Blog
Guides & Deep Dives
Practical, hands-on articles about developer workflows, data formats, and the tools that make them faster — written to be read, not skimmed.
- 3D / Stereoscopy / Free-Viewing / Anaglyph
How to See 3D Without Glasses (Free-Viewing, Step by Step)
"Glasses-free 3D" covers three unrelated things. This is the one that works on any screen you already own: a practical way to learn free-viewing, the size rule that decides whether it can work at all, and what to do when it won't come.
Read article - SSL / TLS / SAN / SNI / Domain Name / HTTPS
Why Doesn't My SSL Certificate Match My Domain? SAN and SNI Explained
A certificate-name error does not always mean the certificate was ordered incorrectly. The requested hostname, SANs, wildcard depth, SNI, DNS, CDN, and load balancer can all make a client receive another certificate. Follow the public path to find the endpoint actually serving it.
Read article - SSL / TLS / Certificate Chain / Intermediate Certificate / HTTPS
Why Is My Certificate Chain Incomplete? Fix Missing Intermediate Certificates
A certificate-chain error is not always a missing intermediate. The live endpoint may be serving an old chain, a private CA, or a chain with an expired certificate. Learn how to compare the public handshake with your intended deployment and fix the actual TLS terminator.
Read article - Email / Headers / DMARC / Security / Phishing
How to Read Email Headers (and Spot a Forged Sender)
Headers are the only first-hand record of how a message travelled. Read Authentication-Results, walk the Received chain backwards, and recognise the marks of a spoofed sender.
Read article - SSL / TLS / Certificates / HTTPS / Security
Why Is My SSL Certificate Invalid? A Practical Troubleshooting Guide
A browser certificate error does not tell you which layer failed. Check the live endpoint for expiry, hostname coverage, trust, certificate chain, SNI, TLS versions, and DNS before changing anything.
Read article - Email / DMARC / SPF / DKIM / Deliverability
From p=none to p=reject Without Losing Your Own Mail
A staged DMARC rollout: read the aggregate reports first, find every legitimate sender, use t=y as the brake now that pct is gone, and only then enforce.
Read article - Email / SPF / DKIM / DMARC / DNS
SPF, DKIM, and DMARC: What Each One Actually Does
Three records, three different jobs. What SPF, DKIM, and DMARC each check, why alignment is the piece that makes DMARC work, and how a message can pass SPF and still fail DMARC.
Read article - chmod / Unix / File Permissions / Linux
Permission Denied Even After chmod? Here's Why
You ran chmod and still get 'permission denied.' The file's mode is only the first gate. A field guide to the layers underneath: parent directories, ownership, mounts, SELinux, and ACLs.
Read article - chmod / Unix / File Permissions / Linux
chmod 644 vs 755: Which One Should You Use?
644 for files, 755 for directories — but why, and what about the modes in between? A field guide to choosing Unix permissions, plus the recursive chmod trap that makes every file executable.
Read article - chmod / Unix / File Permissions / Linux
What Does chmod 755 Mean? (And How to Read Any Permission)
The digits in chmod 755 aren't magic — they encode who can read, write, and execute. Read 755, 644, and 700 on sight, and see why execute works differently on a directory.
Read article - Cron / crontab / Debugging / DevOps
Why Didn't My Cron Job Run? A Field Guide to Silent Cron Failures
"It didn't run" is three failures in one phrase — it never fired, it died on its first line, or it ran fine somewhere you can't see. This guide tells them apart, starting at the cron log.
Read article - Cron / crontab / Scheduling / DevOps
Cron Schedule Examples: Every Minute, Hour, Day, Week, and Month
You know the cadence you want — every 5 minutes, weekdays at 9, the 1st — and just need the line. Copy-ready cron lines for the common cases, plus the few where the obvious guess is wrong.
Read article - Cron / crontab / Scheduling / DevOps
How to Read a Cron Expression (and Write One That Runs When You Think)
Cron is five fields in fixed positions and four symbols. Read any schedule on sight, and dodge the two traps that fire a correct-looking line at the wrong time.
Read article - Hashing / Checksums / Encoding / Debugging
Why Does the Same File Have a Different Hash?
You hash a file, someone else hashes what they swear is the same file, and the digests don't match. A hash is one of the most deterministic things in computing, so the value only changed because the bytes changed — quietly, invisibly. This guide walks the usual culprits: text encoding, a BOM, line endings, a trailing newline, text-vs-binary mode, structured data, and repacked archives — then shows how to normalize so the hashes agree again.
Read article - Hashing / Checksums / MD5 / SHA-256 / Security
MD5 vs SHA-256 for Checksums: Which Should You Actually Use?
"MD5 is broken, never use it" is the advice you'll hear, and it's half right — which makes it dangerous. Whether MD5 is fine or reckless for a checksum depends entirely on one question you have to answer first: is anyone trying to fool you? This guide separates the two jobs a checksum does, shows which hash each one needs, and explains why reaching for a stronger hash is often the wrong fix.
Read article - Hashing / Checksums / Integrity / Debugging
Why Doesn't My Checksum Match? A Field Guide to Hash Mismatches
A checksum that doesn't match feels like an alarm, but the alarm has only one setting: the two byte streams are not identical. It can't tell you why. The skill isn't re-running the hash — it's narrowing a mismatch to one of three causes: the data really differs, you're comparing the two hashes unfairly, or the reference value you're trusting is itself wrong. This guide walks all three.
Read article - YAML / Strings / Parsing / Configuration
YAML Multiline Strings: When to Use | and When to Use >
A multiline value in YAML has two block symbols, a pipe and a greater-than sign, plus three scalar styles — plain, single-quoted, and double-quoted — that also span lines. Each keeps or folds your line breaks differently, and picking wrong turns a script into one broken line. Here is the whole picture, with the corners that bite.
Read article - YAML / Parsing / Debugging / Configuration
Why Does My YAML Break? The Loud Errors and the Silent Ones
Two tickets land the same morning, both say 'my YAML broke.' One is a red parse error at line 12 — fixed in a minute. The other is a service that booted fine and behaved wrong, because an unquoted value quietly became something else. They're opposite problems, and the dangerous one is the quiet one.
Read article - JSON / YAML / TOML / Configuration
JSON vs YAML vs TOML: How to Choose a Config Format
A pull request adds one small config file and the review derails into forty comments — YAML? TOML? just use JSON? — and changes nothing. The thread jams on the wrong question: which format is best? There is no best. Each format's biggest strength comes bundled with a matching weakness, and once you see that, the choice comes down to two much simpler questions.
Read article - JSON / jq / CLI
How to Query a Huge JSON File Without Writing a Script
You don't need a throwaway parser to pull one value out of a giant JSON export — one too big to open in an editor. Getting data out of JSON is a query problem, and
Read articlejq, JSONPath, and DuckDB answer it, right down to files too big for memory. - Number Bases / Hexadecimal / Binary
Hex, Binary, and Decimal: Reading Numbers Programmers Actually Use
A color is
Read article#FF5733. A file mode ischmod 755. A permission check isflags & 0x04. A constant is0b1010, or0xFF, or255. Each looks like its own dialect, but they're one number in different clothes — and the fluency that makes all of it stop being friction is smaller than it looks: hex for bytes, binary for bits, decimal for humans. - URL Encoding / Encoding / Debugging
Why Is My URL Encoding Broken? Percent-Encoding and + vs %20
You put
Read articlecaféin a URL and it arrives ascafé. A space is+in one place and%20in another. An&inside a value splits your query in half. Something got encoded twice and now reads%2520. These all look like different bugs, but they're one idea with two twists: percent-encoding escapes bytes a URL can't spell literally, the rules change by component, and a space has two legal encodings. - Base64 / Encoding / Debugging
What Is Base64, and Why Won't Mine Decode?
You paste a Base64 string into a decoder and get 'Invalid character' — or worse, it succeeds and hands you a screen of mojibake. Usually nothing is corrupted. You've made a category error about what Base64 is: not encryption, not compression, just a reversible way to carry bytes through text-only channels — and once you see that, every decode failure becomes one of a short, nameable list.
Read article - Timestamps / ISO 8601 / Databases / Date & Time
Should I Store a Date as a Timestamp or an ISO String?
A code review stalls over one column: one dev stored a Unix timestamp integer, another an ISO string, and the third-party API hands back text ending in Z. Which is 'right'? The argument almost always gets stuck on integer versus string — which is the least important and last question to ask. What decides it is everything that comes before.
Read article - Time Zones / Date & Time / DST / Debugging
Why Does My Date Shift by a Day? Time Zones and Calendar Dates
A birthday saved as May 1 shows April 30. A July 15 event lands on the 14th. Yesterday's report counts the wrong rows. The cause is almost always the same: a calendar date is not a point in time, and the bug happens at the boundary where a zoneless date meets a zoned instant.
Read article - Time Zones / UTC / ISO 8601 / Date & Time
UTC, GMT, ISO 8601, and Unix Time: What's the Difference?
UTC, GMT, a Z-suffixed string, +08:00, a ten-digit number — they get used as if they were the same thing, and swapping them is how time bugs slip in. They aren't variants of 'the time'; they sit on four different layers. This untangles the reference scale, the zone, the offset, and the two ways to write an instant down.
Read article - Timestamps / Time Zones / JavaScript / Debugging
Why Is My Unix Timestamp Wrong? Seconds, Milliseconds, and Time Zones
A timestamp that shows the wrong time is almost never a broken number — it's a category error. A Unix timestamp isn't a date and has no time zone; it's a single count of seconds from one fixed instant. Once you separate the instant from the way it's rendered, 'off by decades', 'off by three hours', and 'off by a day' each collapse into one specific, findable cause.
Read article - JWT / Authentication / Security / Sessions
Short-Lived Tokens, Refresh Rotation, and How to Revoke a JWT
The way JWTs are usually deployed — as self-contained access tokens a server verifies locally, without checking any state — is exactly why you can't easily take one back: it's valid until it expires, whatever happens server-side. This article is about managing that: short access-token lifetimes, refresh tokens and rotation with reuse detection, and the real options for revoking a self-contained token, each with its trade-off against the statelessness you chose it for.
Read article - JWT / Security / Frontend / Authentication
Where Should I Store a JWT? localStorage, Cookies, and the XSS/CSRF Trade-off
Where to keep a JWT in the browser is usually asked as if one location were simply safer. It isn't a ranking. Each option answers two questions differently — can JavaScript read the token, and does the browser attach it automatically — and those map onto XSS and CSRF. This article works through localStorage, cookies, and in-memory storage, the patterns the industry has settled on, and why stopping XSS matters more than any storage choice.
Read article - JWT / Security / Authentication / Debugging
Is My JWT Secure? How Token Verification Gets Bypassed
Most JWT security failures do not break cryptography; they exploit a verifier that accepts an attacker-written token or never verifies it at all. The root mistake is letting unverified token data influence how code checks it. This guide explains the main attack paths and the validation rules that stop them.
Read article - JWT / Authentication / Debugging / Security
Why Is My JWT Invalid? How to Decode and Debug a JSON Web Token
A 401 that says 'invalid token' rarely means the token is garbled — it means one specific check between you and the server failed. Instead of collecting decode tricks, learn what a JWT actually is: signed plaintext you can always read but should only trust after verifying. Then every failure becomes a short, ordered checklist.
Read article - Regex / Lookahead / JavaScript
How Do I Match Something Without Consuming It? Regex Lookahead and Lookbehind
Your regex matches, but match[0] is missing the piece you expected — or your password check needs three rules at once. Both come down to one idea: lookahead and lookbehind inspect the text without consuming it. Here's how zero-width assertions really work, and the handful of things they make easy.
Read article - Regex / ReDoS / Performance / Security
Why Is My Regex So Slow? Catastrophic Backtracking and ReDoS
A regex that runs fine on short input but freezes the page on slightly longer input usually isn't slow — it's exponential. Learn to recognize catastrophic backtracking from its shape, understand the ReDoS attack behind it, and rewrite the pattern to make it safe.
Read article - Regex / Debugging / JavaScript
Why Isn't My Regex Matching? Start by Understanding the Engine
A regex that 'doesn't match' has usually matched — just not the span you expected. Instead of memorizing tips, understand how the engine walks the text and backtracks: greedy, lazy, anchors, lookahead, and catastrophic backtracking are all sides of that one mechanism.
Read article - JSON / Debugging / Formatting
How to Fix JSON That Won't Parse (and Clean Up the Mess That's Left)
A parse error usually means the input was never strict JSON in the first place. Here's how to read the error, spot the five things that quietly break it, and turn the result into something readable.
Read article - JSON / Diffing / Workflow
How to Compare Two JSON Files and See Only the Real Changes
Comparing JSON as plain text buries the change you care about under formatting and key-order noise. Here are terminal, editor, code, and browser approaches that make the actual difference easier to review.
Read article