All articles

Artificial Intelligence / 08 Sep 2026 / 9 min read

Detect Out-of-Distribution Inputs with Energy Scores

A classifier can be highly accurate on its test set and still behave confidently on inputs that are unlike anything it was trained to recognize. A product classifier trained on shoes, bags, and watches may receive a photo of a bicycle and still be forced to choose one of its known classes. That creates a deployment problem: ordinary classification answers which known class looks most likely, but many systems also need to ask whether this input resembles the data on which the classifier was validated.

Artificial Intelligence Machine Learning

Go / 08 Sep 2026 / 7 min read

Detach Go Work Safely with context.WithoutCancel

Request cancellation is usually exactly what a Go service wants. When a client disconnects or a request deadline expires, database calls, HTTP requests, and other downstream work should normally stop too. Sometimes one small piece of work has a different lifetime. A handler may need to enqueue an audit record, finish a bounded cache update, or send a best-effort notification after the request itself is no longer alive. Passing the request context directly makes that work inherit cancellation. Replacing it with context.Background() avoids cancellation, but also throws away useful request-scoped values.

Go Context

Software Engineering / 08 Sep 2026 / 11 min read

Designing Read-Your-Writes Consistency

A user changes their delivery address, sees a success message, and opens the order page. The old address appears. They refresh a few seconds later and the new value finally shows up. Nothing necessarily lost the write. The system may have accepted it correctly and then served the next read from a copy that had not caught up yet. From the user’s perspective, however, a successful update appeared to reverse itself.

Software Engineering Reliability

Software Engineering / 08 Sep 2026 / 8 min read

Designing for Change Locality

A product rule changes from “free delivery above $50” to “free delivery above $60.” The code change sounds small, but the developer has to edit a checkout service, an order validator, a receipt formatter, and two unrelated utility modules. Missing one location leaves the system internally inconsistent. The problem is not simply that several files changed. Some changes legitimately cross many files. The warning sign is that one conceptual decision is represented in several places that must change together.

Software Engineering Software Design

Software Engineering / 08 Sep 2026 / 9 min read

Designing a Test Portfolio for Useful Feedback

A test suite can contain thousands of tests and still give poor engineering feedback. It may run slowly, fail for unrelated reasons, miss important integration mistakes, or make small implementation changes expensive because too many tests depend on internal details. The usual response is to argue about test categories: more unit tests, fewer end-to-end tests, or a particular shape such as a testing pyramid. Those models can be useful reminders, but a fixed ratio does not tell you whether a specific test earns its cost.

Software Engineering Testing

Cybersecurity / 08 Sep 2026 / 10 min read

Design Break-Glass Access for Emergencies

Strong access controls can create an uncomfortable failure mode: the controls that protect administration may themselves become unavailable during an incident. An identity provider can fail, a privileged-access service can be misconfigured, or an administrator can accidentally remove the last usable administrative role. If every recovery action depends on the failed component, responders may be unable to repair the system. A break-glass path is emergency privileged access kept for situations where the normal administrative path cannot be used. The name suggests breaking a physical emergency panel: using it is exceptional, visible, and followed by investigation and repair. That analogy is useful, but the actual mechanism is simply a deliberately separate way to obtain narrowly defined privileged access under controlled conditions.

Cybersecurity Access Control

Artificial Intelligence / 08 Sep 2026 / 8 min read

Deep Ensembles for Model Uncertainty

A neural network can return a confident prediction even when an input is unfamiliar or ambiguous. Looking only at one model’s largest probability can therefore hide an important question: would another plausible model, trained on the same task, make the same decision? A deep ensemble helps answer that question by training several neural networks independently and combining their predictions. The combined prediction can improve robustness in some settings, while disagreement among members provides a practical uncertainty signal. It is not a guarantee that the prediction is correct, and it does not detect every kind of uncertainty.

Artificial Intelligence Machine Learning

Python / 08 Sep 2026 / 8 min read

Copy File-Like Streams Safely with shutil.copyfileobj in Python

Many Python programs need to move bytes between objects that behave like files without caring whether either side is an ordinary disk file. The source might be a decompressor, an uploaded file, an in-memory buffer, or a response body. The destination might be a temporary file, another buffer, or a wrapper that transforms data as it is written. For that job, shutil.copyfileobj() is a small but useful standard-library primitive. It copies from one file-like object to another and lets the objects themselves define where the bytes ultimately come from and go.

Python Files

Python / 08 Sep 2026 / 8 min read

Copy and Move Paths with pathlib in Python 3.14

Python 3.14 adds high-level copy and move operations directly to pathlib.Path. Path.copy(), Path.copy_into(), Path.move(), and Path.move_into() make many filesystem workflows easier to express without switching between pathlib, shutil, and os for basic operations. The convenience is useful, but filesystem mutations still need explicit policy. Overwrites, symbolic links, metadata, cross-filesystem moves, partial failure, and concurrent changes can all affect correctness. The four new operations Use copy() when the destination path itself is known:

Python pathlib

Go / 08 Sep 2026 / 7 min read

Contain Untrusted File Access in Go with os.Root

Applications often combine a trusted directory with a file name that came from somewhere less trusted: an HTTP request, archive entry, manifest, job message, or database row. The obvious implementation is also a common security boundary mistake: path := filepath.Join("./uploads", userName) f, err := os.Open(path) If userName can select a path outside ./uploads, the application may expose files it never intended to touch. Even careful string validation becomes harder when symbolic links and concurrent filesystem changes enter the picture.

Golang Security

Cybersecurity / 08 Sep 2026 / 10 min read

Confine Archive Extraction to a Trusted Directory

An application that accepts ZIP, TAR, or similar archives may appear to be handling one uploaded file. During extraction, however, the archive can ask the application to create many filesystem objects with names chosen by whoever created the archive. If those names are treated as trusted paths, extraction can write outside the directory the application intended to use. The consequence can be more serious than a misplaced file. Depending on the process permissions and surrounding system, an unintended write might replace application data, alter configuration, or place content where another component will later consume it.

Cybersecurity Secure Coding

Cybersecurity / 08 Sep 2026 / 8 min read

Compare Security Secrets Without Leaking Match Length

Applications compare secret values in places that look deceptively simple: message authentication codes, signed-request tags, API tokens, and other authentication material. A normal string or byte equality operator may return as soon as it finds a mismatch. When the compared value is secret, that data-dependent work can create a timing signal about how much of a guess matched. This does not mean every ordinary string comparison is remotely exploitable. Network noise, runtime behaviour, compiler optimisations, rate limits, and the surrounding protocol all affect what an attacker can measure. The defensive lesson is narrower: when equality itself protects a secret or cryptographic authenticator, do not make its comparison time depend on the matching prefix if your platform already provides a hardened comparison primitive.

Cybersecurity Secure Coding

Cybersecurity / 08 Sep 2026 / 10 min read

Compare Secret Values Without Data-Dependent Early Exit

Applications compare secret-derived values in many places: webhook message authentication codes, API tokens, password-reset tokens, signed request authenticators, and other proofs that a caller knows a secret. A normal string or byte comparison may stop as soon as it finds a difference. That is efficient for ordinary data, but it can be the wrong behavior at a security boundary. If the amount of comparison work depends on where two secret values first differ, an observer may be able to learn something from repeated timing measurements. Whether that signal is practically exploitable depends on the surrounding system, noise, protocol, implementation, and attacker access. The defensive decision is still straightforward: when equality of a secret or secret-derived authenticator controls access, use the platform’s dedicated constant-time comparison primitive rather than writing the comparison yourself.

Cybersecurity Secure Coding

Python / 08 Sep 2026 / 8 min read

Compare Neighboring Values Lazily with itertools.pairwise

Many data-processing tasks are really questions about transitions: Did a measurement increase? How long was the gap between two events? Did a state change? Is a sequence sorted? These problems need neighboring values, not arbitrary pairs. Python 3.10 added itertools.pairwise() for exactly this pattern. It produces overlapping adjacent pairs lazily, which makes the intent clearer than manual indexing and lets the same code work with lists, generators, files, and other iterables.

Python Itertools

Software Engineering / 08 Sep 2026 / 8 min read

Choosing Coverage Criteria for Conditional Logic

A test suite can report high coverage and still miss an important bug. The problem is often not the percentage itself, but what the percentage measures. Consider a decision such as isMember && hasCredit. A test may execute the if statement, both outcomes of the decision, or each individual condition in different ways. Those are different kinds of evidence. Treating them as interchangeable makes coverage numbers more reassuring than they should be.

Software Engineering Testing

Python / 08 Sep 2026 / 5 min read

Change Working Directories Safely with contextlib.chdir

Changing the current working directory is one of those operations that looks local in code but is global in effect. I still see scripts that call os.chdir(), do some work, and then try to remember where they started. Python 3.11 added contextlib.chdir(), which makes the restore step much cleaner. To be fair, though, a context manager does not make changing the working directory concurrency-safe. The important part is understanding what state is being changed and how long that state stays changed.

Python contextlib

Cybersecurity / 08 Sep 2026 / 8 min read

Canonicalize Resource Identifiers Before Authorization

Access control becomes unreliable when the application authorizes one representation of a resource but later operates on another. A file may be reachable through aliases, an object may have both a public name and an internal ID, or a path may have several textual forms that resolve to the same target. If different parts of the request pipeline disagree about identity, an authorization check can answer the wrong question. The defensive rule is to establish a canonical resource identity before making the security decision. Canonical means the single representation that the application treats as authoritative for identifying that resource. Resolve untrusted names or aliases to that identity, authorize the identity, and make the protected operation use the same resolved object.

Cybersecurity Access Control

Cybersecurity / 08 Sep 2026 / 8 min read

Build Security Links from Trusted Origins

Applications often need to send absolute links in email: password-reset links, email-verification links, invitation links, and similar security-sensitive URLs. A convenient implementation takes the hostname from the incoming HTTP request and combines it with a generated token. That convenience can cross a trust boundary. Request host information is input, and deployments may also receive forwarded host information from proxies. If an attacker can influence the value used to build a security link, the application can generate a valid secret token but place it inside a URL for the wrong origin. A user who follows that URL may disclose the token to a host the application does not trust.

Cybersecurity Secure Coding

Python / 08 Sep 2026 / 7 min read

Budget Async Work with asyncio.timeout

Timeouts in asynchronous programs are easy to scatter and surprisingly hard to compose. A service call gets five seconds, a database query gets five more, and a retry gets another five. Each individual limit looks reasonable, yet the whole request can run far beyond the caller’s budget. Python 3.11 added asyncio.timeout(), an asynchronous context manager that makes a different model practical: put a time budget around a block of work, not just around one awaitable.

Python asyncio

Python / 08 Sep 2026 / 9 min read

Batch Python Iterables Lazily with itertools.batched

Processing data in groups is common in Python. An application may send records to an API 100 at a time, insert rows into a database in manageable groups, or divide a stream of identifiers into work units without first loading the whole input into memory. Since Python 3.12, the standard library provides itertools.batched() for this pattern. It consumes an iterable lazily and yields tuples containing up to a requested number of items. Python 3.13 added a strict option for cases where an incomplete final batch should be treated as an error.

Python Iterators

Artificial Intelligence / 08 Sep 2026 / 10 min read

Avoid Tokenization Boundary Failures in LLM Generation

A language model application usually treats a prompt as text: provide a prefix, then ask the model to continue it. The model sees something more specific. Its tokenizer first converts that text into tokens, and the end of the prompt forces the last token to end at exactly that position. That detail can matter when the prompt ends at a character position that would normally fall inside a larger token if the prompt and its continuation were tokenized together. The resulting tokenization boundary problem, also called the partial token problem, can make an otherwise natural continuation unexpectedly unlikely.

Artificial Intelligence LLM

Cybersecurity / 08 Sep 2026 / 10 min read

Avoid Check-Then-Use Races in File Operations

A program often checks a file before using it. It may confirm that a path is inside an allowed directory, that the target is not a symbolic link, that the file belongs to an expected user, or that it does not already exist. The code then opens, replaces, deletes, or executes the file. The security problem is the gap between those two operations. If another actor can change the relevant filesystem state after the check but before the use, the program may validate one object and operate on another. This is a time-of-check to time-of-use race, often shortened to TOCTOU.

Cybersecurity Secure Coding

Artificial Intelligence / 07 Sep 2026 / 12 min read

Xavier and He Initialization for Neural Networks

A deep neural network can fail before learning has had a fair chance. If its initial weights make activations or gradients shrink layer after layer, useful signals can become tiny. If those quantities grow too much, training can become unstable. The optimizer may receive a problem that is unnecessarily difficult even though the architecture and data are otherwise reasonable. Weight initialization tries to start the network in a numerically useful regime. Two common schemes are Xavier initialization, also called Glorot initialization, and He initialization, also called Kaiming initialization. Both choose the scale of random weights from the size of a layer, but they make different assumptions about how signals pass through the activation function.

Artificial Intelligence Machine Learning

Tech / 07 Sep 2026 / 7 min read

Why Your Phone’s Volume Buttons Do Not Always Change the Same Volume

You press a volume button while watching a video and the video gets quieter. Press the same button during a phone call and the caller gets quieter instead. On another occasion, you lower the volume before putting the phone away, yet a notification later sounds louder than expected. The buttons are not necessarily behaving inconsistently. A phone can maintain separate volume levels for different kinds of sound, and the physical buttons usually adjust the level that is most relevant at that moment. The exact groups and button behaviour vary by operating system, device maker, and settings.

Smartphones Audio