Deep dives into tools,
techniques & the web.
Practical guides covering developer tools, health metrics, SEO, converters and more — written to be actually useful.
✦ AI-powered — understands natural language
Word Boundaries and Lookarounds: Precise Find & Replace
The 300-Year Unbreakable Cipher That Got Broken — Vigenère, Enigma, and What Every "Unbreakable" Cipher Has in Common
The Vigenère cipher was unbreakable for 300 years — until the Kasiski test revealed that repeated keywords create periodic patterns detectable by measuring distances between repeated ciphertext sequences. Enigma failed not through mathematical weakness but through operator protocol flaws (predictable message formats, the reflector's no-self-encryption constraint). The one-time pad is provably unbreakable but impractical. Here's what each historical failure teaches about what "secure" actually means.
GraphQL's Introspection Query Is an Attacker's Best Friend — Batching, Nested Query DoS, and Persisted Queries
GraphQL's introspection query exposes your complete schema — every type, field, and relationship — to anyone who can reach the endpoint, making it the most powerful reconnaissance tool an attacker can use against a GraphQL API. Here's batching attacks that bypass rate limiting, deeply nested queries causing 100^5 database lookups, persisted queries as a security pattern, and how to test GraphQL endpoints with a REST API checker.
Open Graph Isn't the Same on Every Platform — LinkedIn, WhatsApp, Slack, and Discord Each Have Their Own Rules
LinkedIn's Post Inspector forces cache refresh like Facebook's Sharing Debugger — but they're separate tools, LinkedIn caches even more aggressively, and LinkedIn prefers og:image:secure_url over og:image. Here's platform-specific Open Graph differences: WhatsApp's small preview size and no force-refresh tool, Slack's unfurl API for custom app previews, Discord's og:video for inline playback, and Teams Adaptive Cards for rich integrations.
Why Your RTC Chip Returns 89 When the Time Is 59 — BCD, Gray Code, and Other Number Encodings in Modern Hardware
Binary-Coded Decimal (BCD) encodes each decimal digit as a 4-bit group — which is why real-time clock chips return 0x59 to mean 59 seconds (not 89), and why hardware with BCD limits constrains values to 0-99 rather than 0-255. Here's BCD in RTC hardware and financial calculations, Gray code's one-bit-change property that prevents rotary encoder errors, and why TCP checksums use one's complement arithmetic.
Why 1.1.1.1 Reaches Different Servers Worldwide — Anycast, DNS Propagation, and the 13 Root Nameservers That Are Really 1,500
Anycast routing means Cloudflare's 1.1.1.1 reaches different physical servers in different locations — which is why DNS changes propagate to some locations before others, and why checking propagation from multiple places gives different results. Here's how anycast works, why the "13 root nameservers" are actually 1,500+ nodes, the TTL change timing strategy for planned migrations, and why single-provider DNS isn't genuine redundancy.
Why a Single Timing Error Can Corrupt an Entire Morse Message — and How Operators and Algorithms Recover
Morse code encodes information entirely in time ratios — and a single timing error can corrupt every character from that point forward because there are no explicit character boundaries, only inferred ones from timing. Here's how experienced operators resynchronise using context, prosign patterns, and message structure; how automated decoders use Hidden Markov Models and Viterbi algorithms; and why CW Morse can communicate at -10 dB SNR where voice needs +10 dB.
The Viewport Meta Tag Is a Rendering Instruction, Not an SEO Tag — And Why That Distinction Matters
The viewport meta tag is a rendering instruction, not an SEO tag — but its absence causes mobile browsers to render pages in 980px desktop mode, directly affecting Google's mobile-first indexing quality assessment. Here's what width=device-width and initial-scale=1 actually do (and why user-scalable=no is an accessibility violation), how preconnect hints reduce Google Font load times by 100-300ms, and why HTTP header versions of CSP are more secure than meta http-equiv versions.
Fibre Is a Carbohydrate That Doesn't Behave Like One — Gut Bacteria, Short-Chain Fatty Acids, and the Net Carbs Calculation
Dietary fibre is technically a carbohydrate but produces only 0-2 kcal/g instead of the 4 kcal/g that macro calculators assume — because human enzymes can't digest it. Here's how gut bacteria ferment soluble fibre into butyrate, propionate, and acetate (the SCFAs that maintain colon health and signal appetite to the brain), why Western adults eat only 15-19g daily against a 25-38g recommendation, and the net carbs calculation for keto tracking.
What Your MX Records Reveal About Your Email Architecture — Provider Patterns, Redundancy Reality, and SMTP Queuing
MX records reveal your email provider, but also your security gateway architecture, redundancy approach, and subdomain email routing — more information than most administrators intend to expose. Here's how to identify Google Workspace vs Microsoft 365 vs security gateway patterns from MX hostnames, why five MX records at one provider don't protect against a provider outage, and how SMTP queuing means short MX outages don't cause lost email.
Why Lorem Ipsum Leaks Into Production — Placeholder Text in Design Systems, Empty States, and API Docs
Lorem Ipsum serves different functions in design mockups vs component library documentation — and confusing them produces staging environments and production pages with Latin placeholder text that leaks through QA. Here's why CSS placeholder (form input hint text) and design placeholder text are completely different things, why empty states designed with Lorem Ipsum data are never properly designed for the zero-data case, and why API documentation should use example.com email addresses not Lorem Ipsum values.
Why a Footer Link and a First-Paragraph Link Are Not the Same — PageRank, Reasonable Surfer, and How to Distribute Link Equity
Google's Reasonable Surfer Model weights link equity by click probability — a first-paragraph in-content link passes far more equity than the same link in a footer, because users are more likely to click it. Here's the PageRank formula and damping factor, how position, anchor text relevance, and visual prominence determine link click probability, why exact-match anchor text is safer for internal than external links, and what an internal link audit should look for in orphaned pages and link depth.
Why a Unit Conversion Error Destroyed a $327 Million Mars Mission — And Why the US Still Uses Imperial
The US still uses imperial because a voluntary metric conversion law in 1975 lacked enforcement and the Metric Board was abolished in 1982. Here's how the Mars Climate Orbiter was destroyed by a metric-imperial unit confusion costing $327 million, why nautical miles are defined by Earth's geometry (1 arcminute of latitude), and why the modern definition of the metre via the speed of light is reproducible anywhere in the universe without a physical artefact.
