Skip to content

Archive / page 26

All articles

Every practical article from the Nalar archive, newest first.

Artificial Intelligence 16 Sep 2026 6 min read

Account for Exposure Bias in Autoregressive Decoding

An autoregressive model can receive cleaner context during training than it receives during generation. Under teacher forcing, the next-token prediction is conditioned on a reference prefix from the training sequence. During free-running decoding, the model instead conditions on tokens it generated itself. Once a generated token differs from the intended continuation, later predictions operate on a prefix that training may have represented less often. This mismatch is commonly called exposure bias. It is not simply a claim that autoregressive models make errors. The specific issue is that the distribution of prefixes presented to the model can change between optimization and generation, and an early deviation can change every subsequent conditional prediction.

Software Engineering 15 Sep 2026 7 min read

Write Skew Escapes Row-Level Conflict Detection

Two concurrent transactions can each read a valid database state, update different rows, and both commit without colliding on a written row. The final state can still violate a constraint that spans those rows. No lost update is required; each transaction can preserve every value written by the other and still produce an invalid result. This anomaly is commonly called write skew. Its defining feature is that the conflict lives in the relationship among values rather than in two writes aimed at the same row. Isolation mechanisms that detect direct write-write conflicts therefore do not automatically protect every application invariant.

Cybersecurity 15 Sep 2026 7 min read

WebAuthn Signature Counters Are Clone Signals, Not Authentication Proof

Two valid WebAuthn assertions for the same credential arrive close together. One carries a signature counter of 42 and the other carries 41. Both signatures verify. The relying party now has evidence that deserves attention, but it does not have cryptographic proof that the second assertion came from an attacker. That distinction is built into WebAuthn’s signature-counter model. The counter is auxiliary state intended to help detect cloned authenticators. It is not part of the primary decision that establishes possession of the credential private key, and some authenticators legitimately keep it at zero.

Cybersecurity 15 Sep 2026 7 min read

WebAuthn Credentials Bind Authentication to Web Origins

WebAuthn Credentials Bind Authentication to Web Origins A convincing sign-in page can copy logos, typography, form layout, and even the timing of an authentication flow. Passwords offer little resistance to that imitation because the secret is portable: a person can type the same password into the legitimate site or into a hostile page that looks identical. WebAuthn changes the property that matters. Its public-key credentials are scoped to a relying party, and the browser contributes origin context to each ceremony. An attacker can reproduce the appearance of a sign-in page, but cannot simply move a WebAuthn assertion from an unrelated web origin into the legitimate relying party’s authentication flow.

Software Engineering 15 Sep 2026 7 min read

Version Columns Turn Lost Updates Into Explicit Conflicts

Two clients can read the same database row, derive different changes, and then write in sequence. If each update replaces values without checking the state that produced its decision, the later write can silently erase part or all of the earlier one. The database has serialized the statements, yet the application-level read-modify-write operation has still lost a concurrent change. A version column changes the admission rule for the write. The update is accepted only if the row still carries the version observed by the client. A competing update advances that version, so a stale writer affects zero rows instead of overwriting newer state.

Tech 15 Sep 2026 6 min read

USB Selective Suspend Cuts Power Use on Idle Devices

USB devices can remain physically connected while doing no useful work for long periods. Keeping every idle function fully active wastes energy, especially on battery-powered computers with several integrated or external USB devices. Selective suspend gives host software a finer control point. An idle USB function can enter a suspended state while unrelated functions continue operating. When activity is needed again, the host resumes the suspended function and normal transfers continue.

Tech 15 Sep 2026 5 min read

USB Power Delivery PPS Adjusts Charging Voltage

USB-C chargers can advertise several fixed voltage profiles, but some charging systems benefit from finer control. USB Power Delivery includes Programmable Power Supply, commonly shortened to PPS, which lets a compatible sink request output within an advertised programmable range. That changes where part of the voltage regulation can occur. Instead of receiving one fixed supply level for an extended period and converting all of it inside the device, a phone or other sink can ask the charger to move its output closer to the voltage needed by the device’s charging circuitry.

Artificial Intelligence 15 Sep 2026 6 min read

Treat Embedding Model Changes as Index Migrations

An embedding model change does not merely replace a function that emits arrays of the same length. It can change the coordinate system in which stored items and incoming queries are represented. Even when two models produce vectors with identical dimensions, their coordinates and similarity-score distributions are not interchangeable by default. That makes an embedding model version part of the index schema. A retrieval system that changes the query encoder while retaining vectors produced by an older encoder can still return numeric scores, but those scores no longer have a justified geometric interpretation unless cross-version compatibility is an explicit property of the models.

Software Engineering 15 Sep 2026 6 min read

Tombstones Preserve Deletions Across Replica Gaps

A replicated store cannot always represent deletion as immediate absence. If one replica removes a record while another replica is disconnected, erasing every trace of the record also erases the evidence needed to distinguish a deliberate deletion from a replica that simply has not seen recent state. A tombstone keeps that evidence as versioned metadata. Instead of removing the key from the replication domain at once, the system records a deletion marker that participates in reconciliation. A replica carrying an older live value can then compare its state with the marker and discard the obsolete value.

Cybersecurity 15 Sep 2026 8 min read

TLS 1.3 Early Data Trades a Round Trip for Replay Exposure

TLS 1.3 Early Data Trades a Round Trip for Replay Exposure A resumed TLS 1.3 connection can carry application bytes before the server has completed the new handshake. That latency reduction is attractive on paths where a round trip is expensive, but it changes a security property that applications often assume without naming it: a protected request is not necessarily fresh merely because the server decrypted it successfully. TLS 1.3 calls this facility early data, commonly described as 0-RTT. It is available when the client and server share a pre-shared key, including one established through a prior connection. The client can derive keys and send application data in its first flight rather than waiting for the server’s handshake messages.

Tech 15 Sep 2026 5 min read

Thermal Throttling Changes Sustained Processor Speed

A processor can finish a short burst of work at a high clock rate and then settle at a lower rate during a long workload. The change does not necessarily indicate a fault. Modern processors operate inside several limits, and temperature is one of the conditions that can reduce the frequency available over time. Thermal throttling is a control response that keeps a processor within permitted operating conditions. It becomes visible when heat generation exceeds what the cooling system can remove while the workload continues. The resulting clock behavior makes peak specifications a poor substitute for sustained performance measurements.

Tech 15 Sep 2026 7 min read

TCP Window Scaling Expands Receive Capacity

A TCP connection can have plenty of bandwidth available and still transfer data below the path’s capacity. One limit can come from flow control: the receiver tells the sender how much additional data it is prepared to accept, and the sender must respect that boundary. The original TCP header allocates 16 bits to the advertised receive window. That field can represent at most 65,535 bytes directly. TCP window scaling extends its effective range by negotiating a multiplier during connection setup, making much larger receive windows possible without changing the size of the header field.

Tech 15 Sep 2026 5 min read

TCP Nagle Algorithm Batches Small Writes

Applications can hand TCP data in pieces much smaller than the network’s practical segment size. A terminal session, control protocol, or interactive service might produce only a few bytes at a time. Sending every tiny write immediately can create a stream of packets whose headers are much larger than their payloads. The Nagle algorithm reduces that pattern by limiting how aggressively a TCP sender emits new small segments while earlier data is still awaiting acknowledgment.

Software Engineering 15 Sep 2026 7 min read

TCP Half-Close Separates the Two Stream Directions

A TCP peer can reach end-of-stream on incoming data while its outgoing stream remains usable. The event is directional: a FIN closes one side’s sending direction after previously queued bytes, but it does not require the opposite direction to close at the same instant. That property is easy to hide behind APIs that expose a connection as one object with a single close operation. At the protocol boundary, however, TCP carries two byte streams in opposite directions. A half-close makes the distinction visible and gives application protocols a useful signal: one participant can state that its request body is complete while still accepting a response.

Tech 15 Sep 2026 7 min read

TCP Delayed ACK Reduces Acknowledgment Traffic

TCP Delayed ACK Reduces Acknowledgment Traffic TCP acknowledgments provide essential feedback, but sending a separate ACK for every incoming data segment is not always necessary. A receiver can briefly defer an acknowledgment so that one ACK covers more than one segment. This behavior is known as delayed acknowledgment, or delayed ACK. The mechanism reduces packet processing and reverse-path traffic during steady data transfer. It also introduces a timing tradeoff: if another segment does not arrive soon enough, the receiver eventually has to send the pending ACK on its own.

Software Engineering 15 Sep 2026 8 min read

Task Scopes Bind Child Lifetimes to Parent Operations

An asynchronous function can return while work it started is still running. Once that happens, the caller no longer has a lexical boundary that states when the spawned work finishes, where its failure is observed, or which operation owns its cancellation. Structured concurrency changes that lifetime relation. Child tasks belong to an enclosing scope, and the scope does not complete until its children reach a terminal state according to the runtime’s task-group semantics. The central property is not parallel execution. It is that task lifetime follows program structure.

Cybersecurity 15 Sep 2026 7 min read

Subresource Integrity Pins External Assets to Expected Bytes

Subresource Integrity Pins External Assets to Expected Bytes A web page can keep all of its application code under careful review and still execute JavaScript delivered from infrastructure outside its control. Analytics libraries, UI frameworks, payment components, and other dependencies are often fetched from a content delivery network. If that remote response changes, the browser normally has no basis for deciding whether the new bytes are an approved release or an unexpected substitution.

Cybersecurity 15 Sep 2026 8 min read

Strict CSP Moves Script Trust From Hostnames to Authorized Roots

A script policy built around a long list of approved hosts can look restrictive while still granting more authority than the application intends. If any approved origin can serve attacker-influenced JavaScript, or exposes a path that behaves as a script gadget, the hostname boundary may admit code that the page never meant to execute. A strict Content Security Policy changes the basis of that decision. Instead of treating network location as the primary proof that a script is acceptable, the page marks specific root scripts with a fresh nonce or a matching cryptographic hash. With 'strict-dynamic', trust can then follow script-loading relationships created by those authorized roots.

Artificial Intelligence 15 Sep 2026 6 min read

Steer Transformer Activations with Residual Stream Vectors

A transformer can produce different output behavior even when its weights and input tokens stay fixed. One way to cause that change is to alter an intermediate hidden state during the forward pass. Activation steering does this deliberately by adding a vector to a selected residual-stream position or set of positions. The mechanism is simple enough to express as an intervention, but its effect is not a global model setting. The chosen direction, coefficient, layer, token positions, and decoding setup all affect the result. Treating those choices as part of the inference configuration makes the behavior easier to reason about and test.

Cybersecurity 15 Sep 2026 7 min read

SSH Host Key Pinning Turns First Contact Into a Persistent Trust Decision

SSH Host Key Pinning Turns First Contact Into a Persistent Trust Decision An SSH client can negotiate strong encryption with the wrong server. The cryptographic channel may be intact while an active intermediary terminates one SSH connection and creates another, unless the client has a reliable basis for authenticating the server’s host key. OpenSSH addresses that boundary with host key verification. A client records or otherwise obtains trusted host key material and checks the key presented during later connections. This converts server identity from a property inferred from network routing into a cryptographic comparison anchored in local or externally authenticated state.

Tech 15 Sep 2026 5 min read

SSD Write Cache and Sustained Transfer Speed

An SSD can copy the first part of a large file at high speed, then settle at a much lower rate even though nothing else appears to have changed. That drop can be normal. Many consumer SSDs use part of their NAND as a fast write cache, allowing short bursts to finish before the drive has to sustain writes in its denser storage mode. This behavior makes a single peak transfer number a poor description of every write workload. Cache size, free space, NAND type, controller policy, temperature, and the amount of data already waiting inside the drive can all affect the speed seen during a long transfer.

Tech 15 Sep 2026 6 min read

SSD TRIM Marks Discarded Data for Flash Reuse

Deleting a file changes filesystem metadata, but that action does not automatically tell a solid-state drive which flash pages no longer contain useful data. From the drive’s point of view, previously written logical block addresses can remain valid until the host explicitly replaces them or marks them as discarded. TRIM closes that information gap. The operating system can notify the storage device that selected logical blocks no longer need their old contents. The SSD may then treat the associated data as disposable during its internal space-management work.

Software Engineering 15 Sep 2026 5 min read

Schema Renames Create a Compatibility Interval

Renaming a database column is a single catalog operation in many relational systems, but an application deployment can make that apparently atomic change span several software versions. If an old process still sends statements containing old_name after the database exposes only new_name, the schema is valid and the process is valid in isolation, yet their interface no longer matches. The central issue is not the rename operation itself. It is the interval in which multiple application versions can reach one database. During that interval, schema evolution behaves like an API compatibility problem.

Software Engineering 15 Sep 2026 6 min read

Savepoints Create Partial Rollback Boundaries

A database transaction does not have to choose only between keeping every statement and discarding the entire unit of work. In systems that support transaction savepoints, a transaction can mark an intermediate boundary, perform additional operations, then roll back changes made after that boundary while keeping the transaction itself active. That behavior makes a savepoint more than a convenience for error recovery. It creates a local rollback boundary inside a larger atomic unit, with semantics that remain tied to the surrounding transaction. Nothing before the final commit becomes durable merely because a partial rollback succeeded.