All articles

Cybersecurity / 13 Sep 2026 / 7 min read

Passkeys Move Authentication Trust Into Origin-Bound Credentials

A convincing phishing page can copy a login form almost perfectly. It can reproduce branding, layout, wording, and even a plausible domain name. With passwords, visual similarity is often enough to obtain a reusable secret. A passkey changes the decisive part of that exchange: the authenticator signs for the relying party it was registered with, rather than handing a credential string to whichever page asks for one. That distinction is more important than the absence of typing. Passkeys are built on WebAuthn credentials backed by asymmetric cryptography. The relying party stores a public key and related credential data; the authenticator retains or protects the corresponding private-key material. Authentication proves possession by signing fresh protocol data. The server does not need a password-equivalent secret that can be replayed after a database disclosure.

Cybersecurity Passkeys

Go / 13 Sep 2026 / 4 min read

Partition Go Slices Lazily with slices.Chunk

Batching a slice often starts as index arithmetic: advance by a fixed width, clamp the final boundary, and pass each sub-slice onward. Go 1.23 added slices.Chunk, which expresses that operation as an iterator while preserving the backing storage of the source slice. Its behavior has one detail that matters beyond syntax: every yielded chunk has its capacity clipped to its length. A caller can modify elements through a chunk, but a plain append cannot grow that chunk into the next region of the source slice.

Go Slices

Cybersecurity / 13 Sep 2026 / 8 min read

Outbound Requests Turn Applications Into Network Proxies

A feature that fetches a remote image can acquire far more network authority than its product description suggests. From the application host, the same HTTP client may be able to reach loopback services, private address space, cloud metadata endpoints, or administrative interfaces that are invisible from the public internet. That gap between user-visible function and server-side reach is the core security problem in server-side request forgery. The vulnerable component is not necessarily a traditional proxy. Webhook testers, document renderers, URL previewers, import tools, feed readers, media processors, and callback validators can all become request brokers when an external party influences the destination.

Cybersecurity SSRF

Cybersecurity / 13 Sep 2026 / 7 min read

Mutual TLS Makes Service Identity a Certificate Lifecycle Problem

A service can encrypt every connection and still have only a vague idea of what is calling it. Conventional server-authenticated TLS proves the server’s identity to the client, but the reverse direction is usually left to an application credential, a network location, or infrastructure convention. Mutual TLS changes that relationship by requiring the client to present a certificate as well. The transport can then carry authenticated identities in both directions before application data is exchanged.

Cybersecurity mTLS

Software Engineering / 13 Sep 2026 / 7 min read

Monotonic Time Belongs in Elapsed-Time Measurement

A timeout can be represented by an ordinary timestamp comparison: record a start value, read the clock later, subtract, and compare the result with a limit. The arithmetic looks complete. The clock model is not. Civil time exists to place events on a shared calendar. It can be corrected to stay aligned with an external time reference. Elapsed-time measurement has a different requirement: later observations within one running system need an ordering suitable for measuring an interval. A clock correction that improves civil-time accuracy can therefore be harmful when the same reading is treated as a stopwatch.

Software Engineering Time

Artificial Intelligence / 13 Sep 2026 / 7 min read

Merge Retrieval Rankings with Reciprocal Rank Fusion

A lexical retriever and an embedding retriever can return useful results for the same query while assigning scores that have no common numerical meaning. Adding those raw scores treats incomparable scales as if they were calibrated measurements. Reciprocal rank fusion avoids that assumption by combining positions rather than score magnitudes. This makes RRF useful in retrieval-augmented generation systems that mix distinct retrieval signals. Each retriever keeps its own scoring model. The fusion layer only needs ordered result lists and stable document identities.

Artificial Intelligence Retrieval

Go / 13 Sep 2026 / 4 min read

Limit Slice Capacity with slices.Clip in Go

A Go slice can expose more capacity than its current length. slices.Clip removes that spare capacity from the slice header, setting capacity to length without copying the elements into new storage. The operation is deliberately narrow. It changes the range that a later append can reuse through that slice value, but it does not release the backing array or create an independent copy. Clip is a full slice expression The standard library defines Clip with this signature:

Go Slices

Software Engineering / 13 Sep 2026 / 7 min read

Keyset Pagination Under Concurrent Writes

Keyset Pagination Under Concurrent Writes A query returns twenty rows ordered by creation time. Before the client asks for the next twenty, another transaction inserts a row near the front of that order. The data set has changed, but the client still expects page two to continue from the point page one reached. That expectation exposes the main difference between offset pagination and keyset pagination. An offset identifies a position in a particular query result. A keyset cursor identifies an ordering boundary. Under concurrent writes, those are not equivalent references.

Software Engineering Databases

Tech / 13 Sep 2026 / 6 min read

Keyboard Debounce Filters Contact Bounce

A single physical key press does not always create one perfectly clean electrical transition. In many mechanical switches, metal contacts meet and settle over a short interval. During that interval, the electrical state can change several times before becoming stable. Keyboard electronics have to separate that brief contact behavior from deliberate repeated presses. The filtering process is commonly called debounce. A switch can change state several times while settling A basic mechanical key switch acts as an electrical contact. Pressing the key moves parts of the switch until conductive surfaces meet. Releasing it separates those surfaces again.

Keyboards Input Devices

Cybersecurity / 13 Sep 2026 / 8 min read

JWT Verification Must Bind Algorithm, Key, and Issuer

JWT Verification Must Bind Algorithm, Key, and Issuer A signed token can be cryptographically valid and still be unacceptable to the service receiving it. The signature answers a narrow question: the token bytes match a signature produced with a particular cryptographic key under a particular algorithm. Authorization depends on a larger set of facts, including who controls that key, which issuer is trusted, which audience the token targets, and which algorithms the application intended to accept.

Cybersecurity Authentication

Cybersecurity / 13 Sep 2026 / 7 min read

JWT Verification Fails at the Algorithm Boundary

A JSON Web Token can carry a perfectly valid signature and still be unacceptable to the service receiving it. That distinction is easy to lose in systems where token verification is reduced to a library call that returns a boolean or a decoded claims object. JWT signatures establish a narrow fact: given a particular algorithm and key, the protected token bytes authenticate successfully. Authorization requires more. The verifier also has to decide which algorithms are permitted, which keys belong to the expected authority, which issuer produced the token, which service the token targets, whether its time constraints hold, and whether this class of token is valid for the operation at hand.

Cybersecurity JWT

Artificial Intelligence / 13 Sep 2026 / 6 min read

Inspect Intermediate Transformer Predictions with Logit Lens

A transformer produces its next-token distribution only after the final block, yet every block updates the residual state that eventually feeds that prediction. Logit lens examines those intermediate states by mapping them through the model’s output path into vocabulary logits. The result is a sequence of provisional token distributions across model depth. The method is attractive because it reuses components already present in the model. Its output also needs careful interpretation. An intermediate residual state was not necessarily optimized to behave like a final residual state, so a readable token ranking is a diagnostic projection rather than a direct transcript of internal computation.

Artificial Intelligence Transformers

Go / 13 Sep 2026 / 5 min read

Insert Slice Values with slices.Insert in Go

slices.Insert places one or more values at a specific slice index and shifts the existing suffix to make room. The operation modifies slice storage when possible, but it can also return a slice backed by a new array when existing capacity cannot hold the expanded result. Its generic signature is: func Insert[S ~[]E, E any](s S, i int, v ...E) S The returned slice must replace the previous slice value because insertion changes the length and can change the backing array.

Go Slices

Software Engineering / 13 Sep 2026 / 7 min read

Idempotent Consumers and Durable Duplicate Detection

Idempotent Consumers and Durable Duplicate Detection A consumer commits a database transaction, then loses its connection before acknowledging the message. The broker has no evidence that processing finished, so a delivery protocol that permits redelivery can present the same message again. The second delivery is not evidence that the first transaction failed. From the consumer’s perspective, the important fact is more precise: message delivery and application commit have separate completion points. If the broker cannot atomically participate in the application’s state transition, an acknowledgement can be lost after the application effect is already durable.

Software Engineering Distributed Systems

Cybersecurity / 13 Sep 2026 / 8 min read

HTTP Request Smuggling Begins With Parser Disagreement

HTTP Request Smuggling Begins With Parser Disagreement A reverse proxy can reject malicious paths, normalize headers, enforce authentication, and still pass an ambiguous HTTP message to a backend that interprets the same bytes differently. At that point, the security boundary is no longer defined by either component in isolation. It is defined by the gap between their parsers. HTTP request smuggling exploits that gap. The attacker is not primarily defeating TLS or guessing a credential. The useful primitive is message-boundary disagreement: one system decides that a request ends at one byte, while the next system decides that it ends somewhere else. Bytes treated as a body by the front end can become the start of another request at the origin, or the reverse can occur.

Cybersecurity Web Security

Cybersecurity / 13 Sep 2026 / 7 min read

HTTP Request Boundaries Fail When Intermediaries Disagree

A front-end proxy can accept a byte stream as one HTTP request while the server behind it interprets part of the same stream as the beginning of another. At that point, the disagreement is no longer a parsing curiosity. Bytes supplied by one connection can change how a later request is framed, creating a route around controls that assumed every component agreed on request boundaries. HTTP request smuggling sits in this gap between parsers. The vulnerable condition is not simply the presence of a Content-Length or Transfer-Encoding header. It is a chain in which two adjacent HTTP implementations assign different structure to the same traffic, then reuse a connection or otherwise preserve enough state for the disagreement to affect subsequent processing.

Cybersecurity HTTP

Cybersecurity / 13 Sep 2026 / 7 min read

Host Header Trust Can Turn Application URLs Into Attacker Input

A web application can serve the correct page, validate the correct account, and still emit a security-sensitive link pointing at a domain controlled by somebody else. The failure often begins with a value that looks operational rather than privileged: the HTTP host presented with the request. Modern deployments make host handling deceptively complex. A browser sends authority information, an edge proxy may rewrite it, another proxy may add a forwarding header, and the application framework eventually exposes a convenient property representing the apparent host. That property is useful for routing and URL generation. It is dangerous when the application treats it as an authenticated statement about its own public identity.

Cybersecurity Web Security

Tech / Updated 15 Sep 2026 / 5 min read

Hidden Wi-Fi Network Names Do Not Hide Radio Activity

A Wi-Fi network can disappear from the normal list of nearby networks even while its access point continues transmitting. The network has not become radio-silent. It has only stopped presenting its network name in the usual discovery information. This setting is often called a hidden network or hidden SSID. SSID is the identifier commonly shown as a Wi-Fi network name. Hiding it changes discovery behavior, but it does not turn the wireless network into an invisible or private radio link.

Wi-Fi Networking

Tech / 13 Sep 2026 / 6 min read

HDMI Bandwidth Limits Resolution and Refresh Rate

A display can support a high resolution and a high refresh rate yet fail to offer both at the same time. The limiting factor is often the amount of video data that must cross the HDMI connection, together with the capabilities of every device in the signal path. HDMI version labels alone do not describe the complete result. The source, display, cable, intermediate equipment, selected color format, bit depth, and supported signaling modes all contribute to the maximum usable display mode.

Tech HDMI

Go / 13 Sep 2026 / 4 min read

Grow Slice Capacity with slices.Grow in Go

slices.Grow reserves room for future appends without changing a slice’s length. The distinction between length and capacity is central to its contract: existing elements remain the logical contents, while the returned slice can accept at least a requested number of additional elements without another allocation. The generic signature is: func Grow[S ~[]E, E any](s S, n int) S The return value matters because increasing capacity can require a new backing array.

Go Slices

Software Engineering / 13 Sep 2026 / 7 min read

Garbage Collection Does Not Close External Resources

An object can become unreachable while a file descriptor, socket, database transaction, or operating-system lock associated with it still has a meaningful external lifetime. Garbage collection can reclaim managed memory after reachability disappears. It does not, by that fact alone, perform the protocol operation that releases an external resource. The distinction is structural. A collector reasons about references inside a managed heap. A resource such as a file descriptor is an entry maintained by the operating system, and a database transaction is state maintained by another component. Their release semantics come from APIs and protocols outside the collector’s reachability model.

Software Engineering Resource Management

Artificial Intelligence / 13 Sep 2026 / 5 min read

Focus Classification Loss with Focal Modulation

Cross-entropy gives every classified example a loss determined by the probability assigned to its target class. When a training batch contains many examples the model already classifies with high confidence, their individual losses may be small yet their aggregate contribution can still occupy a substantial part of the objective. Focal loss changes that balance with a confidence-dependent multiplier. The mechanism is not a new classifier head or sampling strategy. It modifies the loss so that examples with high target-class probability are attenuated more strongly than examples with low target-class probability.

Artificial Intelligence Classification

Go / 13 Sep 2026 / 3 min read

Find the First Predicate Match with slices.IndexFunc in Go

slices.IndexFunc scans a slice from the beginning and returns the index of the first element accepted by a predicate. That contract is narrower than filtering: only one position is requested, and the scan has no reason to continue after a match. Its standard-library signature accepts any slice element type: func IndexFunc[S ~[]E, E any](s S, f func(E) bool) int The predicate receives each element in index order. A true result ends the search and produces that index. If every call returns false, the function returns -1.

Go Slices

Go / 13 Sep 2026 / 4 min read

Filter Slice Values with slices.DeleteFunc in Go

slices.DeleteFunc removes elements selected by a predicate and compacts the retained values into the same slice storage. It is a filtering operation with mutation semantics: retained order stays intact, the returned slice can be shorter, and callers must use that returned slice header. The generic signature accepts any slice element type: func DeleteFunc[S ~[]E, E any](s S, del func(E) bool) S The predicate describes deletion rather than retention. An element disappears when del returns true.

Go Slices