Topic

Engineering

9 posts

November 2026

The Name That Matched Twice: Unicode Normalization, Grapheme Clusters, and Getting Bengali Text Right The same Bengali name can arrive as two different byte sequences, and your unique index, your search box and your audit log will each disagree about whether it is one … Engineering 26 min read

September 2026

The Certificate Nobody Renewed: 47-Day TLS, ACME Renewal Information, and the End of Revocation as a Safety Net The 200-day certificate limit has been in force since 15 March 2026. The 100-day limit arrives on 15 March 2027 and the 47-day limit two years after that, with … Engineering 26 min read

August 2026

Retry Without Paying Twice: Idempotency Keys and the Draft That Expired in April Every payment API ships a header called Idempotency-Key, and no RFC defines it. The IETF draft that tried expired on 18 April 2026, is absent from the IANA field-name … Engineering 30 min read Stacked Branches Without the Cascade: --update-refs, --onto, rerere, and the Force-Push That Isn't Safe Squash-merging the bottom of a stack detaches everything above it: the merged commits are in main under different SHAs, so git rebase main dutifully replays them and … Engineering 16 min read Audit Logs That Don't Lie: Engineering Trustworthy Audit Trails Most audit logs are diaries — written in good faith, full of gaps, and useless the day they matter. An audit log's actual job is to be believed under hostile questioning: … Engineering 19 min read

July 2026

Your Admin Panel Doesn't Need React: The Server-Rendered Renaissance for Internal Tools Internal admin panels have different constraints than consumer SPAs: same-origin, session-authenticated, operated by a handful of trusted-but-audited humans, and … Engineering 19 min read The Bot That Opened Merge Requests: Push vs Pull for Config, Credentials, and License Distribution When an artifact expires and renews on a schedule — a TLS certificate, a software license, a signing key set — somebody has to move the fresh copy to everyone who needs … Engineering 18 min read Rate Limits Are a Contract: Algorithms, Keys, State, and the Fail-Open Question Nobody Wants to Own A rate limit is not a throttle knob — it is a published promise with two failure modes, and most teams have never decided which one they signed up for. This post works … Engineering 21 min read

June 2026

The API Key Is the Tenant: Identity Models That Survive Multi-Tenancy Most cross-tenant data leaks are not exotic exploits; they are a missing WHERE clause, a trusted X-Tenant-ID header, or a query that resolved the tenant from one input … Engineering 19 min read