All articles

Artificial Intelligence / 07 Sep 2026 / 9 min read

Prevent Catastrophic Forgetting in Continual Learning

Updating a neural network with new data sounds straightforward: continue training on the new examples and deploy the improved model. The difficulty is that an update which helps the new data can damage behavior the model learned earlier. A classifier that learns a new group of products, for example, may become worse at recognizing older groups even though those old classes never changed. This failure is called catastrophic forgetting. It matters most in continual learning, where a model learns from a sequence of tasks or data distributions instead of training once on a fixed mixed dataset.

Artificial Intelligence Machine Learning

Go / 07 Sep 2026 / 14 min read

Observe Streaming Reads in Go with io.TeeReader

Streaming code often needs to do two things with the same bytes. A service may need to parse a response while computing its checksum. A file importer may want to decode records while recording exactly what the decoder consumed. A diagnostic tool may want to inspect a stream without first loading the entire input into memory. A common but wasteful approach is to read everything into a byte slice and then run each operation over that copy. That is simple for small inputs, but it removes the main advantage of streaming: work can begin before the whole input has arrived, and memory usage does not have to grow with the full input size.

Go I/O

Cybersecurity / 07 Sep 2026 / 9 min read

Notify Users When Authentication Controls Change

An application can protect a password change, authenticator enrollment, or account-recovery flow with strong checks and still need a plan for the case where those checks are defeated. If an attacker manages to change an authentication control, the legitimate user may otherwise have no visible signal until the attacker uses the new access or locks them out. A security notification gives the user a second chance to detect that change. The important design detail is independence: the notice should not depend only on the channel or authenticator that the change just replaced.

Cybersecurity Authentication

Artificial Intelligence / 07 Sep 2026 / 10 min read

Neural Network Pruning: Sparsity, Structure, and Speed

A neural network can contain parameters that contribute little to its useful predictions. Removing some of them can reduce storage or computation, but there is an important trap: a model with fewer nonzero weights is not automatically a model that runs faster. That distinction matters when developers use pruning to compress a trained network. The pruning rule determines what disappears, the hardware and runtime determine whether the resulting structure can be exploited, and the evaluation procedure determines whether the saved resources are worth any quality loss.

Artificial Intelligence Neural Networks

Software Engineering / 07 Sep 2026 / 9 min read

Modeling Special Cases as Explicit Behavior

A system often starts with one ordinary case and one exception. A customer has a normal pricing plan unless the account is a guest. A shipment has a delivery date unless it is pickup-only. A report has an owner unless it is generated by the system. The first exception is usually harmless. The problem appears when the same check spreads through the code. Every caller asks whether it has the exceptional case before deciding what to do. Adding a new operation then means finding another place where the condition must be repeated.

Software Engineering Refactoring

Artificial Intelligence / 07 Sep 2026 / 12 min read

Measure Tokenization Efficiency Across Languages

Two prompts can communicate roughly the same amount of information and still consume very different numbers of model tokens. The difference can appear between languages, writing systems, domains, or even formatting styles. That matters because language-model systems usually operate on tokens rather than characters or words. A context window is measured in tokens. Many hosted APIs account for usage in tokens. Longer token sequences can also increase inference work, although the exact latency and compute effect depends on the model, serving stack, batching, caching, and whether the tokens belong to the input or generated output.

Artificial Intelligence LLM

Cybersecurity / 07 Sep 2026 / 9 min read

Match OAuth Redirect URIs Exactly

An OAuth authorization server eventually has to answer a deceptively simple question: where may it send the browser after authorization? If that destination is validated too loosely, an authorization response intended for one client can be sent somewhere the client does not control. In an authorization-code flow, that can expose the authorization code to another endpoint. Other protections may still limit what can be done with a leaked code, but redirect validation should not create the leak in the first place.

Cybersecurity OAuth

Software Engineering / 07 Sep 2026 / 9 min read

Managing Feature Flags as Temporary Code

A feature flag can make a risky change easier to release. Instead of making deployment and exposure happen at the same moment, the team can deploy code while keeping new behavior disabled, enable it for a limited audience, observe the result, and turn it off without rebuilding the application. That flexibility has a cost. Every flag introduces another condition that can affect behavior. If old flags remain indefinitely, developers must reason about combinations that no longer serve a useful purpose.

Software Engineering Feature Flags

Python / 07 Sep 2026 / 11 min read

Manage Dynamic Resource Lifetimes in Python with ExitStack

A normal with statement works best when you know the resources before the block starts: with open("input.csv", "rb") as source, open("output.csv", "wb") as target: ... The structure is clear because both files are known in advance. Python enters each context manager and guarantees that their exit logic runs when the block finishes, including when an exception leaves the block.

Python Standard Library

Cybersecurity / 07 Sep 2026 / 8 min read

Make Protected Routes Private by Default

A team can have good authorization checks and still expose a new endpoint by forgetting to attach them. This failure is especially easy to introduce when routes are registered one at a time: most protected handlers use authentication or authorization middleware, but one new handler is added without it and becomes reachable under the framework’s default behavior. The consequence depends on what that route does. A missed guard can expose private data, allow a state-changing operation, or make an administrative function available to callers who should never reach it.

Cybersecurity Authorization

Cybersecurity / 07 Sep 2026 / 10 min read

Let a New Password Reset Request Supersede Older Ones

A password reset link is temporary authority to replace an account credential. If a user requests three reset emails and all three links remain valid, the application has created three independent pieces of recovery authority. Using one link may not remove the risk from the other two. That matters because reset messages can remain in inboxes, mail previews, browser history, or other places the application does not control. A user may request a second link because the first message arrived late, looked stale, or was requested by mistake. If the second request leaves the first token valid, the user’s attempt to start over has not actually replaced the earlier recovery path.

Cybersecurity Authentication

Artificial Intelligence / 07 Sep 2026 / 9 min read

Knowledge Distillation for Smaller Classifiers

A model can be accurate enough for a product and still be too expensive to deploy. A large classifier may exceed a mobile memory budget, miss a latency target, or cost too much when every request requires substantial compute. Replacing it with a smaller model reduces those costs, but training the smaller model only from ground-truth labels can leave useful information behind. Knowledge distillation addresses this problem by training a smaller student model to learn from a stronger teacher model. Instead of seeing only the correct class, the student can also learn how the teacher distributes its confidence across the alternatives.

Artificial Intelligence Machine Learning

Software Engineering / 07 Sep 2026 / 10 min read

Keeping Behavior Close to Data with Tell, Don’t Ask

A class can hide its fields and still force every caller to understand its rules. The usual symptom is code that asks an object for several values, makes a decision with those values, and then tells the object what state to change. That design spreads knowledge. When the rule changes, every place that reconstructed the rule may need to change too. Tell, Don’t Ask is a design heuristic for reducing that problem. Instead of asking an object for internal information so another object can decide what should happen, tell the object the intent and let the component that owns the relevant rules make the decision.

Software Engineering Software Design

Cybersecurity / 07 Sep 2026 / 12 min read

Keep Security Log Timestamps Comparable Across Systems

Security logs often become most important when several systems disagree about what happened. An identity service records a login, an API records a privileged request, and a database records a change. Investigators then sort those events by time to reconstruct the sequence. That reconstruction can be wrong even when every log entry is genuine. If one system’s clock is two minutes fast and another is one minute slow, sorting their timestamps can place effects before causes. A detector that expects two events within 30 seconds can miss a real sequence for the same reason.

Cybersecurity Security Logging

Cybersecurity / 07 Sep 2026 / 11 min read

Keep Archive Extraction Inside Its Destination

Extracting an archive looks like a file-copying task: read each entry, join its name to a destination directory, and write the bytes. The security problem is that an archive entry name is input chosen by whoever created the archive. If that name can influence the output path without a containment check, extraction can write outside the directory the application intended to grant. The consequence is broader than a misplaced file. Depending on the process’s permissions, an escaped write may replace application data, configuration, generated assets, or another file that the extractor can modify.

Cybersecurity Secure Coding

Rust / 07 Sep 2026 / 10 min read

Initialize Shared Rust State Once with OnceLock

Applications often need one shared value that is expensive or awkward to construct but should not change after initialization. Examples include parsed configuration, a lookup table, a compiled matcher, or metadata discovered during startup. A plain static works only when the value can be created as a constant. A Mutex<Option<T>> can represent “not initialized yet,” but it also introduces a lock and a mutable state model that the program may not need after setup.

Rust Concurrency

Artificial Intelligence / 07 Sep 2026 / 9 min read

Improve Reasoning Reliability with Self-Consistency

A language model can reach different answers to the same reasoning problem depending on how generation unfolds. One sampled path may make an arithmetic mistake, another may misread a condition, and a third may reach the correct result. If an application trusts only one path, its answer depends heavily on that single generation. Self-consistency uses this variability instead of trying to eliminate it. It samples several reasoning paths for the same problem, extracts their final answers, and chooses the answer supported by the largest share of the samples. The technique is an inference-time strategy: it does not require changing model weights.

Artificial Intelligence LLM

Tech / 07 Sep 2026 / 7 min read

How Voice Assistants Hear a Wake Word Without Processing Everything You Say

A voice assistant can appear to be waiting for you all day. You say its trigger phrase, and it responds almost immediately. That raises a reasonable question: if the device can hear the wake word, does it have to fully recognize and process every conversation in the room first? Usually, no. Devices that support hands-free activation can use a small, specialised wake-word detector that looks for a particular sound pattern. It does not need to understand every sentence in order to decide whether the trigger phrase was probably spoken.

Voice Assistants Smartphones

Tech / 07 Sep 2026 / 9 min read

How QR Codes Store Information and Still Scan When Damaged

QR codes appear on tickets, menus, product labels, signs, and screens. Point a phone camera at one and the device may offer to open a website, join a service, show text, or pass information to an app. It is easy to think of the pattern as a picture that points to something online. A QR code is more direct than that: the grid itself stores data. A web address can be encoded in the squares, for example, and the scanner reads that address from the image.

QR Codes Smartphones

Tech / 07 Sep 2026 / 8 min read

How Push Notifications Reach Your Phone When an App Is Not Open

A message can appear on your phone minutes or hours after you last used the app that sent it. That can make it seem as though every app must stay fully active in the background, constantly checking the internet for something new. Modern phone notifications usually work differently. For many apps, the operating system and its notification infrastructure maintain the important connection, while individual apps can remain inactive. When a service has something to tell you, it sends a small message through a push-notification service that can reach the phone on the app’s behalf.

Smartphones Notifications

Tech / 07 Sep 2026 / 7 min read

How Laptop Touchpads Ignore Your Palm While You Type

Your palm can rest partly on a laptop touchpad while you type, yet the pointer usually stays where it belongs. Then, occasionally, the cursor jumps or a click happens by accident. The touchpad is not simply turning itself off whenever a key is pressed. It is continuously trying to decide which contact is intentional and which contact should be ignored. This process is commonly called palm rejection. It combines information from the touch-sensitive surface with software rules that classify contacts. Understanding that distinction explains both why modern touchpads work surprisingly well and why they can still make mistakes.

Laptops Touchpads

Tech / Updated 15 Sep 2026 / 7 min read

How Autosave Works and Why You Can Still Lose Changes

Many writing, note-taking, design, and productivity apps save your work automatically. That can make the old habit of pressing a Save button feel unnecessary. But autosave does not mean that every change instantly becomes permanent or that every mistake can be undone forever. An app can save automatically and still lose the most recent edits after a crash, synchronize an unwanted change to other devices, or keep too little history to recover an older version.

Files Digital Tools

Artificial Intelligence / 07 Sep 2026 / 13 min read

Handle Label Shift in Deployed Classifiers

A classifier can keep seeing familiar inputs and still make worse decisions after deployment. One reason is that the frequency of the classes has changed. Imagine a model trained to classify support tickets as billing, account, or technical. During training, billing tickets made up 20% of examples. After a pricing migration, billing issues temporarily rise to 50%. The model has not changed, but one part of the environment has: the prior probability of each class.

Artificial Intelligence Machine Learning

Go / 07 Sep 2026 / 9 min read

Handle Go HTTP Response Bodies Without Leaking Connections

An HTTP request can appear to work while quietly making later requests more expensive. A common cause in Go clients is mishandling http.Response.Body: forgetting to close it, returning before cleanup is arranged, or assuming that an HTTP error status is returned as a Go error. The important mental model is that a successful Client.Do call gives your code ownership of a stream, not a byte slice. The response headers have arrived, but the body is consumed as you read it. Your code must decide how much of that stream it needs and must close it when finished.

Go HTTP