All articles

Python / 08 Sep 2026 / 9 min read

Use UUIDv7 for Time-Ordered Identifiers in Python

Python 3.14 added uuid.uuid7(), giving applications a standard-library way to generate UUID version 7 identifiers defined by RFC 9562. UUIDv7 is useful when an application wants a globally shaped 128-bit identifier while also putting creation time near the front of the identifier. That property can make newly generated values naturally cluster by time in systems that sort UUIDs by their binary or canonical value. It is tempting to summarize UUIDv7 as “a sortable UUID.” That is directionally useful but incomplete. The timestamp has millisecond resolution, Python adds a counter for monotonicity within a millisecond, clocks can move, and separate processes do not become a distributed sequence generator merely because they all use UUIDv7.

Python UUID

Artificial Intelligence / 08 Sep 2026 / 9 min read

Use Test-Time Augmentation Without Hiding Model Errors

A model usually makes one prediction from one representation of an input. That is convenient, but the representation may contain accidental details that should not determine the answer. A product photo can be shifted a few pixels. A scanned digit can be slightly rotated. A crop can place the object closer to one edge than another. Test-time augmentation (TTA) asks the trained model to predict several valid transformations of the same input and then combines those predictions. The technique can make inference less dependent on one particular view, but it also increases compute and can make predictions worse when the transformations change information that matters to the label.

Artificial Intelligence Machine Learning

Artificial Intelligence / 08 Sep 2026 / 9 min read

Use Test-Time Augmentation for More Stable Predictions

A classifier can change its prediction because an object moved a few pixels, an image was cropped differently, or another harmless transformation changed the input representation. If those transformations should not change the correct answer, that sensitivity is undesirable. Test-time augmentation (TTA) addresses this problem by running the same trained model on several meaning-preserving versions of an input and combining their predictions. Instead of asking the model for one view of the evidence, TTA asks it to evaluate several valid views.

Artificial Intelligence Machine Learning

Artificial Intelligence / 08 Sep 2026 / 10 min read

Use Self-Conditioning in Diffusion Models

A diffusion model repeatedly turns a noisy state into a cleaner one. Each denoising call normally receives the current noisy sample, a noise level or timestep, and any external condition such as a text embedding. Yet the previous call has already produced useful information about what the clean sample may look like. Throwing that estimate away means the next call must reconstruct similar information again from the new noisy state.

Artificial Intelligence Diffusion Models

Python / 08 Sep 2026 / 8 min read

Use Native Max-Heaps with Python heapq

Python’s heapq module has historically been centered on min-heaps: the smallest element lives at index zero. Developers who needed a max-heap commonly negated numeric priorities before pushing them and negated them again after popping. Python 3.14 makes that workaround unnecessary for many programs. heapq now exposes a complete max-heap API: heapify_max(), heappush_max(), heappop_max(), heappushpop_max(), and heapreplace_max(). The new functions are simple, but using them well still requires understanding heap invariants, fixed-size selection, tie-breaking, and the important difference between push-pop and replace operations.

Python heapq

Software Engineering / 08 Sep 2026 / 9 min read

Use Mutation Testing to Find Weak Tests

A test suite can execute every line of an important function and still fail to detect that the function is wrong. Coverage tells you which code ran. It does not tell you whether the assertions would notice a meaningful defect in that code. Mutation testing approaches the problem from the other direction. A mutation testing tool makes small, deliberate changes to production code and runs the tests. If the tests fail, they detected the change. If the tests still pass, the altered behavior has exposed a possible weakness in the suite.

Software Engineering Testing

Go / 08 Sep 2026 / 9 min read

Use Go Timers Correctly After Go 1.23

Timer code in Go has accumulated a surprising amount of folklore. Older examples warn that time.After leaks resources, insist that every stopped timer channel must be drained, and wrap Timer.Reset in careful stop-and-drain sequences. Those rules were important for older Go programs. They are not all current rules. Go 1.23 changed the implementation and guarantees of channel-based timers. Unreferenced timers can now be garbage collected before they fire, and timer channels use synchronous semantics that prevent stale values after Stop or Reset returns. The result is simpler timer code—but only when the program is actually using the new semantics.

Go Timers

Cybersecurity / 08 Sep 2026 / 11 min read

Use Envelope Encryption to Limit Key Exposure

Encrypting sensitive data is only part of the design problem. The application also needs access to the encryption key, and that key must be stored, rotated, authorized, backed up, and eventually retired. If one long-lived key directly encrypts every record, changing how that key is protected can become tightly coupled to re-encrypting all of the data. Envelope encryption separates those jobs. Data is encrypted with a data-encryption key, while that data key is itself protected by another key. This extra layer does not make encryption magically stronger. Its value is operational: it lets a system protect many data keys behind a smaller set of tightly controlled key-encryption keys and change the outer protection without necessarily rewriting the underlying data.

Cybersecurity Encryption

Cybersecurity / 08 Sep 2026 / 12 min read

Use Content Security Policy as XSS Defense in Depth

A web application can carefully encode output and still acquire an injection bug later through a new template, a third-party component, or unsafe client-side code. If attacker-controlled text reaches a place where the browser interprets it as JavaScript, the result can be cross-site scripting (XSS): code runs in the security context of the application and can act with whatever authority the page already has. The primary fix is to stop untrusted data from becoming executable code. Content Security Policy (CSP) adds a second boundary. The server sends a policy that tells the browser which scripts are allowed to execute. A well-designed policy can therefore reduce the impact of some XSS flaws even when the application accidentally places attacker-controlled markup into a page.

Cybersecurity Web Security

Cybersecurity / 08 Sep 2026 / 10 min read

Use Authenticated Encryption for Data You Must Trust

Encrypting sensitive data can hide its contents while still leaving an important question unanswered: has the encrypted data been changed? If an application decrypts modified ciphertext without a reliable integrity check, it may consume attacker-influenced plaintext even though the attacker never learned the encryption key. That distinction matters anywhere decrypted data affects a security decision, a payment amount, a permission, a destination, or another meaningful application state. Confidentiality answers who can read the data. Integrity answers whether the protected data is the same data that an authorized key holder produced.

Cybersecurity Encryption

Software Engineering / 08 Sep 2026 / 9 min read

Turning Validation into Trusted Data

A request enters an application with an email address, a quantity, and a delivery method. The request handler validates all three fields. Later, the pricing code checks the quantity again. The notification code checks the email again. A background job checks the delivery method again. The system has validation, but developers still cannot tell which values are safe to use without checking them first. A more useful design goal is to make validation change what the program knows about the data. Unchecked input crosses a boundary, validation establishes specific facts, and successful validation produces a representation that preserves those facts. Code after that boundary can then rely on the representation instead of repeatedly rediscovering the same conditions.

Software Engineering Software Design

Cybersecurity / 08 Sep 2026 / 9 min read

Treat Recovery Codes as One-Time Authenticators

Multi-factor authentication can fail for ordinary reasons: a phone is replaced, a hardware authenticator is lost, or an authenticator application becomes unavailable. Recovery codes give a user a backup path, but that path also becomes part of the authentication system. If a copied recovery code keeps working after it has been used, anyone who obtained the copy may be able to reuse it later. The useful mental model is therefore simple: a recovery code is a one-time backup authenticator, not a reusable emergency password. The server should accept a valid code once, consume it as part of that successful authentication, and reject the same code afterward.

Cybersecurity Authentication

Artificial Intelligence / 08 Sep 2026 / 10 min read

Transformer Attention Weights: What They Show and What They Do Not

Transformer attention maps are visually compelling. A token appears to assign most of its attention to another token, so it is tempting to conclude that the second token caused the model’s prediction. That conclusion is stronger than the data supports. An attention weight has a precise local meaning: inside one attention operation, it controls how strongly a query mixes information from available value vectors. A complete transformer prediction, however, also depends on value vectors, residual connections, feed-forward layers, normalization, later layers, and often many attention heads. A large weight is therefore evidence about one routing operation, not a complete causal explanation.

Artificial Intelligence Transformers

Artificial Intelligence / 08 Sep 2026 / 10 min read

Train Neural Networks with Curriculum Learning

Most training pipelines treat the dataset as a fixed pool and repeatedly shuffle it. That is a strong default: it is simple, exposes the model to the full data distribution, and avoids assumptions about which examples should come first. But some learning problems have a useful notion of progression. A model may learn basic patterns more reliably before it is asked to handle noisy, ambiguous, or structurally difficult examples. Curriculum learning makes that progression explicit. Instead of changing the model architecture or the loss, it changes which training examples are emphasized at different stages of training. A common curriculum begins with easier examples and gradually introduces harder ones.

Artificial Intelligence Machine Learning

Artificial Intelligence / 08 Sep 2026 / 11 min read

Trade Compute for Memory with Activation Checkpointing

A neural network can fit comfortably in accelerator memory for inference and still run out of memory during training. The reason is that training needs more than model weights. Backpropagation also needs intermediate values from the forward pass, and those activations can consume a large share of memory in deep models or with long sequences and large batches. Activation checkpointing reduces that memory pressure by deliberately not keeping every intermediate activation. Instead, training saves selected checkpoints and recomputes missing forward-pass values when the backward pass needs them. The trade is straightforward: keep fewer activations in memory, but perform extra computation.

Artificial Intelligence Machine Learning

Artificial Intelligence / 08 Sep 2026 / 9 min read

Trace Token Influence with Attention Rollout

Looking at one Transformer attention matrix can answer a local question: which positions a token attends to in that layer. It does not directly tell you how much an input token can influence a representation several layers later. The reason is mixing. After one layer, a token representation already contains information gathered from other positions. The next layer attends to those mixed representations, not to untouched input tokens. Residual connections add another path that carries each representation forward. Reading only the final layer therefore skips the paths through earlier layers.

Artificial Intelligence Transformers

Cybersecurity / 08 Sep 2026 / 9 min read

Throttle Authentication Failures Without Creating a Lockout Weapon

A login endpoint has to reject wrong credentials, but rejection alone does not control how quickly someone can keep trying. If an application accepts thousands of password attempts against the same account with no meaningful slowdown, an attacker gets many chances to guess a valid password. A simple permanent lock after a few failures creates a different problem: anyone who knows a username may be able to lock out its owner on demand.

Cybersecurity Authentication

Artificial Intelligence / 08 Sep 2026 / 9 min read

The Softmax Bottleneck in Language Models

A language model can have a powerful network behind it and still be constrained by the layer that turns its hidden state into next-token probabilities. In the common linear-softmax output layer, that constraint has a precise form: across many contexts, the model can represent only a limited family of log-probability patterns. This limitation is known as the softmax bottleneck. It is not a claim that softmax itself is defective, nor does it mean every modern language model is visibly harmed by it. It is a structural result about a particular output parameterization.

Artificial Intelligence Machine Learning

Software Engineering / 08 Sep 2026 / 9 min read

Testing Test Suites with Mutation Testing

A test suite can execute every line of an important function and still fail to notice that the function is wrong. Coverage tells you which code ran during tests. It does not tell you whether the tests would detect a meaningful mistake in that code. Mutation testing examines that missing question. A mutation testing tool makes small changes to production code, one change at a time, and runs the relevant tests. If the tests fail, they detected the changed behavior. If they still pass, the altered code has exposed something worth investigating.

Software Engineering Testing

Software Engineering / 08 Sep 2026 / 9 min read

Testing Resilience with Fault Injection

A service can pass every normal-path test and still behave badly when a dependency times out, a write fails halfway through, or a connection disappears at an inconvenient moment. The problem is often not missing error handling. It is that the team has never observed whether the error handling produces the behavior they expect. Fault injection is the deliberate introduction of a controlled failure into a system or test. Instead of waiting for a real dependency to fail, you make a specific failure happen and observe the consequence.

Software Engineering Testing

Software Engineering / 08 Sep 2026 / 9 min read

Testing Hard-to-Test Code with Humble Objects

Some code is difficult to test for reasons that have little to do with the behavior you care about. A user-interface callback depends on a framework event loop. A scheduled job reads the clock, queries a service, writes a file, and decides whether to alert someone. A device handler receives data through an operating-system API before applying a simple rule. When the decision and the awkward environment live in the same unit, every test inherits the environment’s complexity. The test may need framework setup, timing control, filesystem state, or several mocks just to reach a small branch.

Software Engineering Testing

Software Engineering / 08 Sep 2026 / 7 min read

Testing Complex Rules with Decision Tables

A rule can be easy to understand one condition at a time and still be difficult to test correctly when several conditions interact. Consider a refund policy. A refund depends on whether the order is within 30 days, whether the item is damaged, and whether it was marked final sale. Writing a few examples from memory can miss an important combination. Adding every possible combination can create noisy tests that repeat the same reasoning.

Software Engineering Testing

Tech / 08 Sep 2026 / 8 min read

Tap to Click vs Press to Click: What Your Touchpad Is Detecting

A laptop touchpad can often register a click in two noticeably different ways. You can lightly tap the surface, or you can press down until the touchpad registers a click. Both may select a button or place the text cursor, yet they are not necessarily the same physical action. The distinction matters when a touchpad feels too sensitive, clicks while you type, refuses to click near an edge, or behaves differently after you change a setting. The useful mental model is simple: a tap is mainly a touch gesture, while a press is a click action detected by the touchpad hardware and software. How the press is detected varies between touchpad designs.

Touchpads Laptops

Database / 08 Sep 2026 / 7 min read

Store JSON Faster with SQLite JSONB

I like SQLite’s JSON functions because they let me keep a small amount of flexible data without immediately turning every property into a column. The trade-off is easy to miss: if I store JSON as text, SQLite has to parse that text before it can navigate the structure. Since SQLite 3.45.0, there is another option. SQLite can persist its binary JSON representation, called JSONB, directly in a BLOB. Here’s the idea: if the database is going to inspect the same JSON repeatedly, I can let SQLite store the representation it already wants to process instead of making it parse the text again.

Database SQLite