Deep dives into tools,
techniques & the web.
Practical guides covering developer tools, health metrics, SEO, converters and more — written to be actually useful.
✦ AI-powered — understands natural language
Why API Key Rotation Is Harder Than It Should Be — Zero-Downtime Rotation, Secure Distribution, and the Permanent Git History Problem
Why Leap Seconds Crash Websites — The Engineering Disaster That Happens Every Few Years (and Won't After 2035)
A leap second adds 23:59:60 to the clock — a second most software assumes can't exist. Here's how the 2012 Linux kernel leap second bug took down Reddit, Yelp, and LinkedIn by sending CPU usage to 100%, how Google and AWS "smear" the leap second across hours to make it disappear gracefully, and why the ITU voted in 2022 to abolish leap seconds entirely before 2035 — ending a recurring distributed systems disaster that occurs every few years.
Missing a Regex Anchor Is a Bug — Why ^, $, and \b Work Differently Than You Think in Multiline Mode
The difference between a regex that matches "digits" and one that matches "only digits" is anchor characters — and missing anchors are why input validators accept strings they should reject. Here's how ^ and $ change behavior in multiline mode (a security-relevant surprise), why \b word boundaries break on Unicode text, the \z vs $ distinction for absolute string-end matching in Python, and why unanchored authorization patterns misclassify URLs.
How to Build a Redirect Map That Won't Create Chains — Inventory, Validation, and Format Selection
A redirect map looks manageable until 40 entries point to destinations that are themselves redirected — creating chains that slow crawlers and bleed equity. Here's the four-source URL inventory methodology (crawl + logs + GSC + sitemap), the three redirect types (one-to-one, pattern-based, 410 Gone), pre-implementation chain and loop detection algorithms, and why a CSV master reference generating server-specific formats is more maintainable than writing .htaccess directly.
Why the Same Random Token Breaks in Some Contexts — Hex vs Base64url vs Standard Base64 Explained
URL-safe Base64, hex, and standard Base64 are different representations of the same randomness — and the wrong choice causes "invalid token" errors when + and / characters in standard Base64 get interpreted as spaces and path separators in URLs. Here's a decision table for token format by context, why prefixed tokens (sk_live_, ghp_) enable security scanner detection of committed secrets, and why you should store only the SHA-256 hash of tokens, never the raw token.
The Most Revealing API Tests Aren't Successful Requests — A Systematic Error-Path Testing Guide
The most revealing API tests aren't successful requests — they're deliberately malformed, missing, or boundary-case inputs that expose implementation quality and security posture. Here's the systematic error-path testing discipline: what good vs weak APIs do with missing fields, why type coercion masks bugs, what oversized inputs reveal about injection surface and length validation, and how the alg:none JWT attack tests a fundamental authentication vulnerability.
Your Savings Goal Is in Today's Prices — Here's Why That Leads to a Shortfall and How to Fix It
Saving ₹5,00,000 for a car in 3 years at 6% inflation means arriving short by about ₹95,000 — because the car will cost ₹5,95,508 when you get there. Here's how to adjust a savings goal for inflation before entering it into the calculator, why the real interest rate (nominal minus inflation) determines whether your RD barely keeps up or meaningfully grows purchasing power, and how education and property inflation running faster than CPI makes long-horizon goals particularly sensitive to this adjustment.
Watts vs Kilowatt-Hours: Why Your Always-On Fridge Can Cost More Than Your Electric Shower
Power (watts) is a rate — how fast energy flows. Energy (watt-hours) is an amount accumulated over time. An 8.5kW electric shower used 8 minutes daily costs about £99/year; a 60W refrigerator running 24/7 costs about £126/year — the lower-power device costs more annually because it runs continuously. Here's the correct appliance running cost formula, why nameplate wattage overstates actual consumption, and the grid-scale context for MW, GW, and TW.
How to Read Hex Like a Debugger — Magic Bytes, Memory Dumps, and Why Byte Order Matters
Hexadecimal is a window into how computers represent data at the byte level — and once you can read it naturally, you start seeing structure in things that previously looked like noise. Here's how magic bytes identify file formats (JPEG starts with FF D8 FF, PDF with %PDF-, ZIP with PK), what hex reveals in network captures and memory dumps, the endianness problem that causes little-endian hex to read backwards, and the famous debug sentinel values like 0xDEADBEEF and 0xCAFEBABE.
The $7.5 Trillion FX Market — How Exchange Rates Are Priced and Why You're Always at the Worst End of It
The FX market trades $7.5 trillion daily but individuals always participate at the least favourable end — paying 3-5% at banks vs 0.3-1% at specialist services, with costs hidden in the spread rather than explicit commissions. Here's how the interbank rate is formed, the three components of exchange cost (spread, commission, transfer fee), how to calculate the true all-in cost percentage against mid-market, and why unusual currency pairs are cheaper to exchange via two USD legs than directly.
Your IP Is on a Blacklist — Here's What the Specific List Tells You About Why and What to Do Next
Spamhaus ZEN checks four separate lists simultaneously — SBL (observed spam operations), XBL (compromised machines), PBL (residential/dynamic IPs that should use relays), and DBL (spam domains) — and being on each requires completely different remediation. Here's the triage guide for each list type, why PBL is the most misunderstood listing (it means "wrong IP type for direct delivery," not "you sent spam"), and reputation repair timelines after delisting.
og:image Shows in the Debugger But Not on the Platform — Every Technical Failure Mode Explained
An og:image that looks correct in Facebook's sharing debugger can still fail to render on other platforms — because relative URLs break crawler fetching, platform dimension requirements differ, WebP may not be supported by some crawlers, and CORS restrictions can block image access. Here's the complete technical checklist: absolute URLs, supplementary og:image:width/height/type tags, the 1200×630 universal dimension, and why SVG og:images fail.
Why a Password Generator Using Math.random() Is Less Secure Than Its Length Suggests — Entropy, CSPRNG, and What to Check
A password generator using Math.random() is not cryptographically secure — a password's effective entropy is limited by the randomness quality of the generator, not just its length and character set. Here's what password entropy actually measures (bits of theoretical guessing difficulty), why crypto.getRandomValues() is categorically different from Math.random(), why length increases entropy faster than adding special characters, and how Diceware achieves verifiable physical randomness.
