Deep dives into tools,
techniques & the web.
Practical guides covering developer tools, health metrics, SEO, converters and more — written to be actually useful.
✦ AI-powered — understands natural language
Why API Key Rotation Is Harder Than It Should Be — Zero-Downtime Rotation, Secure Distribution, and the Permanent Git History Problem
How Land is Measured Around the World: Acres, Hectares, Mu, Tsubo, and Rai Explained
Acres, hectares, mu, tsubo, and rai all measure land — but each unit reflects different agricultural histories and property cultures. Here's what each unit means in practical context, where they're used globally, and a complete conversion reference for international property and agricultural research.
JSON Schema Validation and API Contracts: OpenAPI, Contract Testing, and Validation Libraries
JSON Schema validates structure and constraints — and OpenAPI uses it as the contract format for API documentation, client SDK generation, and contract testing. Here's how JSON Schema works, key validation keywords, how OpenAPI extends it, and how Pact implements consumer-driven contract testing.
JSON Parsing in Python, JavaScript, Go, and Ruby: Edge Cases That Cause Real Bugs
Python's None vs JSON null, JavaScript's integer precision limit at 2^53, Go's strict struct tags, and Ruby's symbolize_names security concern are real production pitfalls. Here's the JSON parsing edge cases in each major language and how they cause bugs at API boundaries.
IP Geolocation: How It Works, Why City-Level Accuracy Is Unreliable, and the VPN Problem
IP geolocation is 95–99% accurate at country level and 50–80% accurate at city level — and VPN users are always wrong by design. Here's how geolocation databases work, the legitimate business uses, the VPN problem for geo-dependent services, and what an IP lookup actually reveals beyond location.
DNS Providers Compared: Cloudflare vs Route 53 vs Google Cloud DNS — and Why It Matters
Registrar DNS is almost always the weakest option — slow global performance, poor TTL flexibility, and limited routing features. Here's how Cloudflare, Route 53, and Google Cloud DNS compare on performance, pricing, and features, and how to move DNS without moving your domain registration.
DNS as a Security Tool and Target: Cache Poisoning, Hijacking, and DNSSEC
DNS cache poisoning, DNS hijacking, and DNS tunneling are real attack vectors. Here's how each works, what DNSSEC does (and doesn't) protect against, how to monitor your own DNS records for unexpected changes, and what domain shadowing is.
Domain Squatting and Typosquatting: How to Detect and Defend Against Brand Impersonation
Typosquatters register domains like examp1e.com and brand-support.com to phish customers and intercept traffic. Here's the patterns attackers use, how to monitor for lookalike registrations using CT logs and DNSTwist, defensive registration strategy, and UDRP dispute resolution.
Localised Placeholder Text for International Design: When Lorem Ipsum Fails for RTL, CJK, and Other Scripts
Lorem ipsum is Latin-script only — using it for Arabic, Hebrew, or CJK designs produces completely misleading mockups. Here's why RTL text direction, CJK character width, German compound words, and bidirectional text each require different placeholder approaches, plus pseudolocalisation for layout testing.
From Caesar Cipher to AES: The History of Why Substitution Ciphers Fail
ROT13 is a specific case of the Caesar cipher, which was broken by frequency analysis described in 800 AD. Here's the history from Caesar to Vigenère to Enigma to AES — and what each cipher's failure revealed about what real security requires.
What Your Ping Number Actually Means — Latency, Jitter, and Packet Loss Explained
50ms latency is fine for browsing but problematic for gaming and VoIP. Here's what ping RTT actually measures, latency thresholds for different applications, why jitter and packet loss often matter more than average latency, and what bufferbloat is.
Reading DMARC XML Reports: What Every Field Means and How to Spot Problems
DMARC aggregate reports are XML files that arrive by email and most people never open. Here's exactly what each field means, the common patterns and what they signal (SPF fail but DMARC pass, alignment failures, unknown IPs), and the tools that make reports readable.
The Complete Email Authentication Audit: How to Check SPF, DKIM, DMARC, PTR, and BIMI
Most organisations have never systematically audited their full email authentication stack. Here's the complete 8-step process: inventorying all sending services, auditing SPF, DKIM, DMARC, PTR, and BIMI, sending a test to verify all pass, and setting up ongoing monitoring.
