Developer guides
Original practical guides about data formats, encoding, security, infrastructure, and browser tools. Each article includes a related tool, limitations, and primary references.
25 independently accessible English articles
What Actually Belongs in a Production Dockerfile for Node (and What Doesn't)
Most Node Dockerfiles in the wild copy node_modules into the image, run as root, and ship a 900 MB layer. A short guide to the few decisions that matter: base image, multi-stage builds, layer caching for dependencies, the NODE_ENV trap, and why your docker-compose should not mirror production.
Catching Missing Translation Keys and Interpolation Mismatches Before Users Do
A missing translation key renders the raw key path to users, and a mismatched interpolation parameter renders an empty string or a crash. Both are easy to miss in review because the developer's locale always has every key. A guide to comparing locale JSON files, finding missing keys, and catching parameter mismatches before they ship.
Mock Data That Actually Exercises Your UI (Not Just Fills It)
Most mock data is ten copies of the same row with a different id. It fills the page and tests nothing. A guide to generating mock data that exercises layout edge cases, long names, missing fields, empty states, and the date and number formats that break formatting code, with field inference so a sample JSON becomes a realistic dataset in one step.
Converting cURL to Fetch, Axios, or Python Without Losing the Headers That Matter
cURL is the lingua franca of HTTP debugging, but pasting a cURL command into application code is a category error. A guide to what survives the conversion to fetch, Axios, and Python requests, what gets lost, and the headers and body encodings that quietly change behavior when you translate.
What an SVG Optimizer Actually Changes (and What to Hand-Edit Instead)
SVG optimizers strip editor cruft, round coordinates, and merge paths, and they usually get it right. They also break gradients, drop accessibility, and collapse groups you needed. A guide to what is safe to automate, what is not, and how to turn a clean SVG into a React or Vue icon component without losing the parts that matter.
QR Codes That Survive Printing: Error Correction, Size, and Field Testing
How QR codes actually work — finder patterns, Reed-Solomon error correction, static vs. dynamic redirects, and the real reasons codes fail in print.
Base64 Is Not Encryption: Alphabets, Padding, and Real Transport Failures
A 1989 hack for smuggling binary through 7-bit email transports — and why we still use it for JWTs, data URIs, and a hundred other places. Two alphabets, one common decode failure, and the things it categorically isn't.
Percent-Encoding Without Double-Encoding: URI vs Form Rules
Why %20 and + both mean space, why encodeURI and encodeURIComponent are not interchangeable, and how the HTML form spec quietly invented its own incompatible variant. RFC 3986 vs application/x-www-form-urlencoded.
Code Points Are Not Characters: Unicode Normalization and Invisible Bugs
A broken 1991 promise, three encoding forms, surrogate pairs as backwards-compat scaffolding, and why string.length lies in basically every language. Plus the surprisingly recent reason emoji families are seven code points each.
JSON Escaping Beyond Backslashes: Unicode, Surrogates, and Embedding Bugs
Six required escapes, one optional one, and a 25-year-old quirk where lone surrogates are legal in JSON but produce invalid UTF-8. Plus the U+2028 footgun that broke JS parsers until 2019.
Seconds, Milliseconds, 2038, and the Timezone Bugs Hidden in Timestamps
Why every computer measures time from 1970-01-01, the difference between a 10-digit and a 13-digit timestamp, what happens in 2038, and the timezone bugs that will outlive us all.
Cron Across Timezones and DST: Why Five Fields Are Not the Whole Schedule
Five fields, one Vixie cron from 1987, and why your '0 9 * * 1-5' fires on the wrong days when the calendar transitions through DST. Plus the day-of-week / day-of-month OR trap that nobody intuits correctly.
Backtracking, Catastrophic Runtime, and the Boundary of Regular Expressions
Regex started as math in 1951 and stopped being math the moment programmers added backreferences. Modern engines are descendants of that compromise — and the line between 'regex' and 'pattern language' has never been formally redrawn.
AES Modes, IVs, and Authentication: What Secure Encryption Actually Requires
NIST chose Rijndael in 2000 over four other finalists. Twenty-five years later it's the cipher under almost every secure connection on Earth. Here's what 'using AES' actually means — and the modes, IVs, and AEAD considerations that determine whether you're using it well.
JSON Has Six Types—and That Simplicity Creates Production Traps
Douglas Crockford didn't invent JSON in 2001 — he discovered it inside JavaScript and gave it a spec. The decisions he didn't make (no comments, no trailing commas, no dates, no integers vs floats) are why JSON outlived every alternative — and why your config file is fighting you.
XML After JSON: Namespaces, Validation, and the Security Boundaries That Matter
XML lost the data-interchange war to JSON twenty years ago — and still ships in your bank's SOAP gateway, your government's tax filing, your phone's SAML login, and the .docx file you opened five minutes ago. The compromises that lost it the war are exactly why it's still here.
When YAML Changes Meaning: Types, Indentation, and Properties Conversion
Why 'NO' becomes false, why Norway's country code (NO) once corrupted databases, and why your indented config file is one space away from a different document. Plus the much older Java .properties format that quietly outlasted everyone.
Readable SQL Is Only the Start: Injection, NULL, Dialects, and Query Plans
SQL standardized in 1986 and immediately splintered into a dozen incompatible dialects. NULL doesn't equal NULL, the order you write clauses isn't the order they execute, and the ANSI standard is largely a polite fiction. The parts that matter when reading or formatting SQL across PostgreSQL, MySQL, SQLite, T-SQL, and the rest.
Decoding Is Not Verification: A Production Checklist for JWTs
RFC 7519 from 2015, three Base64url-encoded parts joined with dots, and a 2015 'alg: none' bug that became a permanent footnote in security history. What JWT actually is, when to use it, when to use a session cookie instead, and the four ways to misuse the alg field.
UUID v4 vs v7: Randomness, Sortability, Privacy, and Database Locality
Eight versions in the spec, only three you'll meet in production, and the case that v7 should be your default in 2026 instead of v4. Plus why random UUIDs make your database ten times slower than you think — and ULID, the alternative that almost won.
MD5, SHA-256, HMAC, and Password Hashing Solve Different Problems
MD5 is broken, SHA-1 is broken, SHA-256 is fine, and absolutely none of those are how you should be hashing passwords. The distinction between fast hashes (for integrity) and slow hashes (for passwords) is the single most important hashing fact, and it's the one most often skipped over.
Why HSL Misleads: Choosing Color Spaces for Accessible Interfaces
Hex, RGB, HSL, HSV, CMYK, OKLCH — six ways to describe the same dot of light, and why HSL has been quietly lying to designers for forty years. Plus the sRGB gamma curve, why your dark-mode palette is wrong, and the case that 2026 should be the year you switch to OKLCH.
Why Morse Code Still Works: Timing, Frequency, and Human Error Tolerance
Samuel Morse's 1830s code is a Huffman coding from a hundred years before Huffman, the only character encoding still routinely used by humans without a computer in the loop, and the reason an `E` is a single dot. Plus the difference between American Morse and ITU Morse, and the prosigns nobody knows.
Nginx Location Matching and proxy_pass: The Slash Rules That Break Deployments
Igor Sysoev started writing nginx in 2002 because Apache's process-per-connection model couldn't handle 10,000 concurrent connections (the C10K problem). Twenty-three years later, nginx runs more of the public web than any other server — and the configuration footguns that defined that era still bite. The location-matching rules, the proxy_pass trailing slash, and the alias-vs-root distinction nobody intuits.
Choosing a Graphviz Layout Engine for Reproducible Architecture Diagrams
Graphviz was born at AT&T Bell Labs in 1991, predates the web, and is still the only graph-layout tool you can hand a 10,000-node dependency graph and expect a sane picture back. Seven layout engines, one DOT language, and the reasons Mermaid and D2 haven't replaced it.