All articles

Tech / 14 Sep 2026 / 7 min read

Flash Wear Leveling Spreads Writes Across NAND Cells

A file can keep the same name and logical location while its bytes move through many different physical locations inside an SSD, phone, memory card, or USB drive. That movement is not a side effect of a messy file system. It is a core part of managing NAND flash. Flash memory has a finite program-and-erase endurance. Rewriting the same physical area continuously would age that area much faster than the rest of the device. Controllers avoid that pattern by spreading writes across available flash. This process is called wear leveling.

Storage NAND Flash

Cybersecurity / 14 Sep 2026 / 6 min read

Filesystem Races Break the Link Between Checks and Use

A process checks that a path is safe, records a reassuring result, then opens the path a fraction of a second later. Those two operations can look like one security decision in source code. The filesystem sees two separate events, with an interval in which names, links, directories, mounts, or permissions may change. That interval is the basis of time-of-check to time-of-use races. The issue is not limited to unusually slow systems or large timing gaps. When an attacker can influence the relevant namespace concurrently, even a small gap can separate the object that passed a check from the object that receives the privileged operation.

Cybersecurity Application Security

Tech / 14 Sep 2026 / 6 min read

eSIM Stores Carrier Profiles Without a Removable Card

A traditional SIM places subscription credentials on a removable card that slides into a phone. An eSIM changes the packaging rather than removing the SIM function. The secure component is built into the device, and a carrier profile can be downloaded into it instead of arriving on a piece of plastic. That distinction matters because cellular service still needs protected credentials, network configuration, and a way to identify a valid subscription. eSIM moves those functions into embedded hardware designed to hold one or more operator profiles securely.

Tech Mobile Networks

Tech / 14 Sep 2026 / 5 min read

eSIM Stores Carrier Profiles in Rewritable Secure Hardware

A removable SIM card combines secure hardware with a carrier profile in a package that can be moved between compatible devices. An eSIM changes the packaging rather than eliminating the secure identity component. The device contains an embedded secure element designed to hold downloadable operator profiles. This arrangement separates the physical module from the subscription loaded onto it. A compatible phone can receive a new profile electronically, keep more than one installed profile when its platform permits it, and activate a selected subscription without opening a SIM tray.

Tech eSIM

Tech / 14 Sep 2026 / 6 min read

Encrypted DNS Hides Name Queries From Local Networks

Opening a website usually starts with a name lookup. A device needs an IP address for a domain, so it sends a DNS query to a resolver. Traditional DNS commonly sends those queries without transport encryption, which allows networks along the local path to observe or alter them. Encrypted DNS changes that transport. DNS over HTTPS, often called DoH, carries DNS messages inside HTTPS. DNS over TLS, or DoT, carries them through a dedicated TLS connection. Both approaches protect queries between the client and the selected resolver from straightforward inspection on that path.

DNS Privacy

Artificial Intelligence / 14 Sep 2026 / 6 min read

Encode Token Distance with Rotary Position Embeddings

Transformer attention has no intrinsic notion that one token sits three positions before another. Rotary position embeddings, usually called RoPE, inject position into attention by rotating pairs of query and key coordinates before their dot product is computed. The mechanism is easy to reduce to a helper function, yet several details determine its actual behavior: queries and keys must use compatible rotations, each coordinate pair has its own angular frequency, offsets emerge through the dot product, and changing the position scale changes the geometry seen by attention.

Artificial Intelligence Transformers

Cybersecurity / 14 Sep 2026 / 8 min read

DNSSEC Makes DNS Answers Verifiable, Not Confidential

A resolver receives an address for a production hostname and has to decide whether the answer is merely syntactically valid or cryptographically tied to the zone that published it. Ordinary DNS provides no native proof that the data survived the path from an authoritative source without unauthorized alteration. DNSSEC changes that property, but only within a carefully defined boundary. That boundary matters in operations. DNSSEC does not encrypt a query, conceal a domain name, authenticate an application server, or guarantee that an authoritative service stays reachable. It signs DNS data so a validating resolver can detect forged or modified records when a chain of trust exists. Treating it as a broad DNS security layer obscures both its value and its failure modes.

Cybersecurity DNS

Tech / 14 Sep 2026 / 5 min read

DNS TTL Controls How Long Resolvers Reuse Records

DNS answers are often reused instead of being requested from authoritative servers for every connection. A resolver can keep a record in its cache for a limited period, then answer later queries from that cached copy. The record’s time to live, commonly written as TTL, sets that cache lifetime in seconds. A value of 300 permits caching for up to five minutes, while 3600 permits up to one hour. Once the remaining lifetime reaches zero, the cached record is no longer considered fresh and the resolver normally needs a new answer before serving it again.

DNS Networking

Tech / 14 Sep 2026 / 6 min read

DNS over HTTPS Encrypts Resolver Queries

Opening a website usually starts before the browser sends an HTTP request. The device first needs an IP address for the hostname, and DNS commonly provides that mapping. Traditional DNS traffic can expose those queries to systems along the network path because classic resolver exchanges are not encrypted by default. DNS over HTTPS, usually shortened to DoH, changes the transport. It sends DNS messages through HTTPS, so the request and response receive the confidentiality and integrity protection of the HTTPS connection between the client and the selected resolver.

DNS HTTPS

Artificial Intelligence / 14 Sep 2026 / 6 min read

Detect Feature Outliers with Mahalanobis Distance

A feature vector can sit close to a reference mean in Euclidean distance and still be unusual for the distribution that produced the reference data. Mahalanobis distance accounts for this by scaling displacement according to covariance. Directions with little observed variation contribute more to the score than directions in which the reference data naturally spreads out. That behavior makes the distance useful as a compact outlier score for model features or embeddings, provided the reference statistics are meaningful and the covariance estimate is numerically usable.

Artificial Intelligence Out-of-Distribution Detection

Cybersecurity / 14 Sep 2026 / 6 min read

Deserialization Can Turn Data Into Program Behavior

A serialized object can look like ordinary application data while carrying enough structure to influence which classes are instantiated, which fields receive values, and which runtime hooks execute during reconstruction. That difference matters whenever an application accepts object graphs from a browser, message queue, cache, file, or another service and treats decoding as a passive parsing operation. The dangerous cases are not defined by serialization itself. JSON decoded into a fixed record type is not equivalent to a native object stream that can name arbitrary runtime classes. The security boundary appears when attacker-controlled input can select behavior-rich types, trigger lifecycle callbacks, or assemble existing code paths into an unintended computation.

Cybersecurity Application Security

Software Engineering / 14 Sep 2026 / 9 min read

Deadlines Shrink Across Service Boundaries

A service receives a request with 480 milliseconds remaining before its deadline. It spends 90 milliseconds reading state, then calls another service with a fixed 500-millisecond timeout. The downstream call can now outlive the request that caused it. Nothing about either timeout is internally inconsistent; the inconsistency appears at the boundary between them. Timeouts are often configured as local limits: a database query gets one value, an HTTP client another, a queue operation a third. A deadline represents a different constraint. It gives an operation an end point, so every later stage can compare its own work against the same finite lifetime.

Software Engineering Distributed Systems

Cybersecurity / 14 Sep 2026 / 7 min read

Dangling DNS Records Can Outlive the Services They Point To

A hostname can remain part of an organisation’s public identity long after the application behind it has disappeared. The DNS record still resolves, certificates may have existed for years, links remain in old messages, and browser cookies may still be scoped broadly enough to include the name. Yet the external service named by that record may have been deleted and returned to a provider’s pool of available resources. That mismatch creates the conditions for subdomain takeover. The core problem is not DNS compromise. The authoritative zone can be operating exactly as configured. The failure sits between two control planes: DNS still delegates traffic toward an external platform, while the platform no longer associates the referenced resource with the domain owner.

Cybersecurity DNS Security

Cybersecurity / 14 Sep 2026 / 7 min read

CORS Policy Is an Authorization Boundary Between Browser Origins

A cross-origin API request can reach its destination, execute application code, and produce a valid response even when the browser refuses to expose that response to JavaScript. That distinction is central to Cross-Origin Resource Sharing, yet it is often blurred by configurations that treat CORS as a connectivity switch. CORS is a browser-enforced extension to the same-origin model. It gives a server a way to state which external origins may access selected responses from browser script. The server still owns authentication and authorization for the underlying resource. CORS controls an additional boundary: whether code running under another web origin may receive the response through browser APIs.

Cybersecurity Web Security

Artificial Intelligence / 14 Sep 2026 / 7 min read

Control Target Certainty with Label Smoothing

A classifier trained with ordinary cross-entropy often receives a one-hot target: probability mass 1 on the labeled class and 0 on every other class. That target keeps rewarding movement toward a more extreme prediction even after the correct class already has the highest score. Label smoothing changes the target distribution rather than the model architecture. A small amount of target mass is moved away from the labeled class and assigned to other classes. Cross-entropy then optimizes against this softened distribution, so the gradient no longer treats absolute certainty on the labeled class as the target state.

Artificial Intelligence Neural Networks

Artificial Intelligence / 14 Sep 2026 / 5 min read

Control Classifier Logits with Cosine Normalization

A linear classification head mixes two signals in each logit: the angle between a feature vector and a class weight vector, and the magnitudes of both vectors. Cosine normalization removes the magnitude terms, so class scores depend on directional alignment instead. That change is small in code but substantial in interpretation. Feature norm no longer increases every class comparison merely by growing, class-weight norm no longer acts as an implicit class-specific scale, and the overall sharpness of the softmax must be supplied separately.

Artificial Intelligence Classification

Artificial Intelligence / 14 Sep 2026 / 6 min read

Control Beam Search Length Bias with Score Normalization

Beam search usually ranks partial sequences by accumulated token log probability. That score has a built-in dependence on sequence length: each additional token contributes another log probability that is zero or negative. As a result, raw cumulative scores can favor shorter completed sequences even when a longer candidate is preferable for the application. Length normalization changes the ranking rule rather than the model distribution. The distinction matters because decoding can produce different outputs without changing a single model parameter or next-token probability.

Artificial Intelligence Language Models

Artificial Intelligence / 14 Sep 2026 / 5 min read

Contrastive Decoding with an Amateur Model

A language model can assign high probability to a token for several reasons. Some reflect context-specific structure; others reflect generic tendencies that also appear in a weaker model. Contrastive decoding separates those signals by scoring candidate tokens with two models rather than one. The larger model acts as an expert. A smaller or otherwise weaker model acts as an amateur. Generation favors tokens that the expert supports more strongly relative to the amateur, subject to a plausibility constraint from the expert distribution.

Artificial Intelligence Language Models

Cybersecurity / 14 Sep 2026 / 8 min read

Content Security Policy Works Best as an Execution Boundary

Content Security Policy Works Best as an Execution Boundary A web application can escape every obvious inline-script habit and still carry a broad execution surface. A compromised analytics host, an overly permissive script source, a reused nonce, or a policy that quietly tolerates inline code can leave the browser with far more authority than the application intended. Content Security Policy, usually delivered through the Content-Security-Policy response header, gives a site a way to constrain that authority. Its strongest role is not as a filter for hostile strings. It is a browser-enforced boundary around resource loading and script execution. That distinction matters because policies built as long host allowlists often age into something much weaker than their authors expect.

Cybersecurity Content Security Policy

Artificial Intelligence / 14 Sep 2026 / 6 min read

Compare RMSNorm and Layer Normalization

Normalization layers can look interchangeable when their outputs have similar shapes, but their invariances are not the same. RMSNorm rescales an activation vector using its root mean square without first subtracting the vector mean. Layer normalization centers the vector and then rescales it using its variance. That missing centering operation is the central distinction. It changes which transformations of an activation vector disappear under normalization and which remain visible to the rest of the network.

Artificial Intelligence Neural Networks

Go / 14 Sep 2026 / 4 min read

Compact Adjacent Slice Values with slices.CompactFunc in Go

slices.CompactFunc removes repeated values only when equivalent elements are next to each other. That adjacency rule makes it different from set-style deduplication: equal values separated by another element remain separate entries. The function accepts a slice and an equality function: func CompactFunc[S ~[]E, E any](s S, eq func(E, E) bool) S It compacts the slice in place and returns the resulting shorter slice.

Go Slices

Cybersecurity / 14 Sep 2026 / 7 min read

Certificate Transparency Makes Public TLS Issuance Observable

A certificate authority can issue a technically valid certificate for a domain without the domain operator being involved in that issuance. The public Web PKI is designed around many trusted authorities, and any authority accepted for a given name can potentially create a certificate that browsers will accept, subject to browser policy and certificate constraints. That broad trust model makes certificate issuance a security event worth observing, not merely an administrative transaction.

Cybersecurity TLS

Cybersecurity / 14 Sep 2026 / 7 min read

Certificate Pinning Trades Broad Trust for Operational Coupling

A mobile application can reject a perfectly valid TLS certificate even when the hostname matches, the certificate is current, and its chain terminates at a trusted public root. That rejection can be intentional. A pinning policy adds another condition: some element of the authenticated certificate chain must match identity material that the application already expects. The extra check narrows trust, but it also changes failure ownership. Normal Web PKI validation delegates a large part of certificate trust to platform root stores and certification authorities. Pinning moves part of that decision into application configuration and release management. A certificate rotation that is routine for a browser can become an outage for a pinned client.

Cybersecurity TLS

Tech / 14 Sep 2026 / 6 min read

Camera Pixel Binning Trades Resolution for Signal

A phone camera may advertise a 48, 50, 108, or 200 megapixel sensor but normally save photos at a much lower resolution. That difference is often intentional. Many high-resolution sensors group information from neighboring photosites before producing the image that reaches the photo library. This process is commonly called pixel binning. It gives the camera pipeline a different balance between spatial resolution, signal quality, processing cost, and file size. The sensor still has its physical array of photosites, but the default output does not need to preserve one final image pixel for every photosite.

Tech Cameras