How big apps really work, explained simply
System design, AI coding tools and secure code. Short reads with clear diagrams, each with a 60-second video.
Latest posts
Claude Code sessions can message each other: how the hand-off works
Claude Code sessions on one Mac can find and message each other over a local socket. What we saw on our machine, how cross-machine replies work, and the limits.
How can an AI answer with no network? On-device AI explained
On-device AI answers with no network because the model is files on your disk and a local runtime does the math. Size, memory and speed, worked out.
Publish/subscribe: why 2 ms jobs waited 31 seconds behind one slow service
Publish/subscribe vs direct calls in our simulation: with one 50 ms service among ten, fast jobs averaged 31,484 ms with direct calls and 1.87 ms with pub/sub.
Service discovery: how 500 services find each other
Service discovery in depth: registries, heartbeats, TTLs and leases, client caching, the stale-window formula, and what a faster TTL costs in heartbeat traffic.
AI citation checks: the link opened, but the quote was missing
AI citation checks need more than working links. Our synthetic lab shows why exact quote matching catches altered numbers that token overlap accepts.
How to create an AI agent skill: one SKILL.md, reused by two agents
An agent skill is a folder with a SKILL.md file: a name, a one-line description that decides when it loads, and the steps. How we run 23 of them with two agents.
Multi-tenancy: pool vs silo, tenant context, and noisy neighbor limits
Multi-tenancy explained: silo vs pool isolation, how a verified tenant ID follows each request, and why shared compute needs per-tenant limits and bounded queues.
Prompt injection: why the AI obeyed a hidden line
Prompt injection turns untrusted page text into instructions. Learn execution allowlists, argument checks and the limits of prompt-only defences.
Is Codex CLI still running after you close it? A 5-minute check
Since Codex CLI 0.157.0 an interactive session can start a background server. How to see it, how big it is on disk, and the one command that turns it off.
How a leaked password check works without sending the full password
How Pwned Passwords checks a SHA-1 prefix, what the lookup reveals, and how to reject breached passwords at sign-up.
Monolith vs microservices: fault isolation and its cost
Monolith vs microservices: worker pools, crash isolation, deployment risks, and the latency and data-consistency costs of splitting services.
AI agent permissions: would an agent delete my files?
AI agent permissions decide what a careless plan can destroy. Full access vs sandbox vs confirm step in one scripted lab: 7 of 10 key files lost, then 0.
Auto mode is now the default in the Claude apps: what it blocks, how to switch back
Claude apps now start in auto mode on Pro, Max and Team. What the automated check blocks, Anthropic's 89% vs 13.6% test, the limits, and how to go back to manual.
How to check your Apache OFBiz runs 24.09.08, the release that fixes two pre-login RCEs
Every OFBiz before 24.09.08 has CVE-2026-83542 (CVSS 9.8) and CVE-2026-68524, two RCEs without login. Find your real release, upgrade, and verify the service.
How apt proves a package is genuine, and how to check and fix CVE-2026-109518
How apt's signed chain from InRelease to .deb works, how CVE-2026-109518 swapped a package after the check, and which apt versions fix it.
Claude Duet: Claude messages you first, and still asks before it acts
Claude Duet is a proactive agent app: it watches your connected apps, works on its own computer, and asks before it sends, pays, signs or deletes.
Claude self-assessment: Claude now reports possible misuse in its own conversations
Claude now writes a hidden safety check after it answers. What self-assessment records, what it does not do to your chat, the 78% and 94% numbers, and the backlash.
Codex CLI agent command center: what 0.167.0 changes when you run several agents
Codex CLI 0.167.0 opens an agent command center with codex agents --no-daemon, marks unread results, keeps drafts across backends and previews images.
Did the AI leak my fake password? Secrets in AI prompts
Secrets in AI prompts reach the recipient even when the reply omits them. Lab: a fake password in 40/40 simulated prompts and body logs, 0/40 after redaction.
Server failover: active-passive vs active-active
Active-passive vs active-active failover, measured: our simulation lost 111 requests waiting for three 1 s probes and 1 when the first error removed the server.
How to check and fix the Node.js Brotli decoder flaw (CVE-2026-111497) in the process that serves traffic
Node.js 22.x below 22.23.4, 24.x below 24.22.1 and 26.x below 26.12.1 carry a Brotli decoder memory bug. Upgrade, restart and verify every serving process.
Alpine and musl sshd without PAM: check for the OpenSSH 10.6p2 password bypass and fix it
OpenSSH below 10.6p2 on musl Linux without PAM can accept any long password for accounts stored as *. Check your sshd, upgrade, restart, verify the running build.
How to check the PHP build your web server runs and fix CVE-2026-109618 and CVE-2026-109619
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two CVSS 9.2 flaws in PHP-FPM, mod_php and php-cgi. Check the build serving traffic, update, restart, verify.
PHP2Shell and Node2Shell: why they were so dangerous, and how to patch your servers
Two remote code execution bugs fixed on the same day, exploited within a week. How the fixes were prepared, why they matter, and how to patch the right process.
How to check Rails image uploads and lock down ImageMagick (GHSA-f3w6-w445-fwh9)
Rails Active Storage with ImageMagick: how uploads reach ImageMagick coders, which versions fix it, and how to lock down policy.xml. Our lab checked 9 files.
How to check WordPress for CVE-2026-119977: the version, the auto-update blockers and the upgrade folder
Check if your WordPress core is below 7.1.4 or its branch fix for CVE-2026-119977, and find the setting, plugin or deploy that stops security releases installing.
1,000 people ask AI at once. Who gets an answer first? KV cache and continuous batching
How one AI server answers 1,000 people at once: the KV cache and continuous batching. Our toy-model lab: 567 ms to 39 ms, median first-token wait 452 s to 14 s.
I interrupted the AI. Why did it keep talking? Voice AI barge-in explained
Voice AI barge-in explained: our simulation cut talk-over from 4,075 ms to 155 ms, but the energy detector also stopped on 19 of 20 synthetic coughs.
Login anomaly detection: why our 3 a.m. alarm was mostly wrong
Login anomaly detection: our synthetic lab compared a fixed night rule with per-user baselines, cutting false alarms from 667 to 32 across 8,457 logins.
Move 1 button: why a computer-use agent checks after every click
How a computer-use agent copes when a button moves: in 50 simulated runs, replay finished 2, looking first 43, and checking after each click 47.
Node.js security: 4 common vulnerabilities we reproduced and fixed
SQL by template string, path.join on user input, a deep merge that walks into __proto__, and exec with a shell string: reproduced in our lab, then fixed.
Python security: 4 common vulnerabilities we reproduced and fixed
SQL in an f-string, pickle.loads on client bytes, subprocess with shell=True and open(base / name): reproduced in our Python 3.14.7 lab, then fixed.
Same question 10 times, different answers. Which one passes? AI evals and guardrails
AI evals and guardrails check replies before delivery. Our seeded simulation shows what format, refund-math and phrase checks catch, and what they miss.
SQL vs NoSQL: choose the data shape first
SQL vs NoSQL is the wrong first question. Our lab: renaming one product rewrote 47,999 embedded documents in 628 ms, while normalized tables changed 1 row.
Semantic cache: can AI safely reuse a similar answer?
A semantic cache reuses a saved AI answer for a similar question. In our lexical 60-pair lab, every cutoff we tested still made wrong reuses.
Vertical vs horizontal scaling: one server or eight?
Vertical vs horizontal scaling in our simulation: one 8-core server vs eight 1-core servers, a near tie when matched, 30.23% vs 0.54% failed after a crash.
What is SQL injection and how to prevent it: bound parameters, tested in a PHP lab
SQL injection happens when input becomes part of the SQL text. Bound parameters fix it. Our PHP lab: 3 rows with string-built SQL, 0 with prepared statements.
Why does AI say "too many requests" after one message?
Why AI says too many requests after one message: token budgets, shared limits, and a reproducible lab showing rejection with request credits remaining.
"Hello" went to a small AI, maths went to a big one. Who decided? Model routing in an LLM gateway
Model routing lets an LLM gateway choose which model answers. Our 60-prompt lab shows how keyword rules affect routing and illustrative costs.
The cable to Asia breaks. Your bank must choose: correct balance or an answer
CAP theorem with real lab numbers: in our simulated 20 s cable cut, CP refused 50.7% of requests with 0 mismatched reads. AP answered 100%, but 241 reads mismatched.
RAG retrieval: how AI finds one line in 100 pages
RAG retrieval ranks document chunks before generation. Explore BM25 internals, hybrid search, token budgets and a reproducible 100-page lab.
MCP tool discovery: 3 new apps, 0 changes to the client code
How tool discovery lets one AI client use new apps unchanged: the tools/list handshake, a lab with 3 apps, 55 of 60 right picks, and the vague-description drop.
HNSW vector search: how a photo search skipped 96% of 20,000 vectors
HNSW vector search with a lab: 20,000 vectors, 776 touched per query, recall 0.944, the efSearch dial, the run-to-run speed spread, and the B-tree contrast.
Layer 4 vs Layer 7 Load Balancer: Internals and Trade-offs
Layer 4 vs layer 7 load balancer internals: connection tracking, HTTP routing, keep-alive imbalance, draining, and measured lab costs.
Eventual consistency: stale likes and safe withdrawals
Eventual consistency left 59.2% of lab reads stale. Learn why quorum reads can go backwards and atomic conditional debits prevent overdrafts.
Load balancer vs reverse proxy: one door, two jobs
Load balancer vs reverse proxy: connection handling, Nginx algorithms, caching, failure modes, and verified simulation results.
One database writes, ten read: primary and read replicas
One primary writes, read replicas serve reads. In our simulation 10 replicas gave 10.3x the reads, but at 500 ms lag your own post was missing 51.8% of the time.
Context window: why a long AI chat forgets your name
How a context window limits chat history: a reproducible simulation of truncation, pinned memory, rolling summaries, and their engineering trade-offs.
Series vs parallel availability: two servers in a row
Series vs parallel availability: two independent 99% servers give 98.01% when both are required, or 99.99% when either copy can serve the request.
Load balancing algorithms: which server gets your request?
Load balancing algorithms: round robin, least connections, user-ID hash. In our 4-server simulation, quick-request p99 was 150.3 ms, 22 ms and 468.9 ms.
When will AGI happen? Why every forecast names a different finish line
When will AGI happen? What lab leaders, forecasters and a researcher survey said from 2023 to 2026, each date with its definition, and what METR measures.
AI agent tokens: why history makes total input grow
AI agent tokens add up: each call carries the retained history as input, so an append-only task grows close to N squared. The math, KV caching and trimming.
Embeddings explained: why a search for car finds vehicle
Embeddings explained with BM25, PPMI and cosine arithmetic: why car finds vehicle, where retrieval fails, and how hybrid vector search scales.
What happens when you type google.com? DNS in depth
What happens when you type google.com? DNS walks root, .com and name server, then caches. Our model: 37 ms cold, 7.1 ms resolver hit, 0.05 ms OS cache.
One AI writes, another reviews: designing a multi-agent coding pipeline
How to split AI coding work across agents: routing, a second model as reviewer, a gate with a round cap, and a sandbox. With our own review data.
How to use Claude like a professional, not like a casual user
Use Claude like a pro: Projects, Skills, memory and connectors in the apps; CLAUDE.md, hooks, permissions and headless runs in Claude Code; habits that catch errors.
Claude Ultra: the 5-hour limit is gone, the weekly cap stays
Claude Ultra plan limits explained: no 5-hour limit for verified accounts, a weekly cap of 10x Pro, why Max 20x was renamed, and what users think of it.
Fast for you, slow for a million. Why?
A 5 ms server against a 15 ms server: why the faster one has a 498 ms median at 100 users, explained with queueing laws, pools and a simulation.
A highway with 10 lanes can still be slow
More workers raise throughput, not speed: 1 to 10 lanes took a simulation from 5 to 49.8 req/s at 200 ms, until one 50 ms lock capped it at 19.9 req/s.
50K fans, 5K seats. Design it.
Performance vs scalability for engineers: Little's law, utilisation vs queueing delay, Amdahl and the USL, load balancing, retry storms and admission control.
Design Instagram's feed: system design in five steps
System design as engineering, on a news feed: API, data model, fan-out on read vs write with cost formulas, Redis timelines, cursors, hot keys and a benchmark.
1M rides a day. What do you do in the first 5 minutes?
Requirements in depth: functional vs non-functional, SLIs, SLOs and error budgets, nines arithmetic, capacity estimation and how the numbers pick the design.
Two fans click the same seat at the same moment. Who wins?
Race conditions, lost updates and write skew, how PostgreSQL isolation levels, row locks and conditional updates prevent them, and when strong consistency matters.
Claude Code vs Codex CLI: how we use both AI coding agents together
Hands-on comparison of Claude Code and Codex CLI from daily work, and why letting one review the other catches more mistakes.
You tap like. How does your friend's phone know a second later?
From your tap to your friend's buzz: events, a queue, a worker, live connections, Apple and Google push, and grouping 1,000 likes into one alert.
How do apps handle a million likes at once without crashing?
When millions tap like at once, one database row becomes a traffic jam. How big apps survive: a queue, split counters and a cache.
PHP security: 7 common vulnerabilities and how to fix them
Defensive PHP checklist: SQL injection, XSS, CSRF, password storage, uploads, sessions and unserialize, with the exact fix for each.
