Blog
RSSFull-stack development and DevOps notes, written up from what I build and ship.
Series
Topics
Episode five: my expense tracker FinScan AI, Binance's $6.3 billion security incident, Google's cybersecurity-focused Gemini 4 Carbon, and a tampered Claude Code extension on Cursor's marketplace.
Episode four: the PHP2Shell vulnerabilities, Google's infrastructure for AI agents, how the LiteLLM supply-chain attack worked, and Anthropic donating the Agent Skills standard.
PHP2Shell (CVE-2026-109618, CVE-2026-109619) explained: how two critical PHP bugs lead to remote code execution, which versions are fixed, and how to patch.
Partitions, segments, offsets, indexes and the page cache: what a Kafka topic looks like as files, and why that design is fast.
Both are 128-bit UUIDs, but one scatters inserts across your B-tree and the other keeps them on the right edge. What that changes, what it doesn't, and how to measure it.
When PostgreSQL says COMMIT succeeded, your table pages may not be on disk yet. Here is how the write-ahead log, row versions and checkpoints make that safe.
Episode two: ChatGPT's Intelligent UI with GPT-6, Google's Gemini Agent for work, Microsoft's Execution Containers for sandboxing agents, and Anthropic's free vulnerability scanner for open-source projects.
Follow one query from your keyboard to the disk and back, with an animation you can click through, and the one command that shows you every stage.
The first episode of a new weekly series: persistent AI agents, AI in cybersecurity, why CUDA may matter more than NVIDIA's chips, and AI helping design the chips that power AI.
Why an index lookup touches only a handful of pages, what every extra index quietly costs on writes, and how to think about composite indexes as one sorted list instead of a bag of columns.
A closer look at the part I glossed over last time: what a B-tree index actually looks like on disk, when Postgres reaches for a bitmap scan instead, and how an index-only scan skips the table entirely.
What happens between hitting enter on a SELECT and the rows coming back: parser, planner, executor, the buffer manager, and when it finally touches disk.
The reward signal behind a model has quietly moved from what humans prefer, to what can be verified, to whether the model's own confidence can be trusted. Here's the progression.
TypeSafe AI's new 'System 1' model skips text generation entirely and returns bounded, typed decisions instead: what that actually buys you, and what it doesn't fix.
What a load balancer actually does, how Layer 4 and Layer 7 differ, how to pick a balancing algorithm, and the health-check, session, and timeout traps that cause most production 502s.
A form builder for React and Next.js apps: drag fields into sections, publish a shareable link, or export a clean component. No backend, no boilerplate.
Why I built a Chrome extension that scans your prompts for API keys, credentials, and personal data before they ever leave your browser, and how the detection actually works.
Why I'm starting a blog, and what to expect here.
· 1 min read
meta
Get new posts by email
Full-stack and DevOps notes, straight to your inbox when I publish. No spam, and you can unsubscribe any time.