Articles
In-depth articles on AI, web development, cloud native, and indie hacking.
Registration conversion alone cannot tell whether users get value. This article defines the measurement boundaries for AI products—from start event, activation, first trusted result to repeat value—and builds a replayable baseline with percentiles, completion rate, rework, and cost.
Without the OWASP Top 10, Web applications are easy targets. This article explains XSS, SQL injection, CSRF, SSRF, insecure deserialization, and broken access control, including how they work, how modern frameworks defend against them, and the core habits of distrusting input, escaping output, and using parameterized queries.
A policy engine returning allow doesn't mean downstream executes with the same input and obligations. This article defines a verifiable decision receipt, a one-time acceptance point, and execution confirmation to block stale policy, parameter substitution, and fail-open bypass.
Writing scripts and writing production Python are two different things. This article explains dependency management with uv, poetry, and pip-tools; type annotations and mypy; project structure; pytest; packaging and releases; and the transition from runnable scripts to maintainable engineering projects.
After a contract or billing migration takes effect, execution nodes still need consistent authorization. This article uses monotonic entitlement revisions, request snapshots, and cache invalidation to handle out-of-order Webhooks, long tasks, and real-time revocation.
State management is a perennial React topic, and too many choices can create confusion. Learn the right layer for useState, useReducer, Context, Zustand, and Redux; client vs. server state with React Query/SWR; and when Context or a global store is appropriate.
Swapping a model while reusing old thresholds, or staring only at overall accuracy, silently changes both blocks and false kills. This article freezes the classifier, calibrator, per-category thresholds, and action table as independent artifacts, and gates release on per-slice confidence upper bounds.
Still centering with float and margin? Modern CSS has moved on. This article covers the division of labor between Flexbox (1D) and Grid (2D), modern centering/equal-height/holy-grail patterns, Container Queries (component-level responsiveness), and new CSS capabilities (@layer/:has/logical properties)—so you write stronger layouts with less code.
Permanent allowlists turn temporary business needs into invisible backdoors. This article models policy exceptions as bounded leases, tied to precise scopes, compensating controls, and usage receipts, and makes expiry, revocation, and renewal re-evaluation actually work.
When a server fails and SSH leaves you staring at an unfamiliar terminal, this Linux survival kit gives developers everyday file and text commands, process and resource diagnostics (top/htop/lsof/df), network troubleshooting (curl/ss/netstat), pipes and redirection, and a practical incident workflow: check resources, then processes, then logs.
Calling setState on every token off the network multiplies React commits. This article constrains only the frequency and freshness from event to commit, using per-frame coalescing, Event Timing, and LoAF to build release gates.
Traditional APM falls short for nondeterministic, multi-step, token-hungry LLM apps. This article covers three layers: traces for each LLM/tool call, automated quality evals, and latency, token, and cost metrics and alerts, then shows how to wire them into the development loop and turn post-launch black boxes into debuggable, improvable AI systems.