All articles

Software Engineering / 16 Sep 2026 / 6 min read

ETag Revalidation Separates Cache Freshness From Representation Transfer

An HTTP cache can hold a response that is no longer fresh yet still avoid downloading the representation again. When the stored response carries a usable validator, the cache can send a conditional request and let the origin confirm whether the selected representation has changed. This separates two operations that are often treated as one: checking whether cached state remains valid and transferring a new representation. A successful revalidation can perform the first without performing the second.

Software Engineering HTTP

Linux / 16 Sep 2026 / 5 min read

epoll Edge-Triggered Readiness Requires Draining

An edge-triggered epoll consumer can block while unread data is still buffered. The failure appears when an event is consumed, only part of the available input is read, and the event loop returns to epoll_wait() expecting another notification for the bytes that remain. This behavior follows directly from EPOLLET. Edge-triggered notification reports changes in readiness rather than continuously reporting a ready condition. Once a readiness transition has produced an event, leaving the file descriptor ready does not itself create a new transition.

Linux epoll

Software Engineering / 16 Sep 2026 / 7 min read

Duplicate File Descriptors Share Offsets but Not Descriptor Flags

Calling dup() does not create an independent stream position. The returned descriptor refers to the same open file description as the source descriptor, so a seek through either descriptor changes the offset observed through both. At the same time, descriptor-local state such as the close-on-exec flag remains attached to each descriptor separately. That split is easy to miss because both kinds of state are manipulated through integer file descriptors. The integer is only a process-local reference. Several descriptors can point at one open file description, and that shared object carries state with consequences for reads, writes, seeks, and status-flag changes.

Software Engineering Linux

Tech / 16 Sep 2026 / 6 min read

DRAM Refresh Restores Charge Before Bits Fade

Dynamic random-access memory stores data in cells whose electrical state does not remain stable indefinitely. Charge leaks from a cell over time, even when software performs no reads or writes. A memory system therefore has to refresh DRAM periodically to preserve stored bits. Refresh is a maintenance operation rather than a request from an application. The memory controller and DRAM device coordinate it alongside ordinary reads and writes. During parts of that work, some memory resources cannot serve normal requests.

Memory DRAM

Cybersecurity / 16 Sep 2026 / 7 min read

DNSSEC Denial Proofs Let Resolvers Synthesize Negative Answers

DNSSEC Denial Proofs Let Resolvers Synthesize Negative Answers A recursive resolver receives a query for a random subdomain beneath a signed zone and already holds a validated denial record from an earlier lookup. The queried label was never sent to the authoritative server, yet the resolver can still return an authenticated negative result. The answer is not a guess and is not ordinary exact-match negative caching. It is derived from cryptographic evidence that covers a portion of the DNS namespace.

Cybersecurity DNS

Cybersecurity / 16 Sep 2026 / 10 min read

DNS Rebinding Turns Name Resolution Into a Moving Network Boundary

A browser loads script from an attacker-controlled hostname while that name resolves to a public server. Seconds later, another lookup for the same hostname returns a private address such as an RFC 1918 destination. The browser still sees the same scheme, host, and port in the URL, yet a subsequent connection can terminate at a different machine. That gap between web origin identity and network destination is the basis of DNS rebinding. The same-origin policy primarily reasons about origins expressed through URL components; it does not define an origin by the IP address selected by DNS for each connection. An attacker who controls both a hostname and its DNS answers can exploit that separation when a browser is permitted to resolve the name to a target reachable from the user’s network.

Cybersecurity DNS

Cybersecurity / 16 Sep 2026 / 9 min read

DNS Rebinding Turns Name Resolution Into a Browser Network Pivot

DNS Rebinding Turns Name Resolution Into a Browser Network Pivot A browser can load active content from a public server, keep the same URL origin, then resolve that origin name to a different IP address later. If the new address reaches a service on a private network, the browser has become a transport path between attacker-controlled code and a target that was never intended to accept requests from the public Internet.

Cybersecurity DNS

Tech / 16 Sep 2026 / 5 min read

DNS Negative Caching Temporarily Stores Name Errors

A DNS cache does not store only successful answers. Recursive resolvers can also retain authoritative responses that say a requested name or record does not exist. This behavior is called negative caching. Negative caching reduces repeated work. If many clients ask for the same absent name, a resolver can answer from its cache instead of sending the same query through the DNS hierarchy each time. The trade-off is temporal. If an administrator adds the missing record while a negative answer is still cached, some clients can continue receiving the cached error until its negative cache lifetime expires.

DNS Networking

Software Engineering / 16 Sep 2026 / 6 min read

DNS Negative Caching Can Outlive Record Creation

A recursive DNS resolver can continue returning an earlier absence result after the authoritative zone has gained the requested name. The new record and the cached negative answer are not contradictory: they exist at different points in the resolution path, and the cache remains valid until its negative TTL expires or local policy removes it sooner. This behavior gives DNS absence its own cache lifetime. Publishing a record changes authoritative state, but it does not synchronously invalidate negative entries already stored by recursive resolvers.

Software Engineering DNS

Artificial Intelligence / 16 Sep 2026 / 6 min read

Detect Distribution Shift with Energy Scores

A classifier can assign a high softmax probability to an input that does not resemble the data used to fit it. The probability vector still has to sum to one, so normalization can produce a confident-looking prediction even when every class is a poor match. An energy score provides a scalar derived from the logits before that normalization and can serve as a signal for out-of-distribution detection. The score does not make a classifier aware of every possible unfamiliar input. Its value depends on the model, logit scale, training procedure, and data used to set a decision threshold. That makes energy-based detection an evaluation problem as much as a scoring mechanism.

Artificial Intelligence Evaluation

Cybersecurity / 16 Sep 2026 / 9 min read

CSP Strict-Dynamic Shifts Script Trust From Hosts to Execution Lineage

CSP Strict-Dynamic Shifts Script Trust From Hosts to Execution Lineage A page can carry a restrictive script host list and still face a difficult deployment choice when its trusted bootstrap code loads dependencies at runtime. Adding every current script host to script-src keeps policy tied to network locations that can change. Adding 'strict-dynamic' takes a different route: in supporting browsers, trust attached to a nonce-bearing or hash-authorized root script can propagate to scripts that root code inserts dynamically.

Cybersecurity CSP

Cybersecurity / 16 Sep 2026 / 9 min read

Cross-Origin Opener Policy Separates Window Relationships at the Browsing Context Boundary

Cross-Origin Opener Policy Separates Window Relationships at the Browsing Context Boundary A browser can prevent a cross-origin popup from reading most properties of its opener and still preserve a live relationship between the two windows. The same-origin policy restricts direct access to a foreign document, but a cross-origin WindowProxy can remain reachable, expose a limited interface, participate in navigation relationships, and carry observable state such as whether the referenced window is closed.

Cybersecurity Browser Security

Tech / 16 Sep 2026 / 7 min read

CPU Thermal Throttling Reduces Clock Speed at Temperature Limits

A processor can run at a high clock rate only while electrical, power, and temperature limits permit it. Heavy work raises transistor switching activity, which raises power consumption and heat output. If cooling cannot remove that heat quickly enough, the processor approaches a thermal limit. Modern CPUs respond automatically. Control logic reduces performance states so the chip generates less heat. This behavior is commonly called thermal throttling. Thermal throttling is not the same as a processor simply running below its advertised maximum frequency. Boost algorithms already vary clock speed according to workload, active core count, current, power, and temperature. Thermal throttling refers specifically to temperature becoming a limiting condition.

CPU Thermal Management

Tech / 16 Sep 2026 / 6 min read

CPU Store Buffers Decouple Retirement from Cache Writes

A processor does not need every store instruction to finish its cache update before later instructions make progress. Modern cores commonly place completed stores into a store buffer, allowing the instruction to retire while the memory subsystem handles the write afterward. This separation improves throughput because cache ownership, coherence traffic, and other memory activity can take longer than the execution pipeline can afford to wait. The buffer acts as a queue between architectural execution and the cache hierarchy.

CPU Memory

Tech / 16 Sep 2026 / 6 min read

CPU Cache Associativity Limits Where Lines Can Reside

Processor caches keep recently used memory close to execution cores, but cache capacity alone does not determine which data can remain resident. Most general-purpose CPU caches divide storage into sets and give each set a fixed number of slots, commonly called ways. A memory block maps to a particular set. It can occupy any way inside that set, but it cannot move into an unrelated set merely because that other set has free space. This placement rule makes hardware lookup practical and fast, while creating a distinct source of misses when too many active blocks compete for the same set.

CPU Cache

Cybersecurity / 16 Sep 2026 / 8 min read

CORS Preflight Caching Extends Cross-Origin Policy Decisions

CORS Preflight Caching Extends Cross-Origin Policy Decisions An API operator can remove a cross-origin method from its CORS configuration and still see browsers issue that method without a fresh OPTIONS exchange. The browser may already hold a valid preflight cache entry authorizing the request shape. Until that entry expires or is discarded, the earlier policy decision can continue to suppress a new preflight. This behavior does not make CORS authorization permanent, and it does not bypass the CORS check on the actual response. It does create an operational interval in which a server-side policy change and browser preflight behavior are not synchronized. Access-Control-Max-Age therefore affects more than request volume: it influences the lifetime of a cached permission decision inside the user agent.

Cybersecurity CORS

Artificial Intelligence / 16 Sep 2026 / 6 min read

Control Repetition with Contrastive Search Decoding

Greedy decoding can keep selecting locally probable tokens even when the resulting continuation becomes repetitive. Sampling can break that pattern, but it does so by introducing randomness. Contrastive search takes a different route: it remains deterministic for fixed inputs and settings while scoring likely next-token candidates against a representation-level repetition penalty. The method combines two signals that describe different properties of a candidate. The language-model probability favors tokens that fit the current prefix. A degeneration penalty disfavors candidates whose new hidden representation is too similar to representations already present in the generated context.

Artificial Intelligence Large Language Models

Artificial Intelligence / 16 Sep 2026 / 5 min read

Control Beam Search Length Bias with Sequence Scoring

Beam search can prefer a short completed sequence even when a longer continuation looks locally plausible at every token. The effect follows from the score being optimized. If a decoder ranks complete hypotheses by the sum of token log probabilities, every additional token contributes a value that is at most zero. Extending a sequence therefore cannot increase its raw accumulated log probability. This property is not a defect in probability theory. A sequence probability is a product of conditional probabilities, and its logarithm is their sum. The implementation concern appears when raw sequence probability is also used as the ranking objective for outputs whose lengths vary.

Artificial Intelligence LLM

Cybersecurity / 16 Sep 2026 / 9 min read

Client Certificate Headers Move mTLS Identity Into the Proxy Trust Boundary

A service can require mutual TLS at its public edge and still have no TLS client certificate at the application server. The client proves possession of its private key to the TLS-terminating reverse proxy; the proxy then opens a separate connection to the origin. Unless certificate information is carried across that second hop, the origin cannot directly inspect the credential authenticated on the first connection. Forwarding the certificate in an HTTP field solves the transport problem but changes the security boundary. The origin is no longer consuming identity evidence directly from its own TLS handshake. It is consuming a statement made by an intermediary about a different handshake.

Cybersecurity TLS

Cybersecurity / 16 Sep 2026 / 8 min read

Certificate Transparency Turns Certificate Issuance Into Publicly Auditable State

Certificate Transparency Turns Certificate Issuance Into Publicly Auditable State A certification authority can issue a TLS certificate that chains to a trusted root even when the domain operator never requested it. Ordinary path validation can establish that a trusted CA signed the certificate, that names and validity fields satisfy client policy, and that the presented chain is acceptable. Those checks do not establish that the domain operator expected the issuance.

Cybersecurity TLS

Cybersecurity / 16 Sep 2026 / 7 min read

Certificate Transparency Makes Certificate Issuance Auditable, Not Preventive

A certification authority can issue a syntactically valid TLS certificate for a domain even when the domain operator did not request it. Traditional certificate validation can still succeed if the issuing chain reaches a trusted root and the certificate satisfies the client’s other checks. The missing signal is accountability: the domain operator needs a reliable way to see that the certificate exists. Certificate Transparency, or CT, moves that problem into public, cryptographically auditable logs. A log does not decide whether a certification authority was entitled to issue a certificate. It records certificates and precertificates, signs commitments about accepted submissions, and exposes an append-only history that monitors can inspect.

Cybersecurity Certificate Transparency

Cybersecurity / 16 Sep 2026 / 8 min read

Cache Keys Define the Security Boundary of Shared HTTP Responses

Cache Keys Define the Security Boundary of Shared HTTP Responses A reverse proxy receives two requests for the same URL. One carries a header that changes the origin response; the other does not. If the proxy stores the first response under a key that ignores that header, the second request can receive content generated from state it never supplied. The cache is operating correctly according to its key, yet the key has merged two requests that the application treats as distinct.

Cybersecurity HTTP

Artificial Intelligence / 16 Sep 2026 / 6 min read

Bucket Sequence Lengths to Reduce Padding Waste

A padded batch is shaped by its longest sequence, not its average sequence. If one batch contains token counts of 120, 124, 131, and 900, every sequence may be represented at length 900. Most positions in the first three rows then carry padding rather than input tokens. Length bucketing changes batch composition instead of changing the model. Examples with similar token counts are placed near each other before batches are formed. The maximum length inside each batch falls closer to the lengths of its members, reducing the number of padded positions processed by operations that still use the rectangular batch shape.

Artificial Intelligence Transformers

Tech / 16 Sep 2026 / 6 min read

Battery Power Path Prioritizes System Load Before Charging

Plugging a battery-powered device into an adapter does not always mean that adapter current flows straight into the battery first. Many portable designs use a power-path circuit that manages external input, the system load, and the battery as related but distinct power flows. This arrangement lets the device operate while the battery charges. More importantly, it gives the active system priority when the adapter cannot supply both the requested system power and the full programmed charge current.

Battery Charging