All articles

Cybersecurity / 07 Sep 2026 / 10 min read

Treat Signed URLs as Bearer Capabilities

A signed URL can make private content easy to share. Instead of requiring the recipient to authenticate to the storage service, an application creates a URL containing enough authorization information for the service to accept a specific request. That convenience changes the security model. Anyone who obtains a usable copy of the URL may be able to exercise the authority it carries. If the URL permits too much, remains valid too long, or is exposed through logs and messages, a small disclosure can become unintended access.

Cybersecurity Access Control

Cybersecurity / 07 Sep 2026 / 10 min read

Treat File Uploads as Untrusted Content

A file-upload feature can appear simple: accept bytes, save them, and let another user download them later. The security problem is that the uploaded file crosses several trust boundaries. Its name, declared type, contents, and eventual delivery behavior are all influenced by the uploader. If the application treats any of those properties as trustworthy, an ordinary upload can become an unintended way to consume excessive resources, overwrite data, feed dangerous content into a parser, or make a browser handle attacker-controlled bytes in a more powerful context than intended.

Cybersecurity Secure Coding

Cybersecurity / 07 Sep 2026 / 10 min read

Treat Authenticator Enrollment as an Account-Control Change

Adding an authenticator can look like an ordinary settings change. It is not. A newly enrolled security key, authenticator app, or other login method may be accepted during future sign-ins, long after the session that created it has ended. That makes enrollment an account-control change: it changes which evidence the system will trust as proof of the user’s identity. If a stolen session is enough to add a new authenticator, an attacker may turn temporary session access into a durable way to return later.

Cybersecurity Authentication

Artificial Intelligence / 07 Sep 2026 / 9 min read

Transfer Hyperparameters Across Model Width with MuP

Scaling a neural network creates an expensive tuning problem. A learning rate that works for a small prototype may behave differently after hidden dimensions become much wider. If every model size needs a fresh hyperparameter sweep, experimenting on small models saves less compute than it first appears. Maximal Update Parametrization, usually written MuP or μP, addresses this problem by changing how parameter initialization and learning rates scale with model width. The goal is not to make a wider model identical to a narrow one. It is to make important training dynamics behave consistently enough that hyperparameters tuned on a smaller proxy can often transfer to a wider target.

Artificial Intelligence Machine Learning

Artificial Intelligence / 07 Sep 2026 / 10 min read

Train Neural Networks with Sharpness-Aware Minimization

A neural network can reach low training loss at parameter values where a small change to the weights makes the loss rise sharply. Standard optimization does not directly discourage this behavior: it mainly asks whether the loss is low at the current parameters. Sharpness-Aware Minimization (SAM) changes the training objective. Instead of optimizing only the loss at the current weights, it approximately optimizes the worst loss in a small neighborhood around them. The practical idea is simple: find a nearby parameter perturbation that makes the current mini-batch harder, then update the original model using the gradient measured at those perturbed parameters.

Artificial Intelligence Machine Learning

Software Engineering / 07 Sep 2026 / 9 min read

Testing Failure Semantics, Not Just Errors

A test that expects an error can still miss the most damaging part of a failure. An order operation may return payment declined correctly while also marking the order as paid. A file import may report that parsing failed after writing half of its records. A retry may succeed but send the same notification twice. In each case, the visible error is correct. The failure semantics are not. Failure semantics describe what the system promises about state, side effects, and subsequent operations when something goes wrong. Testing them means asking more than “did this fail?” This article shows how to identify those promises and turn them into focused tests.

Software Engineering Testing

Go / 07 Sep 2026 / 11 min read

Suppress Duplicate Concurrent Work in Go with singleflight

A service can become overloaded even when each individual request is reasonable. Imagine a popular product whose cached record expires. Fifty requests arrive almost together, all observe the same cache miss, and all start the same database query. The problem is not ordinary parallelism. Those requests are doing duplicate work for the same result at the same time. golang.org/x/sync/singleflight provides a small mechanism for suppressing that duplication inside one Go process. For a given key, one caller performs the work while concurrent callers for the same key wait and receive the same result. Calls using different keys can still perform their own work.

Go Concurrency

Go / 07 Sep 2026 / 8 min read

Stream Data Between Go Components with io.Pipe

Many Go APIs meet at io.Reader and io.Writer. That makes components easy to compose until both sides want to drive the operation. A compressor may want an io.Writer where it can emit bytes incrementally, while an uploader wants an io.Reader from which it can pull those bytes. One tempting solution is to write everything into a bytes.Buffer first and upload it afterward. That works, but it turns a streaming pipeline into a whole-payload allocation.

Golang IO

Cybersecurity / 07 Sep 2026 / 10 min read

Store API Keys as Verifiers, Not Recoverable Secrets

An API key is often treated like a password: a client presents a secret string, and the server decides whether that string represents an authorized caller. Yet many systems store API keys in plaintext because the application needs to compare them later. That design creates an avoidable consequence. If an attacker obtains the credential database, every stored plaintext key may immediately become a usable credential. The database leak becomes an authentication compromise as well as a data leak.

Cybersecurity API Security

Tech / 07 Sep 2026 / 9 min read

Sleep vs Hibernate: What Happens to Your Open Work

Closing a laptop lid often makes the screen go dark, yet opening it later can bring back the same windows within seconds. Hibernation can also restore an open session, but it usually takes longer and uses less power while the computer is inactive. The difference comes down to where the computer keeps the information needed to restore your session. Sleep normally keeps that working state in memory while the machine remains in a low-power condition. Hibernation saves the state to non-volatile storage so it can survive without continuously powering memory.

Computers Laptops

Tech / 07 Sep 2026 / 7 min read

Sleep vs Hibernate vs Shut Down: What Actually Changes

A laptop’s power menu may offer Sleep, Hibernate, and Shut Down. All three can leave the screen dark, but the computer is not in the same state. The practical difference is what the computer keeps ready for your return. Sleep prioritizes a quick resume, hibernation prioritizes preserving your session while using very little power, and shutdown ends the current operating-system session. Understanding that distinction makes it easier to choose the right option when taking a short break, putting a laptop in a bag, leaving it unused for days, or troubleshooting a problem.

Computers Laptops

Artificial Intelligence / 07 Sep 2026 / 10 min read

Resolve Conflicting Gradients in Multi-Task Learning

Training one neural network to solve several tasks can reduce duplicated computation and let related tasks share useful representations. It also creates a problem that single-task training does not have: two losses can ask the same shared parameter to move in opposing directions during the same update. Simply adding the losses does not make that disagreement disappear. Their gradients are added too, so one task can partially cancel another or dominate the shared update. Gradient surgery is a family of techniques that changes task gradients before combining them. A well-known example is projected conflicting gradients, commonly called PCGrad, which removes a conflicting component of one task’s gradient relative to another.

Artificial Intelligence Machine Learning

Cybersecurity / 07 Sep 2026 / 10 min read

Require Independent Approval for High-Impact Actions

Some administrative actions are dangerous for a reason that ordinary role-based access control does not fully address: one authorized identity can cause an unusually large or difficult-to-reverse effect. Consider an administrator who can disable organization-wide authentication controls, replace a production signing key, or permanently delete a large body of security-relevant data. Strong authentication and least privilege reduce who can reach that action. They do not help enough if the one account that is legitimately allowed to perform it is compromised, or if its operator makes a serious mistake.

Cybersecurity Access Control

Artificial Intelligence / 07 Sep 2026 / 10 min read

Repetition Controls for Language Model Generation

A language model can produce fluent text and still get stuck repeating a phrase, sentence pattern, or idea. A support reply may restate the same apology three times. A summarizer may loop over one point. A long generation can begin copying a short phrase again and again. The tempting fix is to turn up a “repetition” setting until the duplicate text disappears. That can solve one symptom while creating another: names become awkward, code becomes invalid, required terms disappear, or a model avoids repeating words that the task genuinely needs.

Artificial Intelligence LLM

Go / 07 Sep 2026 / 7 min read

Reject Unknown JSON Fields in Go API Requests

Go makes it pleasantly simple to decode JSON into a struct. That convenience also hides a compatibility decision that matters at API boundaries: by default, fields that do not map to the destination struct are ignored. For internal data this can be useful. For an HTTP request, it can turn a typo into a silent behavior change. A client may send "expires_inn": 3600 while the server expects "expires_in". The JSON is valid, decoding can succeed, and the server may continue with a zero value or a default. The caller receives no direct signal that the field it thought it supplied was never used.

Golang JSON

Software Engineering / 07 Sep 2026 / 10 min read

Reducing Temporal Coupling by Making Order Explicit

Some APIs look simple because each method is simple. The difficulty appears only when you try to use them correctly: one method must run before another, a third method is legal only after some state change, and cleanup must happen at the end. The code is then coupled not only to what operations exist, but also to when they happen. This is temporal coupling: correctness depends on operations occurring in a particular order. Some ordering is unavoidable. You cannot read a file before opening it, and a transaction cannot commit before it begins. The design problem is hidden or unnecessarily fragile ordering, where callers must remember rules that the API does not make clear.

Software Engineering Software Design

Software Engineering / 07 Sep 2026 / 9 min read

Reducing Coupling with Connascence

Two pieces of code are coupled when a change in one can require a change in the other. That definition is useful, but it leaves an important engineering question unanswered: which coupling should you fix first? A shared constant, a parameter order, and a distributed workflow can all create coupling. Treating them as equally harmful leads to unnecessary abstractions in some places and fragile dependencies in others. Connascence gives a more precise mental model. Two software elements are connascent when they must agree in some way for the system to work correctly. By asking what must agree, how difficult that agreement is to maintain, how far apart the elements are, and how many elements participate, you can make better refactoring decisions.

Software Engineering Software Design

Software Engineering / 07 Sep 2026 / 10 min read

Reducing Change Coupling with the Law of Demeter

A line of code can be short and still know too much. Consider a shipping service that needs the destination country for an order: country = order.customer().profile().shippingAddress().countryCode() The line works, but it depends on several structural decisions at once: an order has a customer, the customer has a profile, the profile owns the shipping address, and the address exposes a country code. If any link in that path changes, the shipping service may need to change even though its actual responsibility did not.

Software Engineering Software Design

Cybersecurity / 07 Sep 2026 / 13 min read

Recheck Authorization When Resource Ownership Changes

Changing who owns a resource can look like an ordinary data update. In a security model, it can be much more important: ownership often determines who may read the resource, change it, share it, or grant access to somebody else. If an application changes the owner_id but leaves every related permission untouched, people who were legitimate collaborators under the old owner may silently keep access after the resource crosses into a new security boundary. The reverse can also happen: a transfer may remove access that the new owner expected to inherit.

Cybersecurity Access Control

Go / 07 Sep 2026 / 12 min read

Read Large Line-Oriented Input Safely in Go with bufio.Scanner

Line-oriented input looks simple until one record is much larger than expected. A program may process thousands of ordinary log lines correctly, then stop on a generated stack trace, a large JSON record, or a malformed input that contains no newline for megabytes. Go’s bufio.Scanner is convenient for this job because it handles tokenization and defaults to scanning lines. But that convenience comes with an important boundary: a scanner has a maximum token size. If a token cannot fit within that limit, scanning stops with an error.

Go I/O

Go / 07 Sep 2026 / 11 min read

Read File Regions Safely in Go with io.ReaderAt

Many file formats are not consumed strictly from beginning to end. An index may point to records at known offsets. A binary container may keep metadata in a header and payloads elsewhere. A server may need to serve several independent byte ranges from the same open file. The obvious approach is to call Seek, then Read. That works when one goroutine owns the file position. It becomes fragile when several operations share the same file because the current offset is mutable state.

Go I/O

Cybersecurity / 07 Sep 2026 / 11 min read

Protect Security Logs from Tampering

Security logs are most valuable after something has gone wrong. That is also when their trustworthiness matters most. Imagine an application records failed sign-ins, privilege changes, and administrative actions to a file on the same server that runs the application. The logging is detailed and correctly formatted. But if an attacker gains enough control of that server to edit or delete the file, the investigation may lose the very evidence it was supposed to rely on.

Cybersecurity Security Logging

Software Engineering / 07 Sep 2026 / 9 min read

Property-Based Testing for Behavioral Invariants

Example-based tests are excellent when you know the cases that matter. You choose an input, state the expected result, and protect that behavior from regression. The weakness is also clear: the test checks only the examples you thought to write. Some defects hide between those examples. A parser works for ordinary names but fails on an empty segment. A range-normalization function works for the three values in the test file but produces an invalid range for an unusual ordering. A serializer handles familiar records but loses information for one combination of optional fields.

Software Engineering Testing

Artificial Intelligence / 07 Sep 2026 / 10 min read

Probe Neural Network Representations with Linear Classifiers

A neural network can produce the right output while leaving an important engineering question unanswered: what information exists inside its intermediate representations? Suppose an image classifier predicts product categories. You may want to know whether an early layer already separates shapes, whether a later layer distinguishes categories, or whether a supposedly irrelevant attribute such as camera source remains easy to recover. Looking only at the final prediction does not answer those questions.

Artificial Intelligence Machine Learning