All articles

Software Engineering / 19 Sep 2026 / 6 min read

Write Skew Breaks Cross-Row Invariants Under Snapshot Isolation

Snapshot isolation can let two transactions commit even when their combined result violates a rule that each transaction checked before writing. The anomaly appears when both transactions read the same logical condition, then write different rows. Because their write sets do not overlap, ordinary write-write conflict detection has nothing to reject. This is write skew. It matters at the boundary between application invariants and database isolation: a transaction may see a consistent snapshot and still participate in a final state that would have failed its own predicate.

Software Engineering Database

Cloud Computing / 19 Sep 2026 / 5 min read

Wildcard Subdomains on Cloudflare Workers: Routing and TLS Boundaries

A hostname such as demo.instara.app can reach a Cloudflare Worker through one wildcard DNS record and one Worker Route. A deeper hostname such as web.demo.instara.app can resolve through the same wildcard DNS record and still fail before the Worker runs because the edge certificate does not cover that hostname. That distinction matters because three independent mechanisms participate in the request: DNS resolution | v Worker Route matching | v TLS certificate coverage They all use wildcard syntax, but they do not have identical matching rules.

Cloud Computing Cloudflare Workers

Artificial Intelligence / 19 Sep 2026 / 8 min read

Where PEGASUS-XSum Inference Time Goes

google/pegasus-xsum is a summarization checkpoint, not a compact text utility. Its latency follows directly from the work performed by a large Transformer encoder-decoder: first encode the source document, then run the decoder repeatedly until the summary is complete. On a CPU, the second phase is usually the part that makes a short output feel disproportionately expensive. The original PEGASUS work describes a Transformer encoder-decoder pretrained with Gap Sentences Generation and reports a 568M-parameter best model. The XSum checkpoint is fine-tuned for highly abstractive single-document summarization. That combination is useful when summary quality matters, but it also means inference has substantially more machinery than extracting a few source sentences or running a small classifier.

Artificial Intelligence Summarization

Tech / 19 Sep 2026 / 5 min read

When a Transformer Surface Can Become an Electric-Shock Hazard

A transformer can have exposed metal around its core, frame, mounting hardware, or enclosure while carrying hazardous voltage on its windings. Those metal parts are not automatically live simply because the transformer is energized. Whether touching them can produce an electric shock depends on the transformer’s construction, insulation condition, protective earthing, and the electrical path between the person and the circuit. The important distinction is between a conductor intended to carry voltage and an accessible conductive part that should remain separated from it.

Transformer Electrical Safety

Tech / 19 Sep 2026 / 7 min read

What Happens When a Charger Cannot Supply Enough Current

A charger’s current rating is a capacity limit, not a fixed amount of current that it forces into a device. A 5 V, 3 A supply does not continuously push 3 A into every connected load. The load draws current according to its circuitry, while the source must keep its output within specification up to the current it is designed to provide. The interesting case begins when the device would benefit from more power than the source can supply. Depending on the charger, cable, charging protocol, and device power-management circuit, the result can be slower charging, reduced input voltage, source shutdown, repeated reconnects, or battery discharge even while the charger remains connected.

Charging Power Supply

Tech / 19 Sep 2026 / 5 min read

What Actually Receives a Radio Signal: Antenna, Tuning, Detection, and Amplification

A radio receiver does not begin with a transistor. It begins at the antenna terminals, where an electromagnetic field produces a small RF voltage and current that the rest of the circuit can process. That distinction matters in discrete-transistor projects. An antenna, a tuned network, a detector, and an amplifier perform different electrical jobs. Combining their names into “the radio circuit” hides the boundary that determines whether a receiver can select a station, recover its modulation, and produce enough output to hear.

Electronics Radio

Tech / 19 Sep 2026 / 8 min read

What a DT-9205A Digital Multimeter Can Measure and Where Its Limits Matter

The DT-9205A is a manual-ranging digital multimeter built around a 3½-digit LCD, typically displaying values up to 1999 counts. Its rotary switch selects both the measurement function and the range, so the meter depends more heavily on correct setup than an autoranging instrument. The DT-9205A name is used by multiple manufacturers and sellers. Functions and maximum ranges can differ between versions, even when the front panels look similar. The markings on the actual meter and its supplied manual therefore take precedence over specifications found for another DT-9205A variant.

Digital Multimeter DT-9205A

Cloud Computing / 19 Sep 2026 / 6 min read

WebSocket Lifecycles in Cloudflare Workers: Upgrade, Coordination, and Hibernation

A Cloudflare Worker can terminate a WebSocket connection directly. The harder architectural question appears after the upgrade succeeds: where does connection state live, which process coordinates multiple clients, and what remains valid when the runtime is no longer in memory? Those are separate boundaries: HTTP request | | Upgrade: websocket v Worker | +-- one independent connection | +-- shared room / session / presence | v Durable Object | v optional hibernation Treating all of them as “WebSocket support” hides the behavior that matters most in production.

Cloud Computing Cloudflare Workers

Cybersecurity / 19 Sep 2026 / 6 min read

WebAuthn Signature Counters Are Clone Signals, Not Identity Proofs

WebAuthn Signature Counters Are Clone Signals, Not Identity Proofs A relying party can verify a valid WebAuthn assertion and still receive a counter value that adds no useful evidence about credential cloning. The signature proves possession of the credential private key for the signed assertion. The signCount field has a narrower role: when an authenticator maintains a usable signature counter, changes in that value can give the relying party evidence that the same credential may be active in more than one place.

Cybersecurity WebAuthn

Cybersecurity / 19 Sep 2026 / 6 min read

WebAuthn Signature Counters Are a Clone Signal, Not a Session Guarantee

A WebAuthn assertion can carry a valid signature and still present an operational anomaly: its signature counter is not greater than the value stored after an earlier successful assertion. That condition is useful, but it is not equivalent to proof that a private key was copied, and it does not make the counter a replay-prevention mechanism. The signCount field sits inside authenticator data. A relying party receives that authenticator data as part of an assertion and verifies it together with the client data and signature. The counter can give the relying party evidence about authenticator state across successful ceremonies. Its security value depends on the authenticator’s counter behavior and on the relying party retaining the prior value correctly.

Cybersecurity WebAuthn

Tech / 19 Sep 2026 / 7 min read

Web3 Domains Do Not Replace DNS: The ENS Resolution Boundary

A name such as alice.eth looks like an Internet domain, but its resolution path is not the same as example.com. A conventional domain normally enters the Domain Name System, where resolvers follow the DNS hierarchy to obtain records such as A, AAAA, MX, or TXT. An ENS name enters a different naming system whose authoritative state is expressed through Ethereum smart contracts. That distinction is the practical boundary behind many claims about “Web3 domains.” The name can be globally meaningful to software that implements ENS resolution while remaining unknown to a DNS resolver. A browser, wallet, or dApp therefore needs an ENS-aware resolution path before .eth can behave like a useful name.

Tech Web3

Software Engineering / 19 Sep 2026 / 5 min read

Version Columns Turn Database Updates into Conditional State Transitions

A database client can read a row, spend time computing a change, then issue an UPDATE after another transaction has already changed the same row. If the final statement identifies the row only by its primary key, the later write can replace state derived from the intervening transaction without any visible conflict. A version column changes that boundary. The client reads both the application state and a revision value, then includes that revision in the update predicate. The database accepts the write only while the stored revision still matches the state the client observed.

Software Engineering Databases

Linux / 19 Sep 2026 / 5 min read

userfaultfd Write Protection Turns Memory Writes into Userspace Events

A thread can reach a valid, resident page and still stop before modifying it. With Linux userfaultfd write-protect mode, a registered page can be marked so that a write generates a userfaultfd page-fault event. A userspace handler receives that event, performs its bookkeeping, removes the protection, and lets the blocked thread continue. The mechanism sits between ordinary page permissions and application-level memory accounting. The page remains part of the process address space; the kernel redirects the write fault into a file-descriptor protocol instead of forcing the application to build the same control path around mprotect() and SIGSEGV.

Linux userfaultfd

Cybersecurity / 19 Sep 2026 / 6 min read

userfaultfd Write Protection Moves Memory Writes Behind a User-Space Fault Boundary

A thread can hold a writable virtual memory mapping and still block when it attempts to modify a particular page. Linux userfaultfd write-protect mode lets user space register a memory range, apply write protection to pages in that range, and receive a page-fault event when a protected page is written. The VMA can remain logically writable while page-table state creates a narrower interception boundary. This mechanism is not a general authorization system. It is a memory-fault control interface. Its security relevance comes from the placement of the decision point: a write can be suspended before the protected page changes, allowing a separate handler to record state, coordinate migration, preserve a snapshot boundary, or reject progress by leaving the fault unresolved.

Cybersecurity Linux

Linux / 19 Sep 2026 / 5 min read

userfaultfd Moves Selected Page-Fault Resolution into User Space

A memory access normally enters the kernel page-fault path and completes without an application choosing the page contents at that instant. Linux userfaultfd changes that boundary for registered virtual address ranges: selected faults become events on a file descriptor, and a user-space manager can supply or activate the page before the faulting thread continues. The mechanism does not replace the process page tables with a user-space data structure. The kernel still owns page-table state and performs the final mapping operation. User space gains control over specific fault classes and the timing of their resolution.

Linux Memory Management

Software Engineering / 19 Sep 2026 / 8 min read

Transactional Outbox Couples State Change to Message Intent

A service that updates its database and publishes an event to a message broker crosses two independent commit boundaries. If the database commit succeeds and the broker publish fails, durable state exists without its corresponding message. Reversing the order only reverses the failure: a consumer can observe a message for a state change that never commits. A transactional outbox narrows this gap by placing the application write and a durable message record in the same local database transaction. Publication moves to a separate relay. The pattern does not make the database and broker one atomic system; it changes the boundary so message intent becomes part of the database commit.

Software Engineering Distributed Systems

Cybersecurity / 19 Sep 2026 / 5 min read

TLS 1.3 Early Data Trades One Round Trip for Replay Exposure

A resumed TLS 1.3 connection can carry application bytes before the server finishes the new handshake. That latency reduction changes a security boundary: early data is protected in transit, yet the protocol does not give it the same replay property as ordinary post-handshake application data. The distinction matters when an endpoint maps one request to a state-changing operation. A captured early-data flight can be presented again under conditions in which a server accepts it, so confidentiality and integrity on the wire do not imply single execution.

TLS 1.3 0-RTT

Tech / 19 Sep 2026 / 6 min read

TLB Shootdowns Extend Page-Table Changes Across CPUs

TLB Shootdowns Extend Page-Table Changes Across CPUs Changing a page-table entry in memory does not by itself retire every translation derived from that entry. A CPU that previously used the mapping can retain it in a translation lookaside buffer, or TLB. On a multiprocessor system, other CPUs may hold their own cached copies, so a mapping change can require coordination beyond the CPU that modified the page table. Linux exposes this distinction through its TLB-flush interfaces. After page-table state changes, architecture code must make the affected translations unusable on every relevant CPU before software relies on the new mapping or releases memory that the old mapping could reach.

CPU TLB

Tech / 19 Sep 2026 / 7 min read

TLB Shootdowns Coordinate Page-Table Changes Across CPUs

A page-table entry can change in memory while another CPU still holds the old address translation in its translation lookaside buffer (TLB). Updating the page table alone therefore does not necessarily make the new mapping effective on every processor that has executed the affected address space. Operating systems close that gap with TLB invalidation. When a mapping change can make a cached translation unsafe, processors that may retain the translation must invalidate it before the kernel treats the change as globally complete. On a multiprocessor system, coordinating those remote invalidations is commonly called a TLB shootdown.

CPU Memory Management

Linux / 19 Sep 2026 / 5 min read

timerfd Reads Count Periodic Expirations

A periodic timer can expire several times before a busy event loop gets CPU time again. Linux timerfd does not compress that delay into a bare “timer fired” notification. A successful read() returns an unsigned 64-bit count of expirations accumulated since the timer was armed or since the preceding successful read. That counter changes the semantics of delayed timer handling. Readiness says at least one expiration is pending; the value read from the descriptor says how many periods elapsed.

Linux Timers

Tech / 19 Sep 2026 / 5 min read

The Same 100 Ohm Resistor Behaves Differently at 3 V and 5 V

A 100 Ω resistor is still a 100 Ω resistor whether it is connected to 3 V or 5 V, provided it remains within its specified operating conditions. What changes is not the nominal resistance but the electrical state around it: current, voltage drop, and power dissipation. That distinction matters because a resistor does not generate an output voltage on its own. Its voltage and current are determined by the surrounding circuit.

Electronics Resistor

Linux / 19 Sep 2026 / 5 min read

systemd Unit File Search Paths and Override Precedence

A systemd service file does not have to live in /etc/systemd/system. The system manager searches several directories for unit files, and the directory matters because the search order defines which definition wins when the same unit name exists in more than one place. For an administrator-managed service, /etc/systemd/system is usually the appropriate location. Distribution packages normally install units under /usr/lib/systemd/system, while /run/systemd/system is used for runtime configuration that disappears after reboot. This separation lets local configuration override vendor defaults without editing files owned by the package manager.

Linux systemd

Rust / 19 Sep 2026 / 8 min read

Streaming Sensor Graphs to ILI9341 Without a Framebuffer on ESP32-C3

An ILI9341 panel is large enough for a useful live sensor graph, but a 240 × 320 RGB565 framebuffer costs 153,600 bytes: 240 * 320 * 2 bytes = 153,600 bytes That is a poor default allocation on a small microcontroller when the graph itself may need only a few hundred samples. The display controller already contains its own graphics RAM. An ESP32-C3 can therefore treat the panel as the destination, keep only the application state it needs, and send changed pixels over SPI.

Rust ESP32-C3

Tech / 19 Sep 2026 / 5 min read

Streaming DMA Mappings Transfer Buffer Ownership Between CPU and Device

Streaming DMA Mappings Transfer Buffer Ownership Between CPU and Device A DMA buffer can be valid memory for both a CPU and a device while still requiring a strict handoff between them. Linux streaming DMA mappings express that handoff. The mapping API supplies a device-visible DMA address and gives the DMA layer a point at which architecture-specific cache maintenance, address translation, or bounce buffering can occur. This matters most on systems where device DMA is not automatically coherent with CPU caches, but the ownership rules are part of the portable DMA API even on machines where cache maintenance becomes a no-op.

DMA Linux