All articles

Artificial Intelligence / 10 Sep 2026 / 9 min read

Regularize Neural Networks with Mixup

Regularize Neural Networks with Mixup A neural network can fit its training examples while behaving unpredictably in the space between them. If two nearby inputs belong to different classes, standard training tells the model what to do at the endpoints but often says little about intermediate points. Mixup changes that training signal. Instead of training only on individual examples, it creates synthetic examples by interpolating pairs of inputs and their labels. The model is then asked to make a correspondingly mixed prediction. This acts as a regularizer because it constrains how predictions may change between training examples.

Artificial Intelligence Machine Learning

Software Engineering / 10 Sep 2026 / 7 min read

Reducing Change Amplification in Software Design

A small requirement arrives: add a new delivery status called delayed. The rule itself is simple, but implementing it means editing validation, display labels, notification logic, reporting code, and several tests in unrelated directories. Nothing is individually difficult. The risk comes from having to remember every place that represents the same idea. This is change amplification: one conceptual change requires many coordinated code changes. Some amplification is unavoidable, but repeated scattering is a useful design signal. Learning to recognize it helps you decide where a refactoring can make future changes smaller and less error-prone.

Software Engineering Software Design

Artificial Intelligence / 10 Sep 2026 / 9 min read

Reduce Repetitive Generation with Unlikelihood Training

Reduce Repetitive Generation with Unlikelihood Training A language model can learn to predict ordinary text well and still assign too much probability to behavior you don’t want at generation time. Repetition is a common example: once a phrase appears, the model may keep making recently used tokens plausible enough that a decoding loop becomes hard to escape. Changing the decoder can hide some of this behavior, but it doesn’t change the probabilities learned by the model. Unlikelihood training takes a different approach. During training, it identifies undesirable candidates and explicitly pushes their probabilities down while the usual likelihood objective pushes desired tokens up.

Artificial Intelligence Machine Learning

Software Engineering / 10 Sep 2026 / 10 min read

Reconciliation Loops for Self-Healing Systems

Reconciliation Loops for Self-Healing Systems A one-shot operation works well when every step succeeds. Real systems are less cooperative. A process crashes after creating half its resources, an external API times out after accepting a request, an operator changes something manually, or a dependency becomes unavailable and recovers later. If correctness depends on one command completing perfectly, every interruption creates another recovery path to design and operate. A reconciliation loop uses a different model. Instead of saying, “perform these steps once,” the system repeatedly asks, “what should be true, what is true now, and what is the smallest safe action that moves reality toward the desired state?” That shift is useful for controllers, background jobs, provisioning systems, synchronizers, and any workflow where state can drift after the initial operation.

Software Engineering Reliability

Cybersecurity / 10 Sep 2026 / 10 min read

Rate Limit Login Attempts Without Creating Easy Lockouts

A login endpoint has to accept wrong passwords. Users mistype them, password managers can hold stale credentials, and old devices sometimes retry automatically. An attacker can use the same interface to make thousands of guesses unless the application limits how quickly authentication can be attempted. The obvious fix is to lock an account after several failures. That slows guessing, but it creates another problem: anyone who knows a username may be able to keep that user locked out by deliberately submitting bad passwords.

Cybersecurity Authentication

Cybersecurity / 10 Sep 2026 / 10 min read

Rate Limit Login Attempts Without Creating a Lockout Weapon

A login endpoint has an awkward property: before authentication succeeds, it must accept requests from people whose identity it hasn’t proved yet. That makes it a natural target for automated password guessing. If the endpoint allows unlimited attempts, an attacker gets unlimited opportunities to try credentials. If it permanently locks an account after a few failures, the attacker may be able to lock out the legitimate user instead. Login rate limiting is the middle ground. It reduces how quickly repeated authentication attempts can be made, but the design matters. A useful limiter needs to constrain attacks aimed at one account, attacks coming from one source, and distributed attacks without turning every false positive into a long outage.

Cybersecurity Authentication

Go / 10 Sep 2026 / 6 min read

Process Go Slices in Batches with slices.Chunk

Batching a slice sounds simple until the loop starts collecting edge cases: the final batch may be short, an empty input needs sensible behavior, and careless subslicing can leave each batch with capacity to overwrite later elements. Go 1.23 added slices.Chunk, which handles that bookkeeping and exposes the batches as an iterator. If you already have the data in a slice and want to process consecutive groups without first building a [][]T, it’s a useful small tool.

Go Slices

Artificial Intelligence / 10 Sep 2026 / 10 min read

Prevent FP16 Gradient Underflow with Dynamic Loss Scaling

Prevent FP16 Gradient Underflow with Dynamic Loss Scaling Mixed-precision training can reduce memory use and accelerate supported operations, but float16 introduces a numerical problem that is easy to miss: some gradients are too small to survive in FP16. They can round to zero before the optimizer gets a chance to use them. Loss scaling addresses that problem by multiplying the loss before backpropagation, which multiplies the resulting gradients by the same factor. The gradients are divided by that factor before the optimizer update, so the intended update is unchanged when the arithmetic remains finite. Dynamic loss scaling adjusts the factor during training so you don’t have to guess one fixed value for the whole run.

Artificial Intelligence Machine Learning

Artificial Intelligence / 10 Sep 2026 / 9 min read

Prepare Models for Low-Precision Inference with Quantization-Aware Training

A model can work well in floating point and lose useful accuracy after its weights or activations are quantized for deployment. The problem is not mysterious: rounding and clipping change the numbers that flow through the network, while the original model was optimized without those changes in the loop. Quantization-aware training (QAT) exposes the model to an approximation of those low-precision numerics while its parameters can still adapt. Training remains differentiable in floating point, but the forward computation simulates the quantization errors expected after conversion.

Artificial Intelligence Machine Learning

Go / 10 Sep 2026 / 7 min read

Preallocate Append Capacity in Go with slices.Grow

Sometimes you know a slice is about to receive several elements, even though you don’t have those elements yet. Repeated append calls will grow the slice automatically, but some of those appends may have to allocate a larger backing array and copy the existing elements. slices.Grow lets you reserve enough capacity for a known amount of upcoming growth. It doesn’t add placeholder elements and it doesn’t change the slice’s length. It simply returns a slice that has room for at least the requested number of additional elements.

Go Slices

Cybersecurity / 10 Sep 2026 / 9 min read

Pin Third-Party Browser Assets with Subresource Integrity

Loading JavaScript directly from another organisation’s server creates a security dependency that is easy to overlook. Your page may contain only a short <script> tag, but the downloaded file executes with the privileges that your site gives that script. If the file at that URL changes unexpectedly, your users can receive code you never reviewed or deployed. Subresource Integrity (SRI) gives the browser an expected cryptographic hash for a fetched resource. The browser hashes the bytes it receives and loads the resource only when the result matches the declared value. That turns “load whatever this URL serves” into “load the specific content I approved from this URL.”

Cybersecurity Software Supply Chain

Software Engineering / 10 Sep 2026 / 8 min read

Parse at Boundaries to Protect Domain Invariants

Parse at Boundaries to Protect Domain Invariants A request arrives with a string that is supposed to be an order quantity. One function checks that the string contains a number. Another checks that the number is positive. A third assumes both checks already happened. Months later, a new caller reaches the third function directly and passes zero. The problem isn’t simply missing validation. The program keeps carrying a weak representation after it already knows something stronger about the value.

Software Engineering Software Design

Artificial Intelligence / 10 Sep 2026 / 10 min read

Pack Training Sequences Without Leaking Between Examples

Pack Training Sequences Without Leaking Between Examples Language-model training often wastes computation on padding. If a batch contains examples with very different lengths, shorter examples are extended with padding so tensors have compatible shapes. The model still has to move those tensor positions through parts of the training pipeline even though they contain no training content. Sequence packing reduces that waste by placing multiple shorter examples into one fixed-length training sequence. The idea is simple; the boundary handling is not. If attention or loss masks are wrong, one example can accidentally use another example as context, or the model can be trained to predict tokens that should not count as targets.

Artificial Intelligence LLM

Artificial Intelligence / 10 Sep 2026 / 10 min read

Neural Collapse in Deep Classifiers

Neural Collapse in Deep Classifiers A classifier can keep changing after it already predicts every training example correctly. Cross-entropy loss can continue to fall, feature vectors can reorganize, and the final classification layer can become increasingly regular. Looking only at training accuracy hides all of that movement. Neural collapse is a name for a collection of geometric patterns that can emerge late in the training of deep classifiers. The striking part isn’t simply that examples from the same class become similar. Under the conditions where neural collapse appears, within-class variation can shrink while class centers and classifier weights approach a highly symmetric arrangement.

Artificial Intelligence Neural Networks

Software Engineering / 10 Sep 2026 / 11 min read

Negative Caching for Repeated Failures

Negative Caching for Repeated Failures Caching usually brings successful results to mind: load a value once, keep it for a while, and avoid repeating expensive work. But repeated failures can be just as expensive as repeated successes. Suppose a service receives thousands of requests for an object that does not exist. If every request queries the same downstream system, the absence of that object becomes a source of load. The same pattern appears with invalid identifiers, unavailable optional resources, failed name lookups, and other outcomes that are expensive to rediscover but unlikely to change immediately.

Software Engineering Reliability

Tech / 10 Sep 2026 / 10 min read

Mesh Wi-Fi vs Range Extender: What Changes at Home?

A weak Wi-Fi room creates an obvious question: should you add a range extender or replace the setup with mesh Wi-Fi? Both approaches can put another Wi-Fi radio closer to your devices. The important difference is how those radios are connected and managed. That affects placement, roaming around the home, available capacity, and how much troubleshooting you may need later. Understanding that difference is more useful than treating mesh as automatically superior or an extender as automatically slow.

Wi-Fi Home Networking

Artificial Intelligence / 10 Sep 2026 / 8 min read

Mask Prompt Tokens During Instruction Fine-Tuning

A supervised language-model example often contains more than the text you want the model to produce. It may include a system message, a user request, separators, and an assistant answer. If you compute next-token loss over the entire sequence, the model is trained to predict all of those tokens, not just the assistant response. That may be intentional for some training objectives. For instruction fine-tuning, though, developers often want the prompt to provide context while only selected response tokens contribute to the supervised loss. A loss mask makes that distinction explicit.

Artificial Intelligence LLM

Cybersecurity / 10 Sep 2026 / 10 min read

Limit Decompression Before Untrusted Data Exhausts Resources

A service may reject a 100 MB upload and still accept a much smaller compressed file that expands far beyond the memory or storage the service can afford. The upload limit measured the bytes crossing one boundary. The expensive work happens after that boundary, when the application decompresses, parses, indexes, scans, or stores the expanded data. This is the practical problem behind decompression bombs: compact input can cause disproportionate resource use when software expands it without enforcing a budget on the result. The consequence is usually availability loss rather than unauthorized access. Workers can run out of memory, temporary storage can fill, CPU time can be consumed, and a queue of expensive jobs can delay ordinary requests.

Cybersecurity Secure Coding

Cybersecurity / 10 Sep 2026 / 10 min read

Keep User-Controlled Redirects on Trusted Destinations

Login flows often need to remember where a user was going. A request arrives for /billing, the application sends the user to sign in, then redirects them back after authentication. The feature is useful, but it becomes an open redirect when an untrusted value can make the application send the browser to an arbitrary destination. That matters because the redirect begins on a domain the user already trusts. A crafted link can legitimately reach your application and then immediately send the browser somewhere you never intended. Redirect parameters can also cross security boundaries in authentication and authorization flows when code assumes that “after login” is automatically a trusted place.

Cybersecurity Web Security

Cybersecurity / 10 Sep 2026 / 8 min read

Keep Untrusted Redirects on Your Own Origin

A login page often needs to remember where a user was going. After authentication, the application might read a next or return_to parameter and send the browser there. The feature looks harmless because the redirect happens only after the application has finished its real work. The problem appears when that parameter can name any destination. An attacker can then distribute a link on your trusted domain that immediately sends visitors somewhere the attacker chose. This is an open redirect: untrusted input controls the destination of an HTTP redirect without a sufficiently strict destination policy.

Cybersecurity Secure Coding

Cybersecurity / 10 Sep 2026 / 9 min read

Keep Untrusted Data Out of Native Object Deserializers

A convenient serializer can turn an object graph into bytes and later rebuild it with one function call. That convenience becomes a security problem when the bytes come from a request, message, uploaded file, cache entry, or other source an attacker can influence. Some native object formats carry more than plain values: they can encode types, object relationships, or instructions that cause application-defined behavior during reconstruction. If an application treats such input as ordinary data, parsing may cross a trust boundary before validation gets a chance to help. The result can range from unexpected object state to dangerous code paths, depending on the serialization system and the classes available to it.

Cybersecurity Secure Coding

Cybersecurity / 10 Sep 2026 / 8 min read

Keep Untrusted Data from Forging Log Events

Security logs often contain untrusted data: usernames, request paths, user-agent strings, filenames, API parameters, and error details. Recording those values is useful, but treating them as preformatted log text can blur the boundary between what happened and data supplied by the requester. If an attacker-controlled value can create what looks like another log record, an investigator or automated parser may misread fabricated text as an event produced by the application. This is commonly called log injection or log forging.

Cybersecurity Secure Coding

Cybersecurity / 10 Sep 2026 / 8 min read

Keep Private Responses Out of Shared Caches

A cache can make a web application faster by reusing a response instead of asking the application to generate it again. That becomes a security problem when the reused response contains data for one particular user. If a shared cache stores a personalized account page under a key that does not distinguish users, a later requester may receive the first user’s response. Authentication at the application can be perfectly correct and the data can still cross an authorization boundary because the second request never reaches that application logic.

Cybersecurity Web Security

Go / 10 Sep 2026 / 5 min read

Iterate Go Slices in Reverse with slices.Backward

Walking a slice from the end used to mean writing the index loop yourself. That works, but the loop mechanics can distract from the actual job, especially when you need both the original index and the value. Since Go 1.23, slices.Backward provides that traversal directly. It returns an iterator. The slice stays in its original order, no reversed copy is created, and the indexes you receive are the real indexes from the source slice.

Go Slices