All articles

Cybersecurity / 16 Sep 2026 / 8 min read

OCSP Must-Staple Turns Missing Revocation Evidence Into a TLS Failure

A TLS endpoint presents a valid certificate chain, the hostname matches, and every certificate is inside its validity period. The server does not provide the OCSP response that its end-entity certificate declares as required. For a client enforcing that certificate constraint, the missing status is not a minor loss of telemetry. The certificate is invalid for that connection. That behavior is the defining security property of OCSP Must-Staple. Ordinary OCSP stapling lets a server carry signed certificate-status evidence inside the TLS exchange. The TLS Feature extension defined by RFC 7633 can make that feature mandatory for clients that both request the feature and process the certificate extension. The change is small in encoding but significant in failure semantics: absence becomes actionable.

Cybersecurity TLS

Tech / 16 Sep 2026 / 5 min read

Network Interrupt Coalescing Batches Packets Before CPU Notification

A network interface can receive packets much faster than a CPU should be interrupted for each individual arrival. At high packet rates, one hardware interrupt per packet would consume substantial processor time in interrupt entry, scheduling, driver work, and return paths. Interrupt coalescing changes that pattern. The adapter waits for a small interval, a packet count, or another implementation-specific threshold before notifying the CPU. Several packet arrivals can then be handled from one notification.

Networking NIC

Tech / 16 Sep 2026 / 5 min read

Nagle Algorithm Batches Small TCP Writes

TCP applications can issue writes much smaller than the network’s maximum segment size. Sending every tiny write as a separate segment can consume disproportionate header and processing overhead. The Nagle algorithm limits that pattern by allowing one small segment to remain in flight while later small writes wait for an acknowledgment or enough queued data to form a larger segment. This behavior reduces streams of tiny TCP segments. It can also add latency when an application expects each small write to leave immediately.

TCP Networking

Artificial Intelligence / 16 Sep 2026 / 6 min read

Measure Gradient Noise Before Scaling Batch Size

Increasing a training batch reduces variation in the minibatch gradient, but the reduction does not continue to buy proportional progress indefinitely. Once a batch is large enough that its gradient estimate is already dominated by the underlying gradient signal, processing more examples before the next parameter update yields diminishing algorithmic returns. Gradient noise scale gives this transition a measurable form. It compares stochastic variation in per-example gradients with the magnitude of the mean gradient. The quantity is not a universal batch-size setting, and its exact estimator depends on assumptions about sampling and gradient aggregation. It is useful as a diagnostic for how much additional batch parallelism the current optimization state can absorb.

Artificial Intelligence Neural Networks

Artificial Intelligence / 16 Sep 2026 / 5 min read

Measure Embedding Anisotropy Before Vector Search

Cosine similarity assumes that vector direction carries useful discrimination. That assumption becomes less informative when many embeddings occupy a narrow region of the space. In that case, unrelated items can share a substantial directional component, cosine scores can cluster into a compressed range, and small residual differences can decide the ranking. This geometric pattern is often described as embedding anisotropy. It exists before a vector index chooses candidates, so index tuning alone cannot establish whether the representation has enough angular separation for the retrieval task.

Artificial Intelligence Embeddings

Artificial Intelligence / 16 Sep 2026 / 5 min read

Measure Classifier Calibration Beyond Accuracy

A classifier can keep the same predicted labels while its probability estimates become badly distorted. Accuracy does not expose that change. If a service uses a score of 0.9 to trigger an automated action, the numeric meaning of that score matters independently of whether the top-ranked class is correct. Classifier calibration examines that numeric meaning. For predictions assigned similar confidence, the observed outcome frequency should be close to the stated confidence when the probabilities are well calibrated for the evaluated population.

Artificial Intelligence Evaluation

Software Engineering / 16 Sep 2026 / 7 min read

Long PostgreSQL Snapshots Delay Dead Tuple Reclamation

A PostgreSQL transaction can remain idle while still preserving a visibility horizon that constrains cleanup elsewhere. Rows updated or deleted after that transaction acquired its snapshot may become obsolete for newer transactions, yet some older versions can remain potentially visible to the retained snapshot. VACUUM cannot reclaim a row version merely because the newest application state no longer references it. This is a direct consequence of multiversion concurrency control. Visibility and physical reclamation are separate decisions: one transaction changes which row version is current, while the database must retain versions that can still be observed by relevant snapshots.

Software Engineering PostgreSQL

Linux / 16 Sep 2026 / 5 min read

Linux TCP TIME_WAIT Retains Closed Connection State

A TCP socket can disappear from an application while the kernel still retains state for the closed connection. On Linux, the endpoint that completes the active close commonly enters TIME_WAIT, keeping enough protocol state to protect a later connection from delayed segments associated with the old one. This state is not evidence that a process forgot to close a file descriptor. The application-visible socket can already be gone. TIME_WAIT belongs to TCP’s connection-lifecycle machinery and persists independently of the process that initiated the close.

Linux TCP

Linux / 16 Sep 2026 / 4 min read

Linux TCP Autocorking Coalesces Consecutive Small Writes

A small TCP write does not always trigger an immediate packet transmission on Linux. With TCP autocorking enabled, the stack can defer a new small send when an earlier packet from the same flow is still waiting in a qdisc or device transmit queue, giving a following write a chance to join the pending data. The mechanism targets packet count rather than application-visible buffering semantics. A successful write() or sendmsg() still reports bytes accepted by the socket; autocorking influences when queued bytes advance into transmission.

Linux TCP

Linux / 16 Sep 2026 / 6 min read

Linux Readahead Expands Sequential Page-Cache Reads

A buffered file read can cause Linux to fetch more data than the application explicitly requested. The extra I/O is readahead: the kernel populates nearby page-cache folios in anticipation of continued access. This behavior sits between application read size and storage request size. A process may issue modest read() calls while the kernel submits larger reads to keep later accesses from waiting on storage. Readahead is page-cache speculation Buffered file I/O normally passes through the page cache. When requested file data is absent, the kernel must arrange I/O for that miss. The readahead path can extend that operation across additional folios that are not yet present in the cache.

Linux Memory

Linux / 16 Sep 2026 / 5 min read

Linux PSI Separates Partial and Total Resource Stalls

A Linux host can report modest CPU utilization while runnable work is delayed, or ample memory capacity while tasks repeatedly stall in reclaim. Utilization counters describe resource activity; pressure stall information records time in which work cannot make progress because a resource is contended. PSI exposes that lost execution opportunity through CPU, memory, and I/O pressure files. Its central distinction is between a stall affecting at least one task and a stall that leaves every non-idle task unable to make progress.

Linux PSI

Linux / 16 Sep 2026 / 6 min read

Linux cgroup memory.high Converts Overage into Reclaim Pressure

A cgroup can remain alive after its memory usage crosses memory.high. The boundary does not behave like a hard allocation ceiling: tasks in the cgroup are throttled and pushed into heavy reclaim pressure, and usage can remain above the configured value under extreme conditions. That behavior makes memory.high materially different from memory.max. The former converts excess usage into execution cost and reclaim work. The latter is a hard limit that can lead to a cgroup OOM when reclaim cannot reduce usage enough.

Linux cgroup v2

Linux / 16 Sep 2026 / 5 min read

io_uring Registered Files Bypass Repeated Descriptor Lookup

An io_uring request that uses a normal file descriptor still has to resolve that descriptor through the submitting task’s file table. A registered file takes a different path: the ring holds a reference to the open file, and an SQE names a slot in that ring-local table. That distinction removes repeated descriptor lookup from the request path. It also changes resource lifetime, update semantics, and the meaning of the SQE fd field.

Linux io_uring

Software Engineering / 16 Sep 2026 / 7 min read

If-Range Prevents Mixed-Representation Resumes

A resumed HTTP transfer can corrupt a local result without any malformed bytes if the resource changes between requests. The first response may supply bytes from one representation while a later range response supplies offsets from another. If-Range exists to bind the resumed range to the representation that produced the stored prefix. This is a representation-identity problem rather than a transport-framing problem. Byte offsets only have stable meaning relative to a particular representation. A syntactically valid 206 Partial Content response can still be unusable for recombination when its bytes belong to a different version.

Software Engineering HTTP

Software Engineering / 16 Sep 2026 / 7 min read

If-Match Turns Stale HTTP Writes Into Precondition Failures

Two clients can read the same HTTP resource, compute different replacements, and send those replacements minutes apart. If the origin accepts both writes without a precondition, the later request can overwrite the earlier result even though it was computed from stale state. HTTP provides a protocol-level guard for this case. A client can retain an entity tag from the representation it read and send that tag in If-Match with a later state-changing request. The origin evaluates the precondition before applying the method. If no listed tag strongly matches the current selected representation, the method is not performed because of that precondition.

Software Engineering HTTP

Cybersecurity / 16 Sep 2026 / 9 min read

HTTP Request Smuggling Starts When Intermediaries Disagree on Message Boundaries

A reverse proxy accepts an HTTP/1.1 request, decides where its body ends, and forwards traffic to an application server over a persistent connection. If the application server reaches a different boundary from the same framing information, the two components stop agreeing about which bytes belong to which request. Bytes treated as body data by one component can become the start of a new request for the other. That disagreement is the core condition behind HTTP request smuggling. The defect is not simply a malformed header, a proxy, or connection reuse in isolation. It is a parser differential across a chain in which multiple recipients interpret request framing and at least one connection carries subsequent traffic.

Cybersecurity HTTP

Software Engineering / 16 Sep 2026 / 8 min read

HTTP 425 Keeps Replay-Sensitive Requests Out of TLS Early Data

TLS 1.3 can carry application data before a resumed handshake completes, which means an HTTP request can reach server processing earlier than the connection has its final handshake state. That latency optimization changes a security property: early data can be replayed, so a request that is safe to execute once can become unsafe when the same bytes are accepted more than once. HTTP status 425 Too Early marks the boundary between transport acceptance and application acceptance. A server can accept TLS early data at the connection layer yet decline to process a particular HTTP request from that data. The client can then retry after the handshake completes, where the early-data replay condition no longer applies.

Software Engineering HTTP

Cybersecurity / 16 Sep 2026 / 8 min read

HSTS Caches Transport Policy Beyond the Response That Declared It

HSTS Caches Transport Policy Beyond the Response That Declared It A site can redirect every plain-HTTP request to HTTPS and still expose the first request of a fresh browser session to an active network attacker. The redirect is delivered only after the browser has already contacted the HTTP endpoint. HTTP Strict Transport Security changes that sequence by moving a transport decision into browser state. After a valid Strict-Transport-Security response arrives over secure transport, a conforming browser records policy for the host. Later attempts to reach that host through HTTP are rewritten toward HTTPS before an insecure request is sent. The control therefore persists beyond the response that declared it.

Cybersecurity HSTS

Go / 16 Sep 2026 / 4 min read

Go Map Iteration Order Is Not Stable

A range over a Go map can visit the same entries in a different order on consecutive iterations. The language specification leaves map iteration order unspecified and gives no guarantee that a later pass over an unchanged map will repeat an earlier sequence. That contract is stronger than saying that maps are merely unsorted. An unsorted container could still expose a stable insertion-dependent or storage-dependent sequence. A Go program cannot assign such meaning to map traversal.

Golang Maps

Tech / 16 Sep 2026 / 6 min read

Ethernet Pause Frames Temporarily Stop Link Transmission

Ethernet links can move frames faster than a receiving device can process or forward them. When that mismatch lasts long enough, receive buffers fill and frames may be dropped. IEEE 802.3x flow control provides a link-level response for full-duplex Ethernet. A device can send a MAC Control PAUSE frame that asks its directly connected peer to stop transmitting ordinary data frames for a specified interval. The pause is temporary, local to that link, and different from congestion control performed by higher-layer protocols.

Networking Ethernet

Software Engineering / 16 Sep 2026 / 6 min read

ETag Revalidation Separates Cache Freshness From Representation Transfer

An HTTP cache can hold a response that is no longer fresh yet still avoid downloading the representation again. When the stored response carries a usable validator, the cache can send a conditional request and let the origin confirm whether the selected representation has changed. This separates two operations that are often treated as one: checking whether cached state remains valid and transferring a new representation. A successful revalidation can perform the first without performing the second.

Software Engineering HTTP

Cybersecurity / 16 Sep 2026 / 10 min read

DNS Rebinding Turns Name Resolution Into a Moving Network Boundary

A browser loads script from an attacker-controlled hostname while that name resolves to a public server. Seconds later, another lookup for the same hostname returns a private address such as an RFC 1918 destination. The browser still sees the same scheme, host, and port in the URL, yet a subsequent connection can terminate at a different machine. That gap between web origin identity and network destination is the basis of DNS rebinding. The same-origin policy primarily reasons about origins expressed through URL components; it does not define an origin by the IP address selected by DNS for each connection. An attacker who controls both a hostname and its DNS answers can exploit that separation when a browser is permitted to resolve the name to a target reachable from the user’s network.

Cybersecurity DNS

Tech / 16 Sep 2026 / 5 min read

DNS Negative Caching Temporarily Stores Name Errors

A DNS cache does not store only successful answers. Recursive resolvers can also retain authoritative responses that say a requested name or record does not exist. This behavior is called negative caching. Negative caching reduces repeated work. If many clients ask for the same absent name, a resolver can answer from its cache instead of sending the same query through the DNS hierarchy each time. The trade-off is temporal. If an administrator adds the missing record while a negative answer is still cached, some clients can continue receiving the cached error until its negative cache lifetime expires.

DNS Networking

Software Engineering / 16 Sep 2026 / 6 min read

DNS Negative Caching Can Outlive Record Creation

A recursive DNS resolver can continue returning an earlier absence result after the authoritative zone has gained the requested name. The new record and the cached negative answer are not contradictory: they exist at different points in the resolution path, and the cache remains valid until its negative TTL expires or local policy removes it sooner. This behavior gives DNS absence its own cache lifetime. Publishing a record changes authoritative state, but it does not synchronously invalidate negative entries already stored by recursive resolvers.

Software Engineering DNS