Articles & Guides

Original tutorials and hands-on guides about encoding, encryption, networking and productivity — each paired with an online tool.

Knowledge Base →
What Is Jev: An AI Decision Model That Does Not Write

Jev generates no text: it turns decisions into structured values software can use directly. What it is, why it appeared, and when not to use it.

AI & Engineering11 min readAILLMAI agentsBeginner
Local LLM vs Cloud API: Privacy, Cost and Capability Trade-offs

There is no universally best option, only a scenario-matched one. Compare privacy, capability, cost and ops — plus a practical hybrid path.

AI & Engineering6 min readAILLMPrivacy
RAG and Context Windows: Show the Model Only What It Needs

A model does not know your internal docs or recent events. The minimal RAG pipeline, context-window trade-offs, and five common pitfalls.

AI & Engineering6 min readAIRAGBeginner
Structured Prompts and Output Constraints for Machine-Usable Output

Same prompt, different result? The requirement was never constrained. Five prompt modules, few-shot examples, and hard output rules.

AI & Engineering5 min readAIPromptingPitfalls
AI Hallucination and Verification: A Six-Step Checklist

Hallucination cannot be prompted away. Four high-risk scenarios and a six-step checklist: models propose, tools and humans confirm.

AI & Engineering6 min readAILLMPitfalls
AI Coding Assistants: A Pair Programmer, Not an Answer Machine

Copy-pasting is not "using AI". A four-step workflow for turning an LLM into a pair programmer: context, decomposition, evidence, verification.

AI & Engineering5 min readAILLMPrompting
API Idempotency, Retries and Timeouts: Making Failure Predictable

Retries turn a blip into an avalanche when idempotency and budgets are missing. Three timeout layers, retryable errors, jittered backoff, idempotency keys.

Network & Ops6 min readAPIPitfalls
IP Route Analysis: What CN2 / 163 / 9929 / CMI Mean

Not all datacenter routes perform the same. Reading the ASNs in a traceroute tells you whether traffic uses CN2, 163, 9929 or CMI.

Network & Ops5 min readNetworkIP
Everyday Git and Recovering from Four Common Accidents

Wrong branch, deleted branch, overwritten work? Recovery through reflog, everyday commands, and three rules for teams.

Engineering Practice6 min readGitCLIPitfalls
Number Bases Made Intuitive: Binary, Hex and Color Codes

Positional notation explains every base conversion in one idea — and why #FF5733 is just hex. Big-number and float pitfalls included.

Encoding & Formats7 min readNumber basesBeginner
HTTP Status Codes and Caching Headers: A Practical Guide

401 vs 403? 301 vs 308? Status code confusions, four caching headers, and ready-to-use strategies for assets, HTML and APIs.

Network & Ops7 min readHTTPCaching
Add a Watermark Before You Share Images

Watermarks do more than stop reposting: attribution, tracing and branding. Choosing a style and cleaning privacy data before upload.

Engineering Practice6 min readImagesPrivacy
Practical Regex Recipes and Four Common Traps

Reusable recipes for emails, phone numbers and log dedup — plus greedy vs lazy, groups, lookaround, catastrophic backtracking, and when not to use regex.

Engineering Practice6 min readRegexPitfalls
Unix Timestamps 101: Seconds vs Milliseconds, UTC and Timezones

Ten digits or thirteen? Why timestamps never change with timezones? How Unix time works and where conversions go wrong.

Encoding & Formats6 min readTimePitfalls
Character Encoding and UTF-8: Why Text Turns into Gibberish

Mojibake is not lost data — it is bytes read with the wrong rule. Character sets vs encodings vs byte order, common symptoms, and a four-step fix.

Encoding & Formats6 min readUnicodeBeginner
URL Encoding: When You Need It, and Where %20 and + Come From

Why does a space become %20 or a plus sign? The difference between encodeURI and encodeURIComponent, and the root of mojibake.

Encoding & Formats7 min readURLEncoding
How to Verify File Integrity with SHA-256

Three steps to verify the SHA-256 checksum of a downloaded file, plus the most common comparison mistakes.

Encryption & Security6 min readHashingPitfalls
JSON Keeps Failing? Four Details That Trip Everyone

Trailing commas, single quotes, comments, unquoted keys — the usual reasons JSON validation fails, plus a fast debugging routine.

Encoding & Formats6 min readJSONPitfalls
Strong Passwords: Why Length Beats Complexity

Adding symbols is not always stronger. Password strength is about entropy — and length matters most. Practical rules and myths.

Encryption & Security6 min readPasswordsBeginner
Cron Expressions Explained: 5 vs 6 Fields and Pitfalls

Five fields or six? What happens when day-of-month and day-of-week are both set? Cron formats and frequent mistakes.

Network & Ops7 min readCronPitfalls
Base64 Is Not Encryption: Encoding vs Encryption

Encoding your password with Base64 does not make it safe. The real difference between encoding, encryption and hashing.

Encryption & Security6 min readEncodingEncryptionBeginner
What an IP Lookup Reveals — and What It Cannot

Can an IP locate your doorstep or reveal your name? The real limits of IP lookups, plus common privacy misconceptions.

Network & Ops6 min readIPPrivacy
Seven Practical Ways to Improve OCR Accuracy

Poor accuracy is rarely the engine alone: resolution, skew, contrast and language packs all matter. A checklist you can apply today.

Engineering Practice6 min readOCRImages
What Is Really Inside a JWT (and Three Fatal Mistakes)

A JWT is not encrypted: anyone holding it can read the payload. Its three segments, signing vs encryption, and what never to put inside.

Encryption & Security6 min readJWTEncodingPitfalls
What the TLS Handshake Actually Does: Symmetric, Asymmetric and Hashing

Three kinds of crypto work together in every HTTPS connection: asymmetric key exchange, symmetric encryption, hashing. Step by step.

Encryption & Security7 min readTLSEncryption
RSA or ECC? Choosing Asymmetric Crypto and Avoiding Misuse

Asymmetric crypto is not for bulk data. Key-size equivalents, RSA vs ECC trade-offs, and the split between encryption and signing.

Encryption & Security6 min readEncryption
AES in Practice: Modes, IVs and Authenticated Encryption

AES is just a block cipher: the wrong mode or a reused IV breaks it. How GCM and CBC differ, and how to use them correctly.

Encryption & Security6 min readEncryptionPitfalls
Never Store Passwords Directly: Salting, Slow Hashing and Rainbow Tables

Why SHA-256 is not enough for password storage: what salting fixes, what slow hashing fixes, and how to size bcrypt/Argon2.

Encryption & Security6 min readPasswordsHashing
Which UUID Version? v1, v4, v7 and When Not to Use One

A UUID is not just a random string. v1, v4 and v7 differ in time semantics, information leakage and index performance.

Engineering Practice7 min readIdentifiersPitfalls
Colour Formats 101: HEX, RGB, HSL and Accessible Contrast

Why does one colour have three notations? When HSL helps most, when contrast matters, plus a WCAG cheat sheet.

Encoding & Formats7 min readColourBeginner
Local vs Server Processing: Why Browser-Only Tools Are Safer

Uploading a file to a server and computing it in your browser have very different security boundaries. Comparing both architectures.

Engineering Practice5 min readPrivacyBeginner
The Testing Pyramid: Unit Tests Should Dominate

Why piles of UI end-to-end tests are slow and flaky. The unit / integration / e2e ratio and where to spend effort.

Engineering Practice6 min readTestingBeginner
Image vs Container: They Are Not the Same in Docker

An image is read-only, a container is a running instance. Layers, size optimization, and why data belongs in volumes.

Engineering Practice6 min readCloud nativeBeginnerCI/CD
Observability Three Signals: Logs, Metrics, Traces

You cannot fix what you cannot see. The distinct roles of logs, metrics and traces, and how to pinpoint failures fast.

Engineering Practice6 min readObservabilityBeginner
What CORS Actually Blocks: Same-Origin and Preflight

Why the browser blocks cross-origin requests. Same-origin policy, simple requests vs preflight, and common misconfigurations.

Network & Ops6 min readHTTPSecurityBeginner
Data Privacy Basics Every Developer Should Know

Collect minimally, don't store secrets in plaintext, support erasure. Compliance is not just legal's job; it starts at data modeling.

Encryption & Security6 min readPrivacySecurityBeginner
How to Version an API: URL, Header, or None

How to change an API without breaking old clients. URL vs header vs media-type versioning, plus deprecation and migration cadence.

Network & Ops5 min readAPIPitfalls
Catastrophic Regex Backtracking: One Pattern That Can Down Your Service

Some patterns explode exponentially on certain input. Why nested quantifiers are dangerous, how to spot and avoid them, plus a timeout fallback.

Engineering Practice6 min readRegexPitfalls
UUIDs and Random IDs: Can They Be Primary Keys

UUID v4 is random, v1 carries time. Pros and cons as a primary key, and why "not unique" is not the same as "guessable".

Encoding & Formats7 min readIdentifiersBeginner
How RGB / HEX / HSL Convert

What each color model is for. HEX is just RGB in hex, why HSL is better for tweaking, and how alpha is represented.

Encoding & Formats6 min readColourBeginner
CIDR and Subnets: Reading 192.168.1.0/24

What the number after the slash means: subnet masks, private ranges, and how to tell if two IPs are on the same network.

Network & Ops8 min readIPNetworkBeginner
Why Cache Invalidation Is Hard: Keys, TTL and Stampede

Caches absorb load but also serve stale data. Cache-key design, TTL strategy, and the three failure modes: penetration, stampede, avalanche.

Network & Ops6 min readCachingAPIPitfalls
SQL Injection Still Ranks #1: Parameterized Queries Are the Fix

String-built SQL is the most common breach entry. How injection works, why parameterized queries win, and the limits of ORMs and escaping.

Encryption & Security6 min readSecurityDatabasesPitfalls
Base64 Is Encoding, Not Encryption: When to Use It

Use Base64 only to put binary into a text channel. It is not secret, it grows the size, and here is where it is misused.

Encoding & Formats7 min readEncodingPitfalls
Why You Never Hash Passwords Plain: Salting and Slow Hashes

MD5 / SHA are wrong for password storage. Salting and slow hashes like bcrypt / Argon2, plus what to do on a leak.

Encryption & Security6 min readPasswordsHashingSecurity
Guarding API Input with JSON Schema

Unvalidated input is where bugs and injection enter. What JSON Schema can and cannot do, plus where in the stack to apply it.

Encoding & Formats6 min readJSONAPIBeginner
What HTTPS and TLS Actually Protect

HTTPS is HTTP plus TLS, not a new protocol. What certificate validation checks, common myths, and why internal traffic needs it too.

Network & Ops6 min readTLSSecurityBeginner
A Checklist for AI-Assisted Code Review

Make review useful, not noise: give context, constrain output, separate facts from guesses, and respect the privacy line for private code.

AI & Engineering6 min readAIPromptingEvaluation
Prompt Injection: Treat Model Output as Untrusted Input

When a model reads web pages, email and documents, attackers can plant instructions inside them. Direct vs indirect injection, plus a defence checklist.

AI & Engineering5 min readAILLMPromptingPitfalls
The 3-2-1 Backup Rule and Restore Drills

Backup is not the goal; recovery is. The 3-2-1 rule, RPO/RTO, verification and restore drills, plus the most common failures.

Engineering Practice6 min readBeginnerPitfalls
Choosing a Rate Limiter: Fixed Window / Sliding / Token Bucket / Leaky Bucket

Edge cases and trade-offs of four rate-limit algorithms, plus distributed counting, 429s and retry backoff.

Network & Ops5 min readAPINetworkPitfalls
HTTP Security Headers to Check Before Launch

What HSTS, CSP and X-Content-Type-Options actually protect, plus a launch-day checklist you can copy.

Network & Ops7 min readHTTPSecurity
Choosing Image Formats: JPEG / PNG / WebP / AVIF and Compression

Photos, screenshots, icons and animations each want a different format. Lossy vs lossless, transparency, animation, and where to set quality.

Encoding & Formats6 min readImagesPitfalls
What 2FA Actually Defends Against: TOTP Explained

Why a 6-digit code helps, and what it does not. TOTP internals, three tiers of 2FA strength, and how to use them well.

Encryption & Security6 min readPasswordsSecurityBeginner
Why Two Identical-Looking Strings Differ: Unicode Normalization

The same character has several representations, so naive comparison fails. NFC, NFD and NFKC explained, plus correct storage, comparison and hashing.

Encoding & Formats6 min readUnicodePitfalls
Semantic Versioning in Practice: MAJOR.MINOR.PATCH and Dependency Ranges

When does a change deserve a MAJOR bump? What is the difference between ^ and ~? Version semantics, the 0.x rules, and four dependency traps.

Engineering Practice6 min readCLIBeginner
Shell Scripting Essentials: Safe Preamble, Quoting Rules, Four Common Errors

Why set -euo pipefail is standard, how $var differs from "$var", and the four places scripts most often break.

Engineering Practice6 min readCLIPitfalls
SSH Keys and config: From Generation to Managing Many Hosts

Why ed25519? How to write a useful ~/.ssh/config? Key deployment, host aliases, and four common pitfalls.

Engineering Practice7 min readSSHCLI
Linux File Permissions: What the Three Digits Really Mean

What do 755, 644 and 600 mean? Why is the execute bit special on directories? Three identity groups, octal notation, and five frequent mistakes.

Engineering Practice6 min readLinuxCLIBeginner
Concurrency Models Compared: Processes, Threads, Event Loops, Coroutines

CPU-bound or IO-bound? Need isolation? Compare four concurrency models across key dimensions, with a selection order and common traps.

Engineering Practice6 min readConcurrencyPerformance
TCP vs UDP: Reliability, Ordering and Latency Trade-offs

Retransmit or not? Ordering? Jitter tolerance? Compare TCP and UDP across five dimensions, and what you must rebuild on top of UDP.

Network & Ops6 min readProtocolsNetwork
DNS Resolution and Record Types: Cache Chain, Records, Debug Commands

What A, AAAA, CNAME, MX and TXT each do, the cache chain a lookup walks, how to pick TTLs, plus debug commands and three common traps.

Network & Ops6 min readDNSNetworkBeginner
The Life of an HTTP Request: Seven Stages and How to Debug Them

From typing a URL to a rendered page: parsing, DNS, connecting, sending, processing, responding, sub-resources — plus where time goes and how to debug.

Network & Ops7 min readHTTPNetworkBeginner
Certificate Chains and Trust Anchors: Why the Browser Trusts You

One server certificate is not enough: the browser must follow the chain to a root it trusts. Chains, intermediate certs, trust anchors and common mistakes.

Encryption & Security6 min readTLSSecurityBeginner
Canary and Blue-Green: Ship Without Blame

Do not push the new version to everyone at once. Canary by percentage, blue-green instant switch, and how to roll back fast.

Engineering Practice5 min readCI/CDBeginner
WebSocket vs Polling: Choosing Real-Time Communication

Polling wastes requests, long-polling is semi-real-time, WebSocket is a bidirectional long connection. When each fits, plus heartbeat and reconnect.

Network & Ops6 min readNetworkBeginner
How a CDN Brings Content Close to You

Requests are routed to the nearest edge node. DNS-based routing, cache hits versus origin fetch, purge and prefetch, and what belongs on a CDN.

Network & Ops6 min readNetworkBeginner
Forward vs Reverse Proxy: Telling Them Apart

A forward proxy represents the client going out; a reverse proxy represents the server facing users. Position, use, and the gateway role.

Network & Ops5 min readNetworkBeginner
What HTTP/2 and HTTP/3 Improve Over HTTP/1.1

Head-of-line blocking, multiplexing, header compression. HTTP/2 gains, and why HTTP/3 moves to QUIC over UDP.

Network & Ops6 min readHTTPBeginner
Circuit Breaking and Degradation: Stop One Failure Taking Down All

Endless retries on a slow downstream only cause an avalanche. The three breaker states, half-open probing, and serving a fallback instead of blocking.

Network & Ops5 min readNetworkCI/CDBeginner
What Message Queues Solve: Async, Buffering, Decoupling

The producer drops a task in the queue and returns; the consumer handles it later. Async, peak buffering, decoupling, plus duplicate and ordering caveats.

Network & Ops6 min readNetworkBeginner
Why a Database Index Makes Queries Fast

Without an index the database scans the whole table. B+tree indexes, the return-to-table step, leftmost prefix, and why more indexes are not always better.

Engineering Practice6 min readDatabasesBeginner
Process, Thread and Coroutine: Three Units of Concurrency

Processes isolate, threads share memory, coroutines schedule in user space. Their costs, switching overhead, and when to favour coroutines or async.

Engineering Practice6 min readConcurrencyBeginner
OAuth2 Authorization Code: What Third-Party Login Does

Why "log in with WeChat" never gives your password to the app. The authorization-code flow, access vs refresh tokens, and what PKCE adds.

Encryption & Security6 min readSecurityBeginner
Cookies vs Sessions: Difference and How They Work Together

Cookies live in the browser, sessions on the server. How login state relies on both, why JWT is mistaken for a session, and the security flags.

Encryption & Security7 min readSecurityHTTPBeginner
GET vs POST: What Differs and When to Use Each

GET can be cached, sits in history, has length limits; POST carries a body and is not cached. Semantics, safety, idempotency, and when it matters.

Network & Ops6 min readHTTPBeginner
REST API Design and Resource Modeling

Treat things as resources and HTTP methods as actions. Resources, status codes, pagination, versioning, and the verb-in-path anti-pattern.

Network & Ops6 min readAPIBeginner