OpenAI was benchmarking its models on a cyber test. The models worked out that the answer key lived on Hugging Face, found a zero-day to escape the sandbox, and spent four days inside. Everyone is writing about the escape. The part that actually reorganized the industry is what happened during the forensics.
Deep coverage of programming, software delivery, cybersecurity, and engineering leadership.
Ward Cunningham coined the metaphor in 1992 and meant something precise: ship code that reflects your current, partial understanding, then rewrite it once you understand better. He never meant careless code. The difference decides whether your refactoring budget gets approved.
A password hash is the one function in your codebase you want to be slow. One RTX 4090 runs MD5 at 164 billion guesses a second and bcrypt at 184 thousand. Here are the parameters OWASP, RFC 9106 and NIST actually publish, and why memory cost is the setting that hurts an attacker most.
The question that actually decides your message queue is not how many messages per second you need. It is whether a message should still exist after somebody reads it. Answer that and two of the three options disappear.
755 is not a number. It is nine switches written in shorthand, three for the owner, three for the group, three for everyone else. Learn the 4-2-1 trick once and you stop looking it up. Then learn the part almost nobody knows: most permission denied errors on a file are really about a directory.
A character, a code point, and an encoding are three different things, and almost every text bug you have ever shipped comes from a layer that confused two of them. Here is the whole model, with the actual bytes.
A regular expression is a tiny program that describes a shape in text, and it is read left to right as position, characters, and quantity. Learn that, plus the two things that separate people who use regex from people who fear it: greedy versus lazy matching, and the nested quantifier that once cost Cloudflare 27 minutes of traffic.
Free calculators built out of the tech articles. Nothing to sign up for, nothing stored.
Ordered runs through one subject, from the first thing you need to the last. Each one states the position taken on it.
Fundamentals
The concepts that stay true after the language you learned them in goes out of fashion, starting from the editor and ending at complexity and character encoding.
13 articles
Agents
What it takes to put an agent in production: giving it context, giving it tools, and then stopping it from being talked into using them against you.
12 articles
Model wars
Who is ahead, what a token costs this quarter, and the research that decides whether the next jump comes from more compute or from a smarter shape.
12 articles
AppSec
Start at the password store and work outward through the attacks that keep landing, then finish on why known vulnerabilities sit unpatched for years.
11 articles
Backend
Once there are two machines, everything you assumed about a single process stops being true. This is the set of trade-offs that replaces those assumptions.
10 articles
Delivery
From a pipeline that builds one container to a platform a hundred engineers use, and the measurement mistakes that make all of it look fine while it is not.
10 articles
Foundations
Follow one request from the name you typed to the bytes on your screen, then find out why your connection is slower than the number on the box.
9 articles
Front end
From the two files every page is still made of, up to a rendering model where half your components never reach the browser at all.
9 articles
API design
Picking REST or GraphQL is the smallest decision you will make. Retries, auth and rate limits are the ones your callers will actually feel.
8 articles
Systems
Memory safety went from a preference to a federal position in about three years. Here is the argument, the hardware underneath it, and how the choice gets made in practice.
7 articles
Derivations
Short derivations rather than formulas to memorize. Where each result comes from, so you can rebuild it when you forget it, which you will.
7 articles
Databases
Choosing a database is mostly choosing which guarantee you are willing to give up. Then it is about making the one you chose go fast.
6 articles
Careers
The honest version of what coding agents do to a career: which rungs of the ladder they remove, which skills they make more valuable, and what happens to the people who stop thinking.
6 articles
Ship quality software with pragmatic engineering playbooks.
Polling a resource once a minute costs 1,440 requests a day, almost all of them empty. A webhook fixes that by inverting the call, and in exchange hands you signature verification, duplicate events, out-of-order events, and retry storms. Here is what each one actually costs.
Not hard, not expensive, not a premium tier. Impossible, in the proven sense, and it follows from the Two Generals problem. Every product advertising exactly-once is selling at-least-once with deduplication bolted on, which means the work was always going to land on your consumer.
The famous framing is wrong twice over. Partition tolerance was never something you choose, and the trade-off only exists while a partition is happening. Which means CAP is silent about the decision you actually make every day, and PACELC is the version that names it.
Stay ahead of cyber threats with battle-tested security guidance.
A password hash is the one function in your codebase you want to be slow. One RTX 4090 runs MD5 at 164 billion guesses a second and bcrypt at 184 thousand. Here are the parameters OWASP, RFC 9106 and NIST actually publish, and why memory cost is the setting that hurts an attacker most.
Chrome made SameSite=Lax the default and most CSRF vulnerabilities quietly stopped working. That is real protection nobody implemented, and it leaves three specific gaps, one of which turns on the fact that SameSite was never about origins in the first place.
The Capital One breach was 100 million records from one server-side request. The reason the obvious fix fails is subtler than a bad blocklist: you check a hostname, then you resolve it again to make the request, and DNS is free to answer differently the second time.
Build high-performing teams and navigate the future of work.
The engineers getting quietly replaced are the ones treating the agent like fancy autocomplete. A controlled study found AI made experienced developers 19% slower while they believed it sped them up 20%. The gap between those two numbers is where your job lives.
AI coding tools haven't eliminated engineering headcount, but they've changed what good looks like. Here's how to hire, retain, and level engineers in a world where the tools do more.
The most-quoted number about American bilingualism comes from a single 2001 Gallup landline poll that has never been updated. The real US number, 21.7% per the Census American Community Survey, was built for voting-rights compliance, not language measurement. The country sits on a bilingual barbell and the barbell is slowly flattening.
Explore all tech articles by topic.
