Code Review
Reviewing Shared State by Asking What Happens Under Contention
Locks and shared state look correct in the single threaded reading of a review and fail only under contention, which is exactly the condition review never…
Security
The Rate Limit That Counted IPs and Not Accounts
The login rate limit was working perfectly and the credential stuffing succeeded completely. A per IP limiter is a defence against a single attacker, and a…
Error Autopsy
ETIMEDOUT, ECONNREFUSED, EHOSTUNREACH: Three Diagnoses
Three socket errors that read as 'the network is broken' are in fact three different answers to three different questions.
Security
The Login Redirect Parameter That Sent Users Anywhere
A next parameter that accepts any URL turns your trusted domain into the first hop of a phishing link. The user sees your hostname, trusts it, and lands…
DevOps
Error Acquiring the State Lock, and the Four Things Not to Do
A stuck Terraform lock stops every deploy in the company, and the obvious fix, force unlock, is also the dangerous one.
AI
A Year of Debugging AI Generated Code
Twelve months of daily agent use, reviewed honestly. The failure modes that got better, the ones that did not, and the practices that stuck.
Code Review
The Formatting Only Pull Request That Changed Behaviour
Four thousand changed lines, all whitespace, and one moved operator. The reviewer skimmed it as formatting and approved it.
Opinion
A Test That Restates the Implementation Is Not a Test
Some tests fail every time the code changes shape and pass every time it breaks. They are not guarding behaviour, they are guarding the current arrangement…
Deep Dive
How the Linux OOM Killer Chooses, and Why It Picked Your App
Under memory pressure the kernel kills one process and not another, and it is not random. The oom score is a small arithmetic formula you can read, tune and…
Bug Hunt
The Feature Flag I Flipped Three Hours Before Anyone Noticed
I turned the flag on at 9am. The first request that saw it arrived at noon, after a restart someone did for an unrelated reason.
Security
The JWT Library That Accepted alg none for Four Months
We pinned the signing algorithm on the way out and trusted the library on the way in. Algorithm confusion let a forged token verify successfully, and…
Performance
Your Average Latency Is Fine and Your Users Are Not
Mean latency is a number that describes nobody. Here is why the tail dominates real user experience, how retries multiply it, and which percentiles are…