Auto-aggregated global tech articles · 1,186 posts
Open Source
We shipped a filter that threw away bad GPS readings. Months later somebody asked whether it was working, and I could not answer. The evidence was gone. That question changed how I build anything that rejects data. The obvious version, and why it rots Mileage tracking depends on tru
DevOps
If you use Windows or Linux, you may have created a bootable USB at some point. For example, if you want to install Windows 11 or Linux Mint, you can download the ISO file and use a tool like Rufus to create a bootable USB. Rufus works very well. But recently, while using Linux Mint, I discovered
Frontend
Social-content integrations often begin with a deceptively small requirement: fetch a transcript, inspect a creator profile, or put engagement figures on a dashboard. The first HTTP request may be easy. The engineering burden arrives later, when an application needs timeouts, cancellation, paginatio
AI & ML
Demo day is where most student projects go to die. The demo works, the applause happens, and the deploy quietly expires three weeks later when the free tier does. Of everything I have built, the projects that mattered — Annapurna after BYTEBATTLE, SCULT Studio, the AI apps — were the ones that survi
DevOps
Stop Hand-Partitioning Disks: Practical systemd-repart on Linux You ship a minimal OS image. The target disk is 64 GB, 256 GB, or 2 TB. Root is still 8 GB. Swap does not exist. /home is not a partition yet. The usual fix is a one-off parted / gdisk script, a fragile installer hook, or “remember t
Backend
Two CVEs against the same identity provider, filed six months apart. CVE-2023-48228 and CVE-2024-23647, both against authentik, describe the same failure: the server accepted PKCE in one request and its absence in the next. RFC 7636 had been published nine years before the first advisory. PKCE bind
Security
HMAC Proves Origin, Not Freshness: Replay Attacks Against Signed APIs The signature verified. The secret was correct. The payment processed for the fourth time, from a request captured three hours earlier. HMAC proves that a request came from someone who knows the secret. It does not prove when.
Backend
The OAuth flow has four participants: client, authorization server, resource server, and, when state is absent, the attacker. RFC 6749 made the only CSRF control in the authorization code flow optional. This is not theoretical. It is CVE-2019-10315, CVE-2023-31999, and most OAuth clients running in
DevOps
The developer adds ?api_key= to the URL because it is the simplest way to test an endpoint. The credential works. The endpoint returns data. What the developer does not see: that token was written into six distinct stores. It was also queued for transmission to a third-party monitoring service. The
Frontend
AI can hand you a working prototype in a weekend. Screens render, buttons respond, data appears. It feels like the app is ninety percent done and the last step is pressing an eject button that drops you into clean, owned production code. That button does not exist. There is no single export that co
Security
Every JWT carries a header parameter whose only job is to tell the server which key to use. The RFC does not define the format of that parameter. Most libraries do not validate what arrives in it. The kid parameter is processed before signature verification. When a server passes that value directly
Security
A logged-in user visits a page you do not control. Your WebSocket server opens a new authenticated connection to that page's JavaScript. The attacker reads every message your server sends and can write any message your server accepts. No XSS. No phishing. Just a missing header check. Cross-Site Web