race with mutable target memory, and the kernel documentation warns against treating the supervisor’s inspection as an authorization primitive.

Linux seccomp

Software Engineering / 19 Sep 2026 / 6 min read

seccomp User Notification Moves Selected Syscall Decisions to a Broker

A seccomp filter can do more than allow or reject a system call immediately. With user notification, a matching call can be suspended while another process receives a structured request on a listener file descriptor and decides what result the blocked thread receives. The mechanism turns selected syscall decisions into a brokered interface without moving the entire syscall implementation into user space. The boundary is precise but narrower than a general interposition layer. The kernel still owns syscall dispatch, task state, descriptor tables, and validation performed by kernel code. The broker receives metadata and can return a value, an error, or in supported cases request continued execution of the original syscall. Correct designs account for mutable target memory, notification lifetime, and the fact that a policy decision is not automatically a transaction over process state.

Software Engineering Linux

CSS / 19 Sep 2026 / 8 min read

Runtime Class Composition Is Not CSS Generation

A function that returns a class string and a compiler that emits CSS solve different problems, even when both eventually produce a `class` attribute in the browser. That distinction matters when a Tailwind component recipe starts like this: const button = tv({ base: 'inline-flex rounded-md', variants: { color: { success: 'bg-green-500 hover:bg-green-700', }, disabled: { true: 'pointer-events-none opacity-50', }, }, compoundVariants: [ { color: 'success', disabled: true, class: 'bg-green-300 hover:bg-green-300', }, ], }); It is tempting to expect a build step to turn that recipe into a semantic selector such as:

CSS Tailwind CSS

Database / 19 Sep 2026 / 5 min read

Run an Embedded Turso Database in SvelteKit Without Turso Cloud

A SvelteKit application does not need Turso Cloud to use Turso. The @tursodatabase/database package can open a database file directly inside the Node.js process: import { connect } from '@tursodatabase/database'; const db = await connect('local.db'); There is no database URL, authentication token, or network round trip in this configuration. The application reads and writes a local database file.

Database Turso

Software Engineering / 19 Sep 2026 / 6 min read

Request Coalescing Collapses Concurrent Cache Misses into One Fill

A cache can reduce steady-state backend traffic yet amplify work at the instant a popular entry expires. If one hundred requests observe the same missing key before any replacement value is stored, a conventional lookup path can send one hundred equivalent reads to the origin. The cache is functioning according to its lookup rules; the amplification comes from concurrency around the empty interval. Request coalescing changes that interval. The first caller for a key starts the fill, while later callers for the same key attach to that in-flight operation instead of starting equivalent work. When the operation completes, its result is distributed to the waiting callers and, when appropriate, stored in the cache.

Software Engineering Caching

Tech / 19 Sep 2026 / 7 min read

Reliable ESP32 IR Air-Conditioner Control Needs Hysteresis and State Synchronization

An ESP32 can turn a conventional infrared air conditioner into a temperature-driven controller without modifying the AC itself. The basic signal path is simple: a room-temperature sensor feeds the ESP32, the firmware decides whether cooling is required, and an IR LED transmits the same kind of frame the handheld remote would send. The difficult part is not producing infrared light. It is keeping the control loop stable while working with an appliance whose IR protocol may encode the remote’s complete state in every transmission.

ESP32 Infrared

Tech / 19 Sep 2026 / 7 min read

Reduce Voice Recording Noise with FFmpeg Without Destroying Speech

A noisy voice recording is not one problem. Low-frequency handling noise, steady microphone hiss, fan noise, electrical hum, room reverberation, clipping, and codec artifacts have different causes, so a single aggressive denoiser rarely fixes all of them cleanly. FFmpeg provides several useful building blocks for offline cleanup. A practical chain often starts by decoding the source, removing frequencies that clearly do not belong to the wanted signal, applying moderate broadband denoising, and writing the result to an uncompressed WAV file for further processing. The important part is restraint: noise reduction that is too strong can replace background noise with metallic, watery, or gated speech artifacts.

Audio FFmpeg

Tech / 19 Sep 2026 / 7 min read

Reading ESP32 I2S Pin Definitions: MCLK, BCLK, WS, DIN, and DOUT

An ESP32 audio configuration can look deceptively similar to ordinary GPIO setup: const uint8_t I2S_MCLK = 0; const uint8_t I2S_SCK = 5; const uint8_t I2S_WS = 25; const uint8_t I2S_SDOUT = 26; const uint8_t I2S_SDIN = 35; These constants do not define five interchangeable audio wires. Each represents a different part of the I2S timing and data path. A speaker amplifier can remain completely silent even when every GPIO is electrically connected if BCLK and WS are missing, the data direction is reversed, or the frame format does not match the receiving device.

ESP32 I2S

Tech / 19 Sep 2026 / 7 min read

Raw IR Capture and Replay on ESP32 Depends on Timing, Frame Boundaries, and Carrier Frequency

An infrared receiver does not hand an ESP32 a universal “button code.” At the electrical boundary, it produces a sequence of detected carrier bursts and gaps. A raw capture represents those intervals as alternating mark and space durations, usually in microseconds. A capture such as: uint16_t rawData[] = { 3570, 1620, 554, 342, 498, 1244, 496, 378, // ... }; is therefore a waveform description. Replaying it successfully depends on preserving four things together: the timing sequence, the correct frame boundary, the modulation carrier used for marks, and enough optical output from the IR LED.

ESP32 Infrared

Linux / 19 Sep 2026 / 4 min read

Random Hex Is Not a Hash: Generating Cryptographic Random Values on Linux

A command such as openssl rand -hex 32 is often described as generating a “random hash.” The output certainly looks like a SHA-256 digest: 64 hexadecimal characters. But no hash operation has happened. OpenSSL generated 32 random bytes and encoded them as hexadecimal. That distinction matters. A hash function transforms input into a fixed-size digest. A cryptographically secure random number generator produces unpredictable bytes. If the requirement is a token, session secret, API credential, nonce, or other fresh random value, the random bytes are the important part. Hashing them afterward usually adds no useful unpredictability.

Linux Randomness

Software Engineering / 19 Sep 2026 / 5 min read

process_vm_readv and process_vm_writev Transfer Memory Across Process Boundaries

process_vm_readv() and process_vm_writev() let one Linux process copy bytes directly between its address space and another process’s address space. The calls operate on vectors of local and remote memory ranges, but a successful process lookup does not make remote memory stable. Mapping changes, page accessibility, permissions, and concurrent mutation remain separate parts of the contract. These interfaces are Linux-specific system calls. They do not define C object lifetime, synchronization, or a portable interprocess-memory model.

Software Engineering Linux

Linux / 19 Sep 2026 / 6 min read

process_madvise Applies Memory Advice Across Process Boundaries

A process can consume memory on behalf of work that is coordinated elsewhere. Linux process_madvise() lets that external coordinator apply selected virtual-memory advice to ranges in the target process without injecting code into it. The target is identified by a pidfd, while the ranges are supplied as an array of struct iovec. That arrangement separates memory-policy decisions from the code that owns the mapping. A runtime manager, service supervisor, or memory controller can request reclaim-oriented or prefetch-oriented treatment for another process, subject to kernel support and permission checks. The system call does not transfer ownership of the mapping, freeze the target, or make its address space stable.

Software Engineering Linux

Artificial Intelligence / 19 Sep 2026 / 6 min read

Prefix Caching Reuses KV State Only Across Identical Prompt Prefixes

Autoregressive transformer serving often repeats the same prompt prefix across requests: a system message, a long document header, or a fixed tool schema may precede user-specific text. Prefix caching stores the key-value state produced by that shared prefix so a later request can resume computation from the cached boundary instead of recomputing the entire prefix. The useful boundary is narrower than “similar prompts.” Reuse depends on the exact token sequence and on model state that affects the cached activations. A one-character text edit may preserve most tokens, shift tokenization near the edit, or change every token after a formatting boundary. The cache can only reuse the portion whose effective input is still identical.

Artificial Intelligence Language Models

Tech / 19 Sep 2026 / 5 min read

Power Architecture Inside a Wi-Fi Smart LED Bulb

A mains-powered smart LED bulb has two electrical jobs that should not be collapsed into one. Its LED array needs controlled current at a voltage determined by the LED string, while its Wi-Fi or Bluetooth controller needs a stable low-voltage supply. A simplified architecture is: 220-240 V AC | input protection and rectification | +--> LED power stage --> R / G / B / WW / CW channels | +--> low-voltage supply --> MCU + Wi-Fi/Bluetooth + control logic The exact topology varies between products. The important boundary is the separation between LED power and logic power.

Smart Bulb LED Driver

Web Development / 19 Sep 2026 / 6 min read

Plugin-Driven Blocks in a React Page Builder

A page builder does not need to compile every block into one permanent application bundle. The core can stay stable while independently shipped plugins register new block types, provide editor controls, and define how those blocks appear on the public site. The important boundary is not React itself. It is the contract between the builder core and each block. Once that contract is explicit, the editor can remain a single React application while blocks, CSS, and optional frontend JavaScript are loaded only when required.

Web Development React

Linux / 19 Sep 2026 / 6 min read

pidfd_getfd Duplicates a Live Descriptor Across Process Boundaries

A process can acquire a new descriptor that refers to the same open file description as a descriptor already held by another process, without asking that target process to send it. Linux provides this operation through pidfd_getfd(). The resulting descriptor is local to the caller, but the kernel object behind it is shared with the target descriptor. That distinction matters because a descriptor number is only an entry in one process’s descriptor table. The open file description carries state such as the current file offset and file status flags. Duplicating across a process boundary therefore transfers access to an existing kernel file instance rather than reopening the pathname or constructing an independent instance.

Software Engineering Linux

Linux / 19 Sep 2026 / 5 min read

PID File Descriptors Give Linux a Stable Handle for Process Lifecycle Events

A numeric PID can name one process now and a different process later. Linux PID file descriptors change that boundary: a pidfd is a file descriptor that refers to a task, so process operations can remain attached to the intended kernel object instead of repeating a lookup by numeric PID. This distinction matters in supervisors, service managers, container runtimes, and other software that observes process lifecycles. A PID is useful for naming, but it is not a durable capability. A pidfd can participate in file-descriptor APIs and can be retained across the interval between identifying a process and acting on it.

Linux Processes

Tech / 19 Sep 2026 / 7 min read

PCIe Posted Writes Separate CPU Completion from Device Visibility

PCIe Posted Writes Separate CPU Completion from Device Visibility An MMIO store can be complete from the CPU’s point of view while the corresponding write is still moving through the I/O path. PCI and PCIe memory writes are normally posted: the requester does not wait for a completion response for each write. Bridges and interconnect logic can accept the transaction and let the CPU continue before the endpoint has consumed it.

PCIe MMIO

Tech / 19 Sep 2026 / 6 min read

PCIe Posted MMIO Writes Can Outlive the CPU Store That Issued Them

A CPU can retire or complete an MMIO store before the corresponding PCIe Memory Write has reached the target device. The gap exists because PCIe Memory Write requests are posted: the requester sends them without waiting for a completion packet from the completer. That property is useful for throughput, but it creates an important boundary. A software-visible store instruction, an ordering barrier, and device observation of the write are not automatically the same event.

PCIe MMIO