A publication about the machinery under everyday software: the contracts between services, the queries behind a page, and the failures that only show up in production.
Photo: tales of a wandering youkai · CC BY 2.0 · Wikimedia Commons
APIs & ProtocolsImplementing idempotency keys in a REST API requires more than just deduplicating on key - it demands storing enough detail to reject mismatched retries and safely handle concurrent…
Also on the desk
As a developer, you've likely hit a code review where two hardworking colleagues spar over which HTTP status code to return for a rejected request. Is it 409 (Conflict) or 422…
When creating an error JSON, most engineers start by copying a format from a previous project. Over time, this casual practice leads to a proliferation of custom error shapes in every…
APIs & ProtocolsDesigning a client-readable rate-limiting policy for a public API requires sending the right headers at the right time. While the standard HTTP status code is 429 Too Many Requests, RFC…
Web PlatformThe quick test looks great: your browser client sends the request, the dev server responds, and your UI updates happily. Delighted, you release into production. Minutes later, users are…
Web PlatformA primary CDN vendor doc or RFC that explicitly quantifies how many cache entries a given Vary line creates, to allow comparison across different usage of Vary by a CDN engineer.
The <dialog> element includes a lot of modal behavior out of the box.
Database applications that combine a connection pooler with a client library that auto-tracks prepared statements discover quickly that the two reuse strategies do not mix. Without matching…
Newly specified UUIDv7 changes the front of the identifier from random pattern to time sequence, which changes how keys cluster in indexes. For database administrators weighing primary key…
Request, response and the contract in between — the beat this domain was built on.
Implementing idempotency keys in a REST API requires more than just deduplicating on key - it demands storing enough detail to reject mismatched retries and safely handle concurrent…
As a developer, you've likely hit a code review where two hardworking colleagues spar over which HTTP status code to return for a rejected request. Is it 409 (Conflict) or 422…
When creating an error JSON, most engineers start by copying a format from a previous project. Over time, this casual practice leads to a proliferation of custom error shapes in every…
Browsers, standards and the document layer, as they behave rather than as they are specified.
The quick test looks great: your browser client sends the request, the dev server responds, and your UI updates happily. Delighted, you release into production. Minutes later, users are…
A primary CDN vendor doc or RFC that explicitly quantifies how many cache entries a given Vary line creates, to allow comparison across different usage of Vary by a CDN engineer.
The <dialog> element includes a lot of modal behavior out of the box.
Database applications that combine a connection pooler with a client library that auto-tracks prepared statements discover quickly that the two reuse strategies do not mix. Without matching…
Newly specified UUIDv7 changes the front of the identifier from random pattern to time sequence, which changes how keys cluster in indexes. For database administrators weighing primary key…
Offset pagination is a common approach to fetching rows in chunks for an interactive feed. But it has a hidden problem: the page boundaries are not anchored to any actual rows, so when the…
The original HAL specification, published at this address since 2011 and kept exactly where it is. The posts that argued it into existence live on The Stateless Blog, at their own addresses.
HAL is a simple format that gives a consistent and easy way to hyperlink between resources in your API.
InfrastructureWhen the defined freshness of a cached web resource runs out, a cache can still serve the stale object to the client while silently revalidating it in the background. RFC 5861, which…
InfrastructureWithout jitter, client retries on rate-limit hit or concurrency overload are synchronized. Each client backs off the same amount, but is rate-limited on the same retry. Not until jitter…
InfrastructureIf your file uploads keep failing with a 413 Request Entity Too Large error, it's time to troubleshoot the limits at each hop between the client and your application. The 413 status means…
Security & IdentityWebhooks pass event data between client and server with clear security guarantees.
Security & IdentityYou logged in and got a refresh token. You used it, and you got a new one. But now, after the interval between valid refresh-rotation windows, you try to use that first token again, as a…
Security & IdentityThe origin of account-management rules for passkey-based auth typically originates with Google’s 2026 autofill and discoverable-credential guidance, and ends with the NHI's updated guidance…
How the work is organised: transports, logs, flags and the decisions around them.
Engineering PracticeIf you are developing a live-event dashboard or feed, choosing the right transport protocol for pushing updates to the browser can make or break the user experience. Many developers start…
Engineering PracticeWhen a cloud-native application goes down, the production log is where on-call engineers turn to answer three crucial questions: which specific request failed, in which specific deployment…
Engineering PracticeYou would rightly think that a feature flag system is mainly a dashboard. a vendor or standards definition stating which part is foundational But the key architecture boundary lies…
Further reading elsewhere
Sponsored placements