All articles

Cybersecurity / 12 Sep 2026 / 8 min read

Passkey Recovery Can Reopen the Password Era

Passkey Recovery Can Reopen the Password Era A service can deploy passkeys, remove passwords from its normal sign-in screen, and still retain a password-grade account takeover path. The weak point often sits outside the authentication ceremony itself: recovery. Passkeys change the primary credential model in useful ways. WebAuthn credentials are scoped to a relying party, and authentication uses public-key cryptography rather than a reusable secret sent to the server. The browser and authenticator also participate in origin and relying-party checks, which gives passkeys strong resistance to conventional credential phishing.

Cybersecurity Passkeys

Artificial Intelligence / 12 Sep 2026 / 6 min read

Pack Transformer Training Sequences Without Cross-Sample Attention

Transformer batches often waste token slots on padding when examples have uneven lengths. Sequence packing reduces that waste by placing several shorter samples into one fixed-length token block. The arithmetic is attractive, but concatenation alone changes the training problem: tokens from one sample can attend to tokens from another unless the packed representation preserves sample boundaries. A correct packing scheme therefore has two jobs. It must fill token capacity more densely, and it must keep the model’s effective computation consistent with the intended independence of the original samples.

Artificial Intelligence Transformers

Software Engineering / 12 Sep 2026 / 9 min read

Optimistic Concurrency with Version Columns

A row can be read correctly, modified correctly, and still be written incorrectly. The problem appears when another transaction changes the same logical record between the read and the write. A plain UPDATE often has no memory of the state on which the new values were based, so the later writer can replace an earlier change without detecting the race. A version column turns that hidden assumption into a predicate. The update says, in effect, that the write is valid only while the row remains at the version that the caller observed. The database then evaluates the state check and the mutation as one atomic statement.

Software Engineering Databases

Cybersecurity / 12 Sep 2026 / 7 min read

OAuth Redirect Security Depends on Transaction Binding

OAuth Redirect Security Depends on Transaction Binding An OAuth callback can arrive over HTTPS, carry a valid authorization code, and still belong to the wrong transaction. That is the uncomfortable property of redirect-based authorization: transport protection can establish who served each endpoint, but it does not by itself prove that a response belongs to the browser session, client instance, authorization server, and callback context that initiated the exchange. The modern authorization code flow addresses this with several bindings rather than a single defensive parameter. Exact redirect URI matching constrains the destination. PKCE binds an authorization code to a verifier held by the client. CSRF protections bind the browser-facing response to the initiating transaction. Issuer identification matters when one client talks to more than one authorization server.

Cybersecurity OAuth

Cybersecurity / 12 Sep 2026 / 6 min read

Native Object Deserialization Expands the Trusted Computing Surface

A serialized object can look like ordinary application data at the edge of a system and behave very differently once it reaches a native object decoder. The distinction matters because some serialization mechanisms do more than parse fields. They reconstruct types, restore object graphs, resolve references, and invoke behavior associated with object creation or restoration. That capability is convenient inside a trusted boundary. Across an untrusted boundary, it can make the application’s installed code part of the input language.

Cybersecurity Secure Coding

Go / 12 Sep 2026 / 4 min read

Merge Map Entries with maps.Copy in Go

Merging two Go maps often comes down to one precise rule: entries from one map are assigned into another, and matching keys replace existing destination values. maps.Copy gives that operation a standard-library form without changing its underlying assignment semantics. The function mutates the destination map. It does not allocate a replacement, return a merged value, or recursively copy data stored behind pointers, slices, maps, or other reference-bearing values. Source entries overwrite matching destination keys maps.Copy accepts a destination followed by a source. Every source pair is assigned to the destination. Keys that exist only in the destination remain present.

Go Maps

Go / 12 Sep 2026 / 5 min read

Materialize Iterator Values with slices.Collect in Go

An iter.Seq can produce values without storing them all at once. That representation is useful while values are flowing through iterator-based code, but many APIs still need an ordinary slice. Since Go 1.23, slices.Collect provides that materialization boundary directly. The function consumes a one-value sequence and returns a newly built slice containing each yielded value in sequence order. It is small API surface, but its allocation, ownership, and empty-input behavior are useful to make explicit.

Go Slices

Cybersecurity / 12 Sep 2026 / 10 min read

Make Password Reset Tokens Single Use

Password recovery is an authentication path with unusual power. A reset link can let its holder replace an account password without presenting the current password, so the token inside that link must be treated as a short-lived credential. A strong token is not enough by itself. If the same token remains valid after a successful reset, a copied link can be replayed. If two requests can validate the same token before either request marks it used, both may pass. If a database stores raw reset tokens, a database disclosure can turn pending recovery records into immediate account access.

Cybersecurity Authentication

Software Engineering / 12 Sep 2026 / 11 min read

Load Shedding: Reject Work Before Overload Spreads

Load Shedding: Reject Work Before Overload Spreads A service has finite capacity. When offered work exceeds that capacity for long enough, accepting every request can make the service less useful rather than more useful. Queues grow, deadlines expire, memory pressure rises, dependencies receive more traffic, and successful throughput can fall. Load shedding is the deliberate rejection of work that the system cannot serve within an acceptable budget. The goal is not to maximize the number of requests admitted. The goal is to preserve useful service during overload.

Software Engineering Reliability

Go / 12 Sep 2026 / 4 min read

Limit Go Slice Capacity with slices.Clip

A Go slice can be short while still carrying much more capacity than its current length. That extra capacity is useful when more elements are expected, but sometimes code should hand off a slice without leaving room for an append to reuse the same tail. slices.Clip gives that intent a direct operation. Clip returns a slice with the same elements and length, but its capacity is reduced to its length.

Go Slices

Cybersecurity / 12 Sep 2026 / 6 min read

JWT Verification Is a Policy Decision Before It Is a Crypto Check

JWT Verification Is a Policy Decision Before It Is a Crypto Check A JWT can carry a valid signature and still be unacceptable to the service receiving it. The signature proves only that the token matches a cryptographic key under a particular algorithm. It does not establish that the key belongs to an issuer the service trusts, that the algorithm is permitted for this token class, or that the claims authorize use at this endpoint.

Cybersecurity JWT

Go / 12 Sep 2026 / 4 min read

Iterate Fixed-Size Slice Groups with slices.Chunk in Go

Splitting a slice into bounded groups often starts as index arithmetic: advance by a fixed width, clamp the final boundary, and take a sub-slice. Go 1.23 puts that operation in the standard library as slices.Chunk. Chunk returns an iterator rather than a [][]T. That detail keeps grouping separate from collecting, and its capacity rule gives each yielded group a useful boundary for later append calls. Chunk produces consecutive sub-slices The signature is:

Go Slices

Go / 12 Sep 2026 / 5 min read

Interleave HTTP Request Reads and Response Writes in Go

An HTTP handler that writes its response before finishing the request body has a protocol-sensitive edge case. With HTTP/1, Go’s server normally consumes the unread request body before it begins writing the response. That default keeps ordinary handlers simple, but it conflicts with handlers that intentionally exchange data in both directions at the same time. http.ResponseController.EnableFullDuplex changes that behavior for the current request. It tells the server that the handler intends to interleave reads from Request.Body with writes to the ResponseWriter.

Golang HTTP

Artificial Intelligence / 12 Sep 2026 / 7 min read

Inspect Transformer Layer Predictions with the Logit Lens

A decoder-only transformer normally exposes token logits only after its final block and output normalization. The residual stream inside earlier blocks has the same model-width shape, which makes another operation possible: take an intermediate state, apply the model’s output-side normalization when required, and project that state through the output matrix. The resulting vocabulary scores form the logit lens. They provide a token-space view of an internal representation before the remaining transformer blocks have processed it. That view is useful for inspecting how candidate tokens change across depth, but it is not a record of tokens that the model has secretly selected in advance.

Artificial Intelligence LLM

Artificial Intelligence / 12 Sep 2026 / 10 min read

Improve LLM Generation with Contrastive Decoding

Improve LLM Generation with Contrastive Decoding A language model can assign high probability to text that is fluent but bland, repetitive, or overly driven by common patterns. Sampling adds variety, but increasing randomness can also admit weak continuations. Contrastive decoding takes a different route: compare a stronger model with a weaker reference model at each generation step, then favor tokens that the stronger model supports more distinctly. The method changes decoding rather than model parameters. It can therefore be useful when you control inference for compatible models and want to experiment with generation quality without another training run. The extra model pass is not free, and the method needs a plausibility guard to avoid promoting strange tokens.

Artificial Intelligence LLM

Software Engineering / 12 Sep 2026 / 11 min read

Idempotent Consumers: Handle Duplicate Messages Safely

Idempotent Consumers: Handle Duplicate Messages Safely A message broker can deliver the same message more than once. A worker may finish its database update and crash before acknowledging the message. The broker sees no acknowledgement, so it sends the message again. From the broker’s perspective, redelivery is the safe choice. From the application’s perspective, the second delivery can repeat a business effect. That gap matters whenever an effect must happen once per logical message. Charging an account twice, granting stock twice, incrementing a counter twice, or sending the same fulfillment request twice can turn a routine retry into corrupted state.

Software Engineering Distributed Systems

Artificial Intelligence / 12 Sep 2026 / 7 min read

Hubness Can Distort Nearest-Neighbor Embedding Retrieval

Embedding retrieval usually treats each query independently: encode the query, compare it with stored vectors, then return the closest items. That local view can miss a collection-level pattern. Some stored vectors may appear in the nearest-neighbor lists of many unrelated queries far more often than other vectors. This pattern is called hubness. A hub is not necessarily a broadly relevant item. It is a vector that becomes a neighbor unusually often under the representation and distance geometry in use. For developers, the distinction matters because a retrieval pipeline can compute cosine similarity or Euclidean distance exactly as specified and still produce systematically repetitive candidates.

Artificial Intelligence Embeddings

Cybersecurity / 12 Sep 2026 / 8 min read

HTTP Request Boundaries Must Survive Every Parser

A reverse proxy can reject a request as malformed and still leave a dangerous assumption intact: that every other HTTP parser in the path would have found the same message boundary. Modern web stacks routinely place a CDN, load balancer, gateway, service proxy, framework server, and application logic between a client and the code that handles a request. A single connection can therefore pass through several independent implementations of HTTP framing.

Cybersecurity HTTP Security

Tech / Updated 15 Sep 2026 / 9 min read

How Automatic Screen Brightness Responds to Your Surroundings

A phone screen that looks comfortable indoors can seem almost black in direct sunlight. Move into a dark room and that same brightness can feel harsh. Automatic screen brightness is meant to handle this change without making you adjust the display every time your surroundings change. The basic idea is simple: a device measures the light around it and changes the display output to suit those conditions. The details matter, though. Automatic brightness is not a fixed rule that maps one sensor reading to one brightness value, and not every brightness change comes from the room around you.

Displays Smartphones

Go / 12 Sep 2026 / 5 min read

Flush Buffered HTTP Data with http.ResponseController in Go

An HTTP handler can write bytes without making those bytes immediately visible to the client. The server, transport, middleware, or another layer may buffer response data. For handlers that emit incremental output, http.ResponseController.Flush provides an explicit request to push buffered data toward the client. The operation belongs to the current response. It does not turn a normal handler into a separate transport protocol, and it does not guarantee that every intermediary on the network will forward each chunk at the same instant. Its useful contract is narrower: ask the active response writer to flush data it has buffered.

Golang HTTP

Go / 12 Sep 2026 / 4 min read

Filter Map Entries in Place with maps.DeleteFunc

Filtering a Go map often means removing entries from an existing map rather than allocating a replacement. maps.DeleteFunc expresses that operation directly: it visits entries and deletes each pair for which a predicate returns true. That mutation model is the central detail. The function does not return a filtered copy, and callers that share the same map observe the deletions. The predicate receives both key and value maps.DeleteFunc accepts a map and a function with the key and value types of that map. A compact filter can use either argument or both:

Go Maps

Software Engineering / 12 Sep 2026 / 9 min read

Fencing Tokens: Block Stale Lease Holders

Fencing Tokens: Block Stale Lease Holders A distributed lease can grant one process temporary permission to act, but expiration alone cannot stop that process from acting after its lease has ended. A long pause, network delay, overloaded runtime, or suspended virtual machine can leave an old holder unaware that another process has already acquired the lease. This creates a subtle safety gap. Two processes can both believe they are entitled to modify the same resource, even when the lease service itself grants ownership correctly.

Software Engineering Distributed Systems

Software Engineering / 12 Sep 2026 / 8 min read

Fencing Tokens for Expiring Distributed Leases

A lease can expire while its holder is still running. That single property separates a distributed lease from an ordinary in-process mutex. The coordinator may grant ownership to another client after a deadline, yet the former holder can resume after a long pause and continue issuing operations based on authority it no longer has. The coordinator has done its job: it stopped treating the old client as the current holder. The shared resource has a different problem. Unless operations carry evidence of ownership order, the resource may have no basis for distinguishing a current holder from a stale one.

Software Engineering Distributed Systems

Artificial Intelligence / 12 Sep 2026 / 7 min read

Extend RoPE Context with Position Interpolation

A transformer that uses rotary position embeddings can accept a larger token buffer at the serving layer and still behave poorly at positions far beyond the range used during model training. The tensor shapes may be valid while the positional phases presented to attention are outside the regime the model adapted to. Position interpolation addresses that mismatch by compressing a longer sequence’s position indices into the original position interval before applying RoPE. It does not add memory to the architecture, and it does not make long-context behavior equivalent to native training at the extended length. It changes the positional coordinates supplied to attention.

Artificial Intelligence LLM