Build better.
Debug smarter.
Deep technical articles on APIs, security, debugging, and developer tooling.
✦ AI-powered — understands natural language
Why 0 0 1 * 1 Runs 63 Times a Year: The Cron OR Trap
Named Capture Groups, Lookahead, and Lookbehind: Modern Regex Features That Make Patterns Readable
Named capture groups turn regex matches from numbered tuples into readable dictionaries. Lookahead and lookbehind assertions match positions without consuming characters. Here's the modern regex feature set — named groups, non-capturing groups, all four assertion types — with practical patterns for log parsing and URL extraction.
Why 9007199254740993 Becomes 9007199254740992: JSON Numbers and JavaScript's Precision Limit
A JSON number like 9007199254740993 can become 9007199254740992 just by being parsed in JavaScript — not a bug in the parser, but a mismatch between JSON's unlimited-precision number specification and JavaScript's double-precision floating point, which can't represent integers above 2^53 exactly. Here's why this specifically affects large database IDs, the common "represent as string" workaround, and why this creates cross-language inconsistencies when backends and JavaScript frontends disagree about what "the same number" means.
Unicode Fundamentals: ASCII History, UTF-8 Encoding, Byte Order Marks, and Why Mojibake Happens
ASCII was designed in 1963 for 7-bit telegraph machines. Every country's attempt to extend it to 8 bits was incompatible, producing mojibake when files crossed systems. Here's how Unicode solved the problem, why UTF-8 became dominant (backward compatibility with ASCII), what byte order marks are, and what character encoding corruption actually looks like.
Cron and Daylight Saving Time: Why Your 2:30 AM Job Didn't Run — or Ran Twice
A cron job scheduled for 2:30 AM doesn't run on "spring forward" night, because 2:30 AM doesn't exist that night — and the same job might run twice on "fall back" night, because 2:30 AM happens twice. Here's why this is exactly the time window many maintenance jobs use, why UTC eliminates the problem entirely for most automated jobs, and why "9 AM local time" scheduling that survives DST requires timezone-aware libraries, not static cron expressions.
How the Cron Daemon Works: OS Scheduling, Process Priority, and When to Use systemd Timers Instead
Cron wakes up once per minute, runs with a minimal PATH, and executes via /bin/sh — which is why working shell commands often fail in crontabs. Here's how crond works as a daemon, why environment variables must be set explicitly, process priority with nice values, and why systemd timers handle missed jobs better.
Passkeys: How FIDO2/WebAuthn Works and Why It's Replacing Passwords
Passkeys store a private key on your device and register only the public key with the website — there's nothing to phish, breach, or reuse. Here's how FIDO2/WebAuthn registration and authentication work, the difference between platform passkeys (iCloud, Google) and hardware keys, and the current state of passkey adoption.
Color Blindness and Design: Why Redundant Signals Matter More Than "Colorblind-Safe" Palettes Alone
Roughly 1 in 12 men have some form of red-green color vision deficiency — meaning "red means error, green means success" relies on a color distinction that's specifically the hardest for the most common type of color blindness. Here's how different CVD types affect color perception differently, why redundant non-color signals (icons, labels, patterns) are the core fix, and how CVD simulation reveals confusable color pairs during design review.
UUID v4 vs UUID v7 vs ULID vs NanoID: Which Identifier Format Should You Use?
UUID v4's random bits fragment database B-tree indexes, causing write amplification. UUID v7 adds a millisecond timestamp prefix to fix this. ULID is sortable and URL-safe without hyphens. NanoID is compact and customisable. Here's how each works and when to choose each format.
Bcrypt's 72-Byte Limit: Why Two Different Passwords Can Hash to the Same Value
Bcrypt silently truncates input at 72 bytes — meaning two passwords sharing the same first 72 bytes but differing afterward produce the identical hash. Here's why 72 specifically, how multi-byte Unicode characters (emoji especially) reach this limit far sooner than "72 characters" suggests, why pre-hashing with SHA-256 is a common mitigation, and why this isn't actually a meaningful security concern for typical passwords.
Base64 vs Base64url: Why `+`, `/`, and `=` Break URLs, and Why JWTs Use a Different Alphabet
Standard Base64's `+`, `/`, and `=` characters all have special meaning in URLs — which is why a Base64-encoded JWT pasted directly into a URL can silently corrupt, and why Base64url exists as a separate, URL-safe alphabet. Here's exactly which characters differ, why JWTs require Base64url specifically, how padding works and why Base64url commonly omits it, and how to tell the two variants apart.
JSON Patch and JSON Pointer: How "What Changed" Becomes a Standardized, Executable Sequence of Operations
"What's different between these two JSON documents" and "what's the smallest sequence of operations that transforms one into the other" are related but distinct questions — the second is what JSON Patch (RFC 6902) standardizes. Here's the six JSON Patch operations, the JSON Pointer path syntax they rely on, how the test operation enables optimistic concurrency control, and when the simpler JSON Merge Patch is sufficient instead.
JWT Token Refresh Strategies: Access Tokens, Refresh Rotation, and When Sessions Beat JWTs
Short-lived access tokens require a refresh mechanism — and how you implement that mechanism determines your app's security and user experience. Here's refresh token rotation, silent refresh in SPAs, theft detection via refresh token families, and the cases where server-side sessions are simpler and safer.
