Build better.
Debug smarter.
Deep technical articles on APIs, security, debugging, and developer tooling.
✦ AI-powered — understands natural language
UUID v4 Breaks Database Performance at Scale — What UUID v7 Changed and Why It's Still Not the Default
How the Cron Daemon Works: OS Scheduling, Process Priority, and When to Use systemd Timers Instead
Cron wakes up once per minute, runs with a minimal PATH, and executes via /bin/sh — which is why working shell commands often fail in crontabs. Here's how crond works as a daemon, why environment variables must be set explicitly, process priority with nice values, and why systemd timers handle missed jobs better.
Passkeys: How FIDO2/WebAuthn Works and Why It's Replacing Passwords
Passkeys store a private key on your device and register only the public key with the website — there's nothing to phish, breach, or reuse. Here's how FIDO2/WebAuthn registration and authentication work, the difference between platform passkeys (iCloud, Google) and hardware keys, and the current state of passkey adoption.
Color Blindness and Design: Why Redundant Signals Matter More Than "Colorblind-Safe" Palettes Alone
Roughly 1 in 12 men have some form of red-green color vision deficiency — meaning "red means error, green means success" relies on a color distinction that's specifically the hardest for the most common type of color blindness. Here's how different CVD types affect color perception differently, why redundant non-color signals (icons, labels, patterns) are the core fix, and how CVD simulation reveals confusable color pairs during design review.
UUID v4 vs UUID v7 vs ULID vs NanoID: Which Identifier Format Should You Use?
UUID v4's random bits fragment database B-tree indexes, causing write amplification. UUID v7 adds a millisecond timestamp prefix to fix this. ULID is sortable and URL-safe without hyphens. NanoID is compact and customisable. Here's how each works and when to choose each format.
Bcrypt's 72-Byte Limit: Why Two Different Passwords Can Hash to the Same Value
Bcrypt silently truncates input at 72 bytes — meaning two passwords sharing the same first 72 bytes but differing afterward produce the identical hash. Here's why 72 specifically, how multi-byte Unicode characters (emoji especially) reach this limit far sooner than "72 characters" suggests, why pre-hashing with SHA-256 is a common mitigation, and why this isn't actually a meaningful security concern for typical passwords.
Base64 vs Base64url: Why `+`, `/`, and `=` Break URLs, and Why JWTs Use a Different Alphabet
Standard Base64's `+`, `/`, and `=` characters all have special meaning in URLs — which is why a Base64-encoded JWT pasted directly into a URL can silently corrupt, and why Base64url exists as a separate, URL-safe alphabet. Here's exactly which characters differ, why JWTs require Base64url specifically, how padding works and why Base64url commonly omits it, and how to tell the two variants apart.
JSON Patch and JSON Pointer: How "What Changed" Becomes a Standardized, Executable Sequence of Operations
"What's different between these two JSON documents" and "what's the smallest sequence of operations that transforms one into the other" are related but distinct questions — the second is what JSON Patch (RFC 6902) standardizes. Here's the six JSON Patch operations, the JSON Pointer path syntax they rely on, how the test operation enables optimistic concurrency control, and when the simpler JSON Merge Patch is sufficient instead.
JWT Token Refresh Strategies: Access Tokens, Refresh Rotation, and When Sessions Beat JWTs
Short-lived access tokens require a refresh mechanism — and how you implement that mechanism determines your app's security and user experience. Here's refresh token rotation, silent refresh in SPAs, theft detection via refresh token families, and the cases where server-side sessions are simpler and safer.
URL Design as API Design: REST Conventions, Versioning Strategies, and the Long-Term Cost of Changing URLs
REST URL conventions, API versioning strategies (URL path vs header vs date-based like Stripe), trailing slash canonicalization, URL length limits, and the link rot problem — URL design decisions made at launch determine API maintainability for years.
Practical JSON Diff Workflows: Debugging APIs, Finding Config Drift, and Verifying Migrations
The most common reason to reach for a JSON diff tool is "something changed and I need to know exactly what, fast." Here's four practical workflows: diagnosing API response changes, finding configuration drift between environments, verifying data migrations changed only what was intended, and triaging failing test assertions where the actual difference is buried in a large JSON structure.
JSON Diff: Why Structural Comparison Matters and How It Handles Key Order, Formatting, and Arrays
Two JSON documents can be semantically identical while looking completely different to a text diff tool — different key order, formatting, or minification all produce false "differences." Here's how structural JSON diffing actually works, why array comparison is the hardest part, and practical uses for API testing, config comparison, and data migration verification.
Credential Breaches and Stuffing Attacks: What Leaked Password Databases Reveal and How HIBP Works
Have I Been Pwned has indexed 12+ billion breached accounts. Here's what a leaked credential database actually looks like, how attackers use credential stuffing at scale, the k-anonymity trick that lets HIBP check passwords without seeing them, and why bcrypt salting defeats rainbow tables.
