Technical articles and thoughts on software engineering & AI
Sporadic traffic saves money. Constant traffic costs a fortune. Cold starts and lock-in carry measurable price.
Reviewing shared-staging screenshots does not scale. One environment per PR with synthetic data transforms review quality.
A backup without a tested restore is superstition. Defined RPO/RTO, 3-2-1 strategy, scheduled disaster simulation.
Internal networks earn no default trust. mTLS, service JWTs, and workload identity in real environments.
K8s solves problems five-person teams don't have. Hidden costs, honest alternatives, and where migrating pays.
A 1.2GB image becomes 80MB without touching the app. Removing build tools cuts attack surface along with size.
The committed .env remains software's most common leak. Vaults, rotation, and safe credential injection.
A Lighthouse score of 100 means nothing accessible. Correct ARIA patterns, focus management, and screen reader testing.
Google Docs ruined the baseline: users expect simultaneous conflict-free editing. Collaboration architecture explained.
Three products, three brands, one design system. Tokens separate decisions from values and make theming scale.
Minifying JS yields 3% LCP gains. Serving correct images yields 30%. Optimizations ranked by measured production impact.
Zustand, Jotai, and signals cut re-render costs beyond what the context API reaches. Selection criteria with render benchmarks.
Server Components change caching, state, and rendering rules. The errors below cost days of debugging in real projects.
GraphQL kills over-fetching and adds its own complexity. Where it beats REST today and where it became dead weight.
Logs say what failed. Traces show where and why. Step-by-step OTel instrumentation with context propagation.
Breaking changes without versioning burn trust. URI, header, or parameter? Contracts, deprecations, communication.
ALTER TABLE freezes production. Expand-contract splits schema changes into phases compatible with coexisting versions.
Every job runs twice eventually. Idempotency, visibility timeouts, and retry patterns that save the system.
Deploy and release are separate events. Flags decouple them and turn rollback into a config toggle.
A tenant_id column, schema-per-tenant, or database-per-tenant? Costs, risks, and when to migrate between the three.
Webhooks fail quietly: duplicates, out-of-order events, silent losses. Complete checklist for receiving events without losing any.
Your messaging choice defines cost and operability. Compared by throughput, ordering, and TCO.
Asking for JSON in prompts breaks in production. Constrained decoding, layered validation, and fallback.
Users expect responses in chunks. SSE covers most cases with less complexity than WebSockets.
Agents break in production without guardrails. Tool-use patterns, agent loops, and autonomy limits.
The LLM bill multiplies without governance. Three levers cut 70% without losing quality.
Unit tests miss probabilistic outputs. Golden datasets, automated judges, and regression gates.
Same 1M-document corpus, same queries. Recall, p95 latency, and operational cost side by side.
Start with prompting. RAG fixes knowledge. Fine-tuning fixes behavior. Real costs for each path.
Naive chunking returns garbage. Full pipeline: semantic chunking, embeddings, hybrid search, and reranking.
queryKey defines identity, staleTime defines freshness, mutations define invalidation. TanStack Query takes over the server cache of your React application.
Generics, conditional types, and mapped types solve specific problems of code reuse and type safety.
Cascade layers end the specificity wars; container queries let the card measure its own container. A migration path without rewriting your CSS.
Most APIs handle errors inconsistently. A well-defined pattern reduces integration bugs and makes debugging easier.
Caching takes ten lines of code. Deciding what goes in, when it expires, and who deletes it takes the rest of the project. Strategies with Redis, CDN headers, and cache warming, with code.
A ramp scenario, a p95 threshold that fails the build, and k6 in CI. Load testing turns latency into a number the team defends and investigates with traces.
Unit test coverage does not walk the customer path. Playwright covers login, checkout, and error states with fixtures, Page Objects, and CI. Examples ready to copy.
Remote state with locking, versioned modules, and plan on the PR. A Terraform pipeline that turns console drift into a reviewable diff before every merge.
Five squads in one repository choke merges and builds. Micro-frontends free the team and charge a price in runtime, deploys, and debugging. Adoption criteria and real costs.
Injection and broken access control lead the OWASP Top 10. The two-user test, CSP, Argon2, and the checklist that closes one real risk per CI run.
An external provider goes down and your queue bloats. Circuit breaker, retry with jitter, bulkhead, and timeout: the four patterns that cut a failure cascade.
Token bucket, fixed window, and sliding log solve different problems. Key by IP, user, or API key, headers the client reads, and per-route limits. Code with Redis and express-rate-limit.
Authorization code with PKCE replaced the implicit flow. The full flow, ID token validation, and the BFF pattern for SPAs without tokens in localStorage.
Merge writes a commit with two parents and keeps history as it happened. Rebase replays your commits on top of main and leaves a straight timeline. The rules for each, plus a PR flow that uses both.
An honest EXPLAIN ANALYZE reveals the two-million-row scan. A guide to B-tree, GIN for JSONB, partial and covering indexes in production PostgreSQL.
One JSON line per event, fixed fields across the application, and a request_id propagated to the last service. The log schema, the pino implementation, and where logging stops and metrics begin.
A 15-minute access token, a refresh token in an HttpOnly cookie, a revocation list in Redis, and claim validation on every request. The full Node flow, from login to logout.
The five principles, the code pattern that violates each one, and the version that fixes it. Where SOLID pays off in a project and where it turns into useless layering.
A Staff Engineer review exists to develop the team. Four anti-patterns that weaken it, the comment format that transfers reasoning, and when to leave the keyboard and talk.
Five patterns that show up in production, implemented in TypeScript: Repository, Strategy, Observer, Decorator, and Builder. Plus the line where none of them is worth adding.
Karpathy popularized the term in 2024: describe the task, accept the code, move on. The method pays off in prototypes. In production with real users, the cost of code nobody read shows up as outages, exposed data, and an on-call shift with no context.
An 88-line workflow that runs lint, typecheck, tests, build, and deploy. Each section explains one configuration choice and the failure it prevents.
Each strict-mode flag catches a category of runtime bug. The four flags inside strict, two outside it worth the cost, and a migration path that keeps the team moving.
Monorepos solve code sharing and atomic refactors, and charge for tooling setup and boundary discipline. Adoption criteria, Turborepo versus Nx, and a folder structure that holds up.
Coverage counts executed lines, not the bugs your suite catches. Behavior over implementation, the cases worth covering, and three numbers that measure confidence.
Server Components never ship JavaScript to the client. Client Components need state, effects, and handlers. Composition rules, serializable props, and the await waterfall that costs seconds per request.
A PR reviewable in 20 minutes: typed title, what/why/how-to-review description, a single responsibility, formatting split from logic, visual evidence. Checklist before you request review.
Diff coverage, lint, static analysis, and type safety as merge conditions. Three calibrations for when an AI assistant opens more PRs than the team reviews.