Writing
Blog
Longer pieces on the formats and failure modes behind the tools.
6 mindata · formats
CSV, JSON Lines or Parquet?
Three formats for tabular data, and the questions that decide between them.
5 minperformance · encoding
Data URIs: when inlining an asset helps and when it hurts
Base64 costs 33 per cent, kills caching and blocks parallelism. Sometimes it is still the right call.
5 minsecurity · xml
The XML feature that reads your files
External entities let a document pull in content from elsewhere. That includes /etc/passwd.
6 mindates · databases
Storing time: instants, wall clocks, and the difference
UTC is the right answer to one question and the wrong answer to another.
5 minhtml · css · performance
What minification can and cannot safely remove
Whitespace in HTML is significant more often than people expect, and aggressive minifiers know it.
6 minhttp · api
The five HTTP status codes people get wrong
401 versus 403, 302 versus 307, and why returning 200 with an error body breaks things you cannot see.
5 mindiff · json
When a line-based diff tells you nothing
Reformat a JSON file and every line changes. Structural comparison asks a different question.
5 minurls · encoding
encodeURI or encodeURIComponent?
Two functions, one letter apart, with opposite jobs. Picking wrong breaks a URL or silently changes what it means.
6 minunicode · text
Your string length is wrong
Code units, code points and grapheme clusters are three different counts, and JavaScript gives you the least useful one.
6 minsemver · dependencies
What ^ and ~ actually let into your build
The two most common version range operators, and the assumption they both rest on.
5 mincron · scheduling
The cron field that runs your job more often than you meant
When both day-of-month and day-of-week are set, POSIX cron uses OR, not AND.
5 minsecurity · hashing
Hashing, encryption and encoding are three different things
They get used interchangeably in conversation and never in code. Here is the distinction that matters.
6 minidentifiers · databases
UUID v4 or v7: which identifier to reach for
Random identifiers are easy to reason about and hard on your database index. Time-ordered ones fix that, with a trade-off.
6 minyaml · config
YAML thinks Norway is false
How an unquoted country code became a boolean, and the other coercions waiting in your config files.
5 minencoding · security
Base64 is not encryption
What Base64 is for, what it costs, and why finding it in your codebase is sometimes a red flag.
5 mindates
Seconds or milliseconds? Reading Unix timestamps correctly
Why the same number means 1970 in one system and next Thursday in another.
7 minregex · performance
The regex that took down the site
How an innocent-looking pattern can take exponential time, and how to write one that cannot.
8 mindata · csv
CSV is not a format, it is a family of dialects
Delimiters, quoting, encodings and line endings all vary. Here is what actually breaks and how to survive it.
7 minsecurity · jwt
Decoding a JWT is not verifying it
A decoder shows you what a token claims. Only a key can tell you whether those claims are true.
6 minprivacy · json
Why most online JSON formatters are a security risk
The average formatter POSTs your input to a server. Here is what that means when the input is a production config.