All articles

Cybersecurity / 13 Sep 2026 / 6 min read

Session Rotation Keeps Authentication From Inheriting an Attacker Chosen Identifier

A login can validate every credential correctly and still leave the resulting account exposed if the application keeps the same session identifier that existed before authentication. The defect is not in password checking or cryptography. It is in the transition from an anonymous browser state to an authenticated one. That transition matters because pre-authentication sessions are often easy to obtain. Applications create them for shopping carts, locale preferences, anti-abuse state, or ordinary framework bookkeeping. If an attacker can arrange for a victim to use an identifier already known to the attacker, and successful login preserves that identifier, the attacker can later present the same value and inherit the authenticated session.

Cybersecurity Session Security

Cybersecurity / 13 Sep 2026 / 8 min read

Session Rotation Closes a Quiet Authentication Gap

A browser can arrive at a sign-in page with a session identifier that already existed before any credentials were presented. That is normal. Shopping carts, anti-abuse state, language preferences, and pre-authentication workflows often need server-side continuity. The security problem appears when successful authentication upgrades that same identifier instead of replacing it. At that moment, a token created for anonymous state becomes a bearer credential for an authenticated account. If another party already knows or controls the identifier, the login has upgraded their copy too. This is the essential shape of session fixation: the attacker does not need to steal a fresh authenticated session if the application can be persuaded to authenticate a session the attacker already possesses.

Cybersecurity Session Security

Cybersecurity / 13 Sep 2026 / 6 min read

Server-Side Fetchers Expand the Network Trust Boundary

A feature that accepts a URL often looks less privileged than it is. An image importer, webhook validator, document previewer, link unfurler, or integration tester may perform only an outbound HTTP request, yet that request originates from infrastructure with a network position the remote caller does not possess. That difference is the core security issue in server-side request forgery, commonly shortened to SSRF. The application is not merely processing attacker-influenced text. It is acting as a network client on behalf of that input, potentially carrying access to private address space, local services, cloud control interfaces, or endpoints protected mainly by topology.

Cybersecurity SSRF

Tech / 13 Sep 2026 / 5 min read

SD Card Speed Classes Describe Minimum Write Performance

An SD card can carry several speed marks at once: C10, U3, and V30 are common examples. The numbers can look like competing estimates of the same speed, but they serve a more specific purpose. A speed class states an assured minimum sequential access performance under defined conditions, with a strong emphasis on sustained recording workloads. That makes a class mark different from a large read or write figure printed elsewhere on a card or package. A peak figure can describe a maximum transfer rate reached under particular conditions. A speed class establishes a performance floor for a supported access pattern.

SD Cards Storage

Software Engineering / 13 Sep 2026 / 7 min read

Schema Changes Are Multi-Version Protocols

A column rename looks atomic in a schema diff. A deployed system rarely experiences it that way. During a rolling release, old application processes can remain active after new processes start. Background jobs may run code built from another release. Replicas can lag behind a primary. Queued work can outlive the binary that created it. Data written before the change remains present after the new schema exists. The migration therefore crosses several versions of code and data at once.

Software Engineering Databases

Artificial Intelligence / 13 Sep 2026 / 6 min read

Reuse Shared Prefix State in LLM Inference

Autoregressive LLM serving often repeats the same initial tokens across many requests. A fixed system prompt, tool schema, or document prefix can occupy thousands of tokens before request-specific text begins. Computing attention state for that identical prefix on every request repeats prefill work that has already produced the same cached keys and values under compatible execution conditions. Prefix caching stores reusable attention state for such shared token prefixes. It changes the amount of prefill computation required for a cache hit, but it does not make arbitrary similar prompts interchangeable. The reusable unit is tied to exact model input state, not semantic resemblance.

Artificial Intelligence LLM

Go / 13 Sep 2026 / 5 min read

Reserve Slice Capacity with slices.Grow in Go

A slice can have enough logical elements for the current operation and still lack room for the next append. When the number of upcoming elements is already known, slices.Grow makes that capacity requirement explicit without changing the slice length. The function joined the standard library with the slices package in Go 1.21. Its contract is narrow: given a slice and a non-negative count, it returns a slice with enough capacity to append at least that many additional elements without another allocation.

Go Slices

Software Engineering / 13 Sep 2026 / 9 min read

Request Coalescing Turns Cache Miss Bursts Into Shared Work

A cache entry expires at a single instant, but requests for that entry do not necessarily arrive one at a time. If twenty callers observe the same miss before any caller has repopulated the cache, a conventional cache-aside path can send twenty equivalent reads to the origin. The cache is functioning according to its contract; the concurrency around the miss is creating duplicated work. Request coalescing changes that boundary. Instead of treating each miss as permission to start an origin operation, callers for the same key can share one in-flight operation. One caller becomes the producer of the pending result. Other callers wait for that result rather than starting equivalent work.

Software Engineering Caching

Go / 13 Sep 2026 / 4 min read

Replace Slice Ranges with slices.Replace in Go

slices.Replace changes a contiguous range of a slice and can make the resulting slice shorter, longer, or the same length. That makes it more than element assignment: the operation combines range removal and insertion while retaining Go slice storage semantics. Its signature accepts any slice element type: func Replace[S ~[]E, E any](s S, i, j int, v ...E) S The half-open range s[i:j] is replaced by the values in v. Since the resulting length can change, the returned slice value is part of the operation’s contract.

Go Slices

Go / 13 Sep 2026 / 5 min read

Replace Non-Overlapping Substrings with strings.ReplaceAll in Go

strings.ReplaceAll replaces every non-overlapping occurrence of one literal string with another. There is no regular-expression syntax, callback, or token model involved: matching is based on the exact byte sequence supplied as old. result := strings.ReplaceAll("api/v1/users", "/v1/", "/v2/") The result is api/v2/users. This small contract makes the function suitable for fixed substitutions where every match receives the same replacement.

Golang Strings

Go / 13 Sep 2026 / 4 min read

Repeat Slice Patterns with slices.Repeat in Go

slices.Repeat builds a new slice by concatenating a source slice with itself a specified number of times. The operation is small, but its exact contract matters when code depends on allocation, nil state, or reference-bearing elements. The function belongs to the standard slices package and has this signature: func Repeat[S ~[]E, E any](x S, count int) S The returned slice has both length and capacity equal to len(x) * count. The result is never nil.

Go Slices

Go / 13 Sep 2026 / 4 min read

Remove Slice Ranges with slices.Delete in Go

slices.Delete removes one contiguous range from a slice and shifts the remaining suffix toward the front. The operation modifies the supplied backing storage, so its returned slice header is part of the result rather than an optional convenience. Its signature accepts any slice element type: func Delete[S ~[]E, E any](s S, i, j int) S The half-open interval s[i:j] follows ordinary Go slicing rules. Elements at indices from i through j-1 are removed, while elements before i retain their positions.

Go Slices

Go / 13 Sep 2026 / 3 min read

Remove Prefixes with strings.CutPrefix in Go

Prefix removal often carries two pieces of information: the remaining text and whether the expected prefix was present. strings.CutPrefix represents both results in one operation instead of separating a prefix test from the removal that follows it. That distinction matters when an unchanged string is a valid result. strings.TrimPrefix returns the input unchanged when the prefix is absent, so its return value alone cannot report presence. strings.CutPrefix returns the remainder plus a boolean that preserves that fact explicitly.

Golang Strings

Go / 13 Sep 2026 / 4 min read

Remove Explicit Suffixes with strings.CutSuffix in Go

strings.CutSuffix removes one exact trailing string and reports whether that suffix was present. The boolean result is the key distinction from operations that only return transformed text: callers can keep suffix recognition separate from the remaining content. base, found := strings.CutSuffix(name, ".json") If name ends in .json, base contains the preceding text and found is true. Otherwise, base is the original string and found is false. The operation does not scan for a matching fragment in the middle and does not repeatedly strip the suffix.

Golang Strings

Go / 13 Sep 2026 / 4 min read

Remove Adjacent Duplicates with slices.Compact in Go

slices.Compact removes repeated values only when they occur next to each other. That detail makes it different from set-based deduplication: the function collapses equal runs, preserves their order, and modifies the supplied slice storage. The operation fits data that is already grouped by value, including sorted slices and streams that naturally produce repeated adjacent states. It does not search the full slice for every matching value. Compact collapses consecutive runs The generic signature accepts slices whose element type is comparable:

Go Slices

Artificial Intelligence / 13 Sep 2026 / 6 min read

Regularize Classifier Targets with Label Smoothing

A classifier trained with one-hot targets is rewarded for pushing the target class probability toward one and every other class probability toward zero. Cross-entropy keeps applying pressure in that direction even after the predicted class is already correct. Label smoothing changes that pressure by replacing the exact one-hot target with a distribution that reserves some mass for other classes. That small change affects more than the target tensor. It changes the gradient on every output logit, limits the incentive for extreme class separation, and alters how predicted probabilities should be interpreted.

Artificial Intelligence Classification

Artificial Intelligence / 13 Sep 2026 / 7 min read

Quantize KV Caches with Separate Key and Value Error Budgets

Autoregressive transformer inference keeps past key and value tensors so each new token can attend to prior positions without recomputing the full prefix. That KV cache grows with sequence length, layer count, batch size, and the number of stored key-value heads. At long contexts, its memory footprint can become a direct limit on concurrent requests or usable context length. Quantizing the KV cache reduces bytes per stored element. The resulting approximation is not equivalent to quantizing a passive data structure, however. Cached keys participate in attention score computation, while cached values are mixed according to the resulting attention weights. Error in those two tensors therefore enters the attention operation at different points.

Artificial Intelligence LLM

Tech / 13 Sep 2026 / 5 min read

PWM Dimming and Screen Flicker

A screen set to 30 percent brightness does not necessarily emit a steady 30 percent of its maximum light. Some displays reduce average brightness by switching light output on and off rapidly. This technique is commonly called pulse-width modulation, or PWM. The switching can be too fast to look like ordinary visible blinking, yet it still changes the light reaching the eyes over time. The exact behavior varies by display technology, panel, brightness setting, and control electronics.

Displays Screen Brightness

Tech / 13 Sep 2026 / 7 min read

Private Wi-Fi Addresses Limit Device Tracking

Every Wi-Fi interface needs a link-layer address for local network communication. Traditionally, a device used a factory-assigned MAC address whenever it joined a wireless network. That stable value made local identification convenient, but it also gave network operators and nearby systems a persistent identifier that could be observed across different places. Modern operating systems can instead present a private, randomized MAC address. The feature changes an identifier visible on the local Wi-Fi network without changing the device’s account, internet address, or other identity signals.

Wi-Fi Privacy

Tech / 13 Sep 2026 / 5 min read

Private Browsing Changes Local Storage, Not Network Visibility

Opening a private browser window changes what the browser keeps after that session ends. It does not create an anonymous internet connection. That distinction matters because several kinds of visibility exist at once. A browser can avoid retaining local history while a website still receives the connection, an internet provider still carries the traffic, and an employer or school network can still apply its own monitoring or filtering. Private browsing mainly changes browser-side data handling.

Web Browsers Privacy

Artificial Intelligence / 13 Sep 2026 / 8 min read

Preserve Attention Sinks in Sliding-Window LLM Inference

A sliding-window KV cache seems mechanically simple: keep the most recent tokens, evict older key-value entries, and continue decoding within a fixed memory budget. The complication is that some transformer models place substantial attention mass on a small set of early positions even when those positions carry little direct semantic relevance to the current token. Those positions are often called attention sinks. If a cache policy removes them while preserving only the newest tokens, the attention distribution seen during decoding can change abruptly. A bounded cache can therefore behave differently from full-context inference even when the evicted text appears unrelated to the current request.

Artificial Intelligence LLM

Artificial Intelligence / 13 Sep 2026 / 6 min read

Preserve Attention Sinks in Bounded KV Caches

A decoder that keeps only the newest key-value states can degrade even when its cache still contains enough recent text for the immediate task. In some transformer models, early token positions attract substantial attention across later decoding steps. Evicting those states changes the attention distribution, not just the amount of accessible history. Attention sink retention addresses that specific failure mode. A bounded cache preserves a small prefix of initial key-value states together with a moving window of recent states. Tokens between those regions can be discarded, keeping cache size bounded as generation continues.

Artificial Intelligence LLM

Tech / 13 Sep 2026 / 5 min read

Power Bank Capacity: mAh and Wh Describe Different Things

A power bank marked 10,000 mAh does not normally deliver 10,000 mAh into a phone battery. The label describes charge stored by the cells under a particular voltage basis, while the USB output operates through conversion electronics and the receiving device has its own charging losses. That distinction makes power bank capacity easier to interpret. Milliamp-hours are useful, but they are incomplete without voltage. Watt-hours describe stored energy more directly and make comparisons across different voltages less confusing.

Power Banks Batteries

Cybersecurity / 13 Sep 2026 / 8 min read

Password Reset Is an Authentication Ceremony

A password reset endpoint can be quieter than the login page and still hold more authority. A successful login proves possession of an existing credential. A successful reset replaces that credential, often after a single email link has crossed several systems outside the application’s direct control. That makes account recovery an authentication ceremony in its own right. Treating it as a support feature creates a dangerous asymmetry: the primary login path receives rate limits, multifactor checks, session controls, and detailed telemetry, while the recovery path is reduced to “email a token and accept a new password.”

Cybersecurity Authentication