Notes that go a level deeper than the docs
Short, opinionated write-ups on the formats and protocols behind the tools here — what they actually guarantee, where they break, and the parts everyone gets wrong the first time.
QR Codes, Properly Explained
How QR codes actually work — finder patterns, Reed-Solomon error correction, static vs. dynamic redirects, and the real reasons codes fail in print.
Base64, Properly Explained
A 1989 hack for smuggling binary through 7-bit email transports — and why we still use it for JWTs, data URIs, and a hundred other places. Two alphabets, one common decode failure, and the things it categorically isn't.
URL Encoding, Properly Explained
Why %20 and + both mean space, why encodeURI and encodeURIComponent are not interchangeable, and how the HTML form spec quietly invented its own incompatible variant. RFC 3986 vs application/x-www-form-urlencoded.
Unicode, Properly Explained
A broken 1991 promise, three encoding forms, surrogate pairs as backwards-compat scaffolding, and why string.length lies in basically every language. Plus the surprisingly recent reason emoji families are seven code points each.
JSON String Escaping, Properly Explained
Six required escapes, one optional one, and a 25-year-old quirk where lone surrogates are legal in JSON but produce invalid UTF-8. Plus the U+2028 footgun that broke JS parsers until 2019.
Unix Timestamps, Properly Explained
Why every computer measures time from 1970-01-01, the difference between a 10-digit and a 13-digit timestamp, what happens in 2038, and the timezone bugs that will outlive us all.
Crontab, Properly Explained
Five fields, one Vixie cron from 1987, and why your '0 9 * * 1-5' fires on the wrong days when the calendar transitions through DST. Plus the day-of-week / day-of-month OR trap that nobody intuits correctly.
Regular Expressions, Properly Explained
Regex started as math in 1951 and stopped being math the moment programmers added backreferences. Modern engines are descendants of that compromise — and the line between 'regex' and 'pattern language' has never been formally redrawn.
AES, Properly Explained
NIST chose Rijndael in 2000 over four other finalists. Twenty-five years later it's the cipher under almost every secure connection on Earth. Here's what 'using AES' actually means — and the modes, IVs, and AEAD considerations that determine whether you're using it well.
JSON, Properly Explained
Douglas Crockford didn't invent JSON in 2001 — he discovered it inside JavaScript and gave it a spec. The decisions he didn't make (no comments, no trailing commas, no dates, no integers vs floats) are why JSON outlived every alternative — and why your config file is fighting you.
XML, Properly Explained
XML lost the data-interchange war to JSON twenty years ago — and still ships in your bank's SOAP gateway, your government's tax filing, your phone's SAML login, and the .docx file you opened five minutes ago. The compromises that lost it the war are exactly why it's still here.
YAML and .properties, Properly Explained
Why 'NO' becomes false, why Norway's country code (NO) once corrupted databases, and why your indented config file is one space away from a different document. Plus the much older Java .properties format that quietly outlasted everyone.
SQL, Properly Explained
SQL standardized in 1986 and immediately splintered into a dozen incompatible dialects. NULL doesn't equal NULL, the order you write clauses isn't the order they execute, and the ANSI standard is largely a polite fiction. The parts that matter when reading or formatting SQL across PostgreSQL, MySQL, SQLite, T-SQL, and the rest.
JWT, Properly Explained
RFC 7519 from 2015, three Base64url-encoded parts joined with dots, and a 2015 'alg: none' bug that became a permanent footnote in security history. What JWT actually is, when to use it, when to use a session cookie instead, and the four ways to misuse the alg field.
UUIDs, Properly Explained
Eight versions in the spec, only three you'll meet in production, and the case that v7 should be your default in 2026 instead of v4. Plus why random UUIDs make your database ten times slower than you think — and ULID, the alternative that almost won.
Hashes, Properly Explained
MD5 is broken, SHA-1 is broken, SHA-256 is fine, and absolutely none of those are how you should be hashing passwords. The distinction between fast hashes (for integrity) and slow hashes (for passwords) is the single most important hashing fact, and it's the one most often skipped over.
Color, Properly Explained
Hex, RGB, HSL, HSV, CMYK, OKLCH — six ways to describe the same dot of light, and why HSL has been quietly lying to designers for forty years. Plus the sRGB gamma curve, why your dark-mode palette is wrong, and the case that 2026 should be the year you switch to OKLCH.
Morse Code, Properly Explained
Samuel Morse's 1830s code is a Huffman coding from a hundred years before Huffman, the only character encoding still routinely used by humans without a computer in the loop, and the reason an `E` is a single dot. Plus the difference between American Morse and ITU Morse, and the prosigns nobody knows.
Nginx, Properly Explained
Igor Sysoev started writing nginx in 2002 because Apache's process-per-connection model couldn't handle 10,000 concurrent connections (the C10K problem). Twenty-three years later, nginx runs more of the public web than any other server — and the configuration footguns that defined that era still bite. The location-matching rules, the proxy_pass trailing slash, and the alias-vs-root distinction nobody intuits.
Graphviz, Properly Explained
Graphviz was born at AT&T Bell Labs in 1991, predates the web, and is still the only graph-layout tool you can hand a 10,000-node dependency graph and expect a sane picture back. Seven layout engines, one DOT language, and the reasons Mermaid and D2 haven't replaced it.