Build better.
Debug smarter.
Deep technical articles on APIs, security, debugging, and developer tooling.
✦ AI-powered — understands natural language
Why 0 0 1 * 1 Runs 63 Times a Year: The Cron OR Trap
Why JSON Parses Differently in JavaScript, Python, and Go — Precision, Duplicates, and Parser Security
JSON's specification deliberately leaves number precision, duplicate key handling, and Unicode surrogate pairs as implementation-defined — which is why identical JSON produces different results in JavaScript (integers lose precision above 2^53), Python (arbitrary precision integers), and Go (float64 by default). Here's the parser differential security attack from duplicate keys, prototype pollution via JSON merge, and why NDJSON enables streaming gigabyte datasets with constant memory.
Using JSON Diff to Detect API Breaking Changes — Schema Diff, Merge Patch, and Contract Testing
API breaking changes — removing fields, changing types, renaming keys — are detectable by diffing JSON Schema between API versions. Here's schema-level vs instance-level JSON diff, JSON Merge Patch (RFC 7396) as a simpler alternative to JSON Patch for PATCH endpoints, why array diffing requires different algorithms than object diffing, and how contract testing uses JSON diff principles to prevent breaking API deployments in CI/CD.
SMS and TOTP Can Both Be Phished in Real Time — Here's Which MFA Methods Are Actually Phishing-Resistant
SMS OTP and TOTP are both vulnerable to real-time phishing (AiTM attacks relay codes before they expire) — hardware keys and passkeys are phishing-resistant because their response is cryptographically bound to the exact URL. Here's the MFA security spectrum from SMS to passkeys, the MFA fatigue (push bombing) attack that compromised Uber in 2022, why number matching prevents rubber-stamping push notifications, and why security questions aren't a genuine second factor.
SHA-256 Is Wrong for Passwords and bcrypt Is Wrong for File Integrity — Why Hash Function Choice Depends on Context
Hash functions serve four completely different contexts — data integrity, password storage, digital signatures, and hash tables — and each requires different properties. SHA-256 is ideal for integrity checks but catastrophically wrong for passwords (too fast); bcrypt is ideal for passwords but terrible for integrity checks (too slow). Here's why, plus SHA-2's length-extension vulnerability, BLAKE3's advantages, and the hash table DoS attack that made Python randomise its hash seeds.
HTML Encoding Doesn't Stop XSS in JavaScript Context — Why CSP Nonces Are the Missing Second Layer
HTML encoding converts < to < — but it can't protect against XSS in JavaScript contexts, where the browser parses script blocks before HTML encoding applies. Content Security Policy blocks injected scripts at the browser level, using nonces (random per-request values) or hashes to allow only legitimate inline scripts. Here's why both layers are required, how CSP nonces work, and what violation reports reveal about attacker probing.
Kubernetes CronJob vs Traditional Cron — ConcurrencyPolicy, TimeZone Support, and Why Serverless Changes Everything
Kubernetes CronJob adds concurrencyPolicy (Forbid/Allow/Replace), startingDeadlineSeconds for missed run recovery, and — since Kubernetes 1.25 — a timeZone field that classic crontab never had. Here's how cloud-native scheduling differs from traditional cron, why serverless functions with 15-minute execution limits need Step Functions for long-running jobs, how Airflow's catchup=True causes burst runs after maintenance windows, and why GitHub Actions cron is always UTC.
Why HSL's "50% Lightness" Lies — oklch, Perceptual Color Spaces, and Why They Matter for Design Systems
HSL's "50% lightness" produces visually different brightness across hues — yellow at HSL(60,100%,50%) looks far brighter than blue at HSL(240,100%,50%). oklch solves this with perceptual uniformity: equal L values produce equal apparent lightness regardless of hue. Here's how oklch works in CSS (now supported in all modern browsers), why it's the best tool for dark mode palettes, and how wide-gamut P3 colors fit in.
Argon2id Won the Password Hashing Competition — Here's Why Memory-Hardness Matters and When to Migrate From bcrypt
Argon2id won the Password Hashing Competition and is now OWASP's recommended algorithm — but its three variants (Argon2i, Argon2d, Argon2id) have different security properties, and Argon2d is specifically not suitable for password hashing despite being in the family. Here's memory-hardness and why it defeats GPU parallelism, the correct Argon2id parameters (19 MB memory, 2 iterations), when to migrate from bcrypt, and the pepper pattern for additional server-side secret protection.
JWT Uses Base64url but Basic Auth Uses Standard Base64 — Why the Encoding Choice Matters in Security Contexts
JWTs use Base64url (not standard Base64) because they appear in URLs and HTTP headers where + and / would break things. HTTP Basic Auth uses standard Base64 (not Base64url) because it's an opaque header value. Here's the three security contexts for Base64 encoding (JWT, Basic Auth, CSP nonces/hashes), why JWT payloads are encoded not encrypted (anyone with the token can read the claims), and how to detect standard Base64 vs Base64url from the encoded string.
ISO 8601, Unix Timestamps, and the "Local Time in Database" Bug — A Practical Format Selection Guide
ISO 8601 UTC and Unix timestamps represent the same moments but encode different assumptions — and the most pervasive timestamp bug is storing DATETIME without timezone information, which breaks when servers change timezones, when DST transitions create missing hours, or when users in different timezones submit local timestamps. Here's the practical guide: when to use each format, why ISO 8601 UTC sorts lexicographically, and the date-only vs datetime semantic distinction that causes birthday-display bugs.
Why OAuth redirect_uri Errors Are Almost Always Encoding Problems — and How to Fix Them
OAuth redirect_uri errors are almost always URL encoding mismatches — the encoded URI sent in the authorization request must exactly match the registered URI, character for character. Here's the correct encoding for redirect_uri, why Base64 state parameters break CSRF checks when + decodes as space, the five different array encoding formats that different frameworks use, and the URL parser inconsistencies that enable SSRF attacks.
The Real UUID Collision Risk Isn't Random — It's Container Snapshots and Broken Random Number Generators
UUID v4's random collision probability is negligibly small — the real risk is deterministic duplicates from containers cloned from the same snapshot sharing PRNG state, language-level UUID libraries using Math.random() instead of CSPRNG, or UUID v1's clock sequence exhaustion when clocks go backwards repeatedly. Here's the container snapshot duplicate problem, the seeding vulnerabilities by language runtime, and why a unique constraint on UUID primary keys is essential defensive programming.
