Deep dives into tools,
techniques & the web.
Practical guides covering developer tools, health metrics, SEO, converters and more — written to be actually useful.
✦ AI-powered — understands natural language
Why Reverse DNS Alone Never Confirms or Denies a Threat — Residential Proxies, Reliability Decay, and SOC Triage
Robots.txt Can Only Ask — It Can't Enforce, Hide, or Remove From Google's Index
Robots.txt can only ask crawlers to stay away — it can't enforce it, it can't hide content, and it cannot remove an already-indexed URL from Google's results. Here's why Disallow prevents crawling but not indexing (and why disallowing a page you want noindexed is self-defeating), why robots.txt paths are public information that scrapers deliberately read, and the correct tool for each goal: Disallow for crawl budget, noindex for search results, authentication for actual privacy.
Why UTM Data Lies: Naming Fragmentation, GCLID Conflicts, and Dark Traffic
UTM parameters tell you what you labeled — not what actually happened. A UTM campaign showing zero conversions might be a marketing failure, a tracking failure, or a naming failure. Here's how inconsistent naming (utm_source=Twitter vs twitter) fragments data, why GCLID and manual UTM parameters conflict in Google Ads, how UTMs get stripped by mobile apps and HTTPS-to-HTTP redirects, and what high "direct" traffic actually signals about UTM data quality.
How BMI Went From Population Statistics to Clinical Screening — And Why That History Matters
BMI was invented by statistician Adolphe Quetelet to study population distributions — and he explicitly said it was unsuitable for judging individuals. It took 150 years of insurance industry adoption, Ancel Keys' 1972 renaming, and a 1998 threshold change that reclassified 29 million Americans as "overweight" overnight for it to become a clinical screening tool. Here's the history of how a population statistic became a medical measure, and what that origin story explains about its limitations.
Beyond ROT13: ROT47, ROT18, Atbash, and the Complete Family of Caesar-Style Rotation Ciphers
ROT47 extends ROT13 to all 94 printable ASCII characters — rotating digits and punctuation in addition to letters — but remains identically trivial to decode. Here's the full Caesar cipher family (ROT5 for digits, ROT13 for letters, ROT18 for both, ROT47 for all printable ASCII), Atbash's Hebrew origins (it appears in the Bible as the first known cipher in a religious text), and the modern use cases where ROT13 is deliberately not meant to be secure.
The Algorithm Behind "Remove Duplicates": Sort-Then-Scan vs Hash-Set, and When Each Is Right
"Remove duplicates" in a sorted list is a different operation than in an unsorted list — and which you need determines whether you must sort first, and whether you can process in a single pass. Here's the sort-then-scan vs hash-set trade-off (O(n log n) memory-efficient vs O(n) order-preserving), the "which occurrence to keep" question, and two edge cases most people don't think about until they hit them: blank lines and case sensitivity.
SHA-3 Exists Alongside SHA-2, Not Instead of It — The Architecture, Length Extension Vulnerability, and 2024 Usage Guide
SHA-3 was developed alongside SHA-2 — not because SHA-2 was broken, but as a precautionary hedge using a completely different design. SHA-2 uses Merkle-Damgård construction; SHA-3 uses a sponge construction. Here's the architectural difference, why Merkle-Damgård is vulnerable to length extension attacks (and how HMAC fixes it), why SHA-3 is immune to this by design, and a 2024 guide to which hash function to use for what purpose.
What WHOIS Still Tells You When Everything Is "REDACTED FOR PRIVACY"
WHOIS privacy protection hides contact details — but creation date, expiry date, registrar, nameservers, and status codes remain visible and tell a detailed story. Here's how to read mass-registration signals from creation date patterns, trace common ownership through shared nameservers, interpret domain status codes (serverHold, redemptionPeriod, pendingDelete), and what RDAP changes about how this data is accessed.
301 Redirects Don't Work Instantly: How Search Engines Actually Process Them and How Long It Takes
A 301 redirect tells search engines a page has permanently moved — but they don't immediately forget the old URL or instantly transfer its signals to the new one. Here's the actual multi-phase timeline (recrawl, re-index, signal transfer), why temporary ranking drops post-migration are normal, what signals do and don't transfer through 301s, and why redirect chains reduce signal transfer even when they technically work.
Reverse DNS Is an Assertion, Not a Proof — Here's What FCrDNS Actually Verifies
A PTR record saying "mail.example.com" for an IP doesn't prove that IP is operated by example.com — it proves whoever controls the reverse DNS zone for that IP chose to set that name. Here's the fundamental asymmetry between forward and reverse DNS, why "forward-confirmed reverse DNS" (FCrDNS) provides substantially more confidence than PTR alone, how Google uses FCrDNS to verify Googlebot traffic, and when PTR records are legitimately useful for logging even without cryptographic verification.
Why a UK Pint Is 20% Bigger Than a US Pint — and Other Volume Unit Confusions That Have Caused Real Disasters
A litre is exactly 1 cubic decimetre — a deliberate coherence design making metric volume directly compatible with metric length. Imperial and US customary volumes lack this coherence, and the US and UK versions of "fluid ounce," "pint," and "gallon" are all different sizes (UK pint is 20% larger than US pint). Here's why cups are almost exclusively a US convention, the NASA Mars Climate Orbiter's $327M unit-confusion lesson, and when "volume" and "capacity" mean different things.
Random Strings for Test Data vs Security Tokens: The Difference That's Invisible in the Output
Generating a random string and generating a *secure* random string can look identical — but only one is safe as a session token or API key. Here's how CSPRNGs differ from standard PRNGs (Mersenne Twister can be fully reconstructed from 624 outputs), how alphabet choice affects entropy per character, why test data often needs structured fake data rather than random strings, and why "always use a CSPRNG" is often the simplest safe policy.
Credit Score and Borrowing Capacity: Why the Same Income Gets You Different Loan Amounts at Different Lenders
Two people with identical incomes can qualify for dramatically different loan amounts — because lenders weigh income alongside credit score, debt-to-income ratio, and credit utilisation differently. Here's how borrowing capacity is actually calculated, why the same applicant gets different offers from different lenders, and what a loan planner reveals before you apply.
