Blog

A list CRDT has one job — converge — so you can brute-force it: 400 operation logs, every one of the 720 delivery orders each, diff the results. Three orderings broke the naive implementation in three different ways, and one of them left every replica in perfect agreement about a scrambled document.

A Bloom filter's error rate is one of the few things we teach that you can actually check, so I built one, inserted 500,000 keys, queried it with ten million keys that were not in it, and compared the result against the textbook formula at seven different sizings.

LeetCode 56 merges [1,4] and [4,5]; LeetCode 435 says they do not overlap at all. Closed versus half-open ends is the one real decision in interval problems, and most interval bugs come from never making it.

The British Airways skimmer sat in a first-party file, so no host allowlist, no 'self' and no nonce would have stopped it — here is one CSP header tightened four times, broken after each round against the CSP Level 3 matching algorithms, until only the directive nobody writes first is left holding.

Eight concurrent workers sharing one idempotency key turned a $49 order into $392 of real charges on PostgreSQL 17.6, and adding a FOR UPDATE row lock changed nothing at all. This walks through what actually prevents the double charge, measured at every step, and what Stripe's and Shopify's own documentation says rather than what gets repeated about them.

Five runs of the same one-million-allocation loop on Node 22, changing only how many objects stay reachable, move total GC time from 13 ms to 334 ms — and that single fact explains most of what people get wrong about V8's heap, Go's missing generations, and why Twitch's 10 GiB of useless memory made their API faster.

Dijkstra's algorithm is four lines of greedy logic wrapped in machinery that fails quietly, so this post builds a binary-heap implementation in TypeScript, differential-tests it against Floyd-Warshall on 4,000 random graphs, and measures what the heap, the Array.shift() queue and the stale-entry check actually cost.

A WebSocket message is eleven bytes on the wire, and almost everything written about those bytes is checkable against a real socket in about a second.

A measured tour of B-tree indexes on PostgreSQL 17, with real query plans for index-only scans, the visibility map, HOT updates, and the selectivity point where the planner abandons your index.