Cyclomatic complexity is a 1976 metric that refuses to die, for a good reason: it maps directly to real pain. McCabe defined it on the control flow graph as M = E - N + 2P, which for a normal single-entry, single-exit method collapses to 1 + the number of decision points. That number is the minimum count of test cases needed to exercise every independent path through the method. ...
The RP2350’s debug-disable is meant to be permanent: an OTP flag, CRIT1.DEBUG_DISABLE, drives both cores’ debug access ports to zero and cannot be unset. Ledger Donjon’s hardware security team showed the flag is not the last word in the enforcement chain. The memory-mapped DEBUGEN register overrides it, and a laser can set DEBUGEN even after it has been locked. Why the target was hard to hit: Debug-disable is triple-redundant in OTP and the lock bits are majority-voted across rows. DEBUGEN has no redundancy, parity or vote documented in the datasheet. Setting one register bit means hitting a few micrometres of silicon. A blind laser scan for it is impractical. So they localized it optically first. Toggle selected DEBUGEN bits in a loop, average 200 full-view frames per bit mask, subtract the two mean stacks to cancel sensor noise, thermal drift and unrelated switching. What survives is the emission that tracks the selected bits. Then the fault itself: ...
Wouter van Oortmerssen has published Goose, a systems language built on one premise: there is no heap. Every dynamic value lives inline on a data stack the compiler assigns statically, growth is a pointer bump, and scope exit is the only free. No allocator, no GC, no reference counting, no destructors, no unsafe. It compiles to a single C file, so it runs anywhere a C compiler does. The memory model is where the speed comes from: ...
Ethan Hawksley’s argument is not that passkeys are bad technology — he calls them fantastic. It is that they are built against the wrong threat for the wrong users. Because they are bound to the site they were created for, they can’t be phished, and because they are asymmetric they can’t be recovered from a breached server. That makes them a good fit for a corporate environment and, he argues, a poor fit for individuals, whose realistic worst cases are permanent lockout, automated account bans and device loss. ...
On 8 September, the flight data system underpinning UK air traffic control corrupted a piece of data and started dropping its link to London Area Control. Controllers saw nothing for two and a half hours. Departures were eventually stopped, more than 2,000 flights were delayed, cancelled or diverted, and restrictions stayed up until 19:30. NATS published its preliminary investigation report on 18 September. The defect is the interesting part. The mechanics: ...
ZCode is Z.ai’s official AI coding desktop app, the first-party harness for the GLM models. A developer who goes by ferstar found it a routine way: clearing disk space, he noticed ~/.zcode had grown past 700MB. Inside v2/checkpoints/ sat a 313MB encrypted file and a metadata record naming his active commercial project, the workspace size (345MB), a baseline label, and a retry counter stuck at 564 failed uploads. While logged in, the app silently packages your whole workspace — .git history, LFS cache, reflogs, global app config — encrypts it, and uploads it to Aliyun OSS, Alibaba’s object storage. ...
On 8 July 2026 a large part of Telstra’s mobile network stopped working — voice calls, SMS, even some calls to the emergency number, plus trains, payment terminals and EV chargers. No attack, no cut fibre, no power loss. One GPS receiver in one chassis in Melbourne came back from scheduled maintenance believing the year was 2006, and talked the rest of the timing hierarchy into agreeing. Netnod’s Svenne Ebenhag read the independent TAP report Telstra published and turned it into a general lesson about timing infrastructure. The verdict is uncomfortable: the protocol worked. Everything around it did not. ...
Every US state ID carries an AAMVA PDF417 barcode. Most of it is documented plaintext — three-letter codes for names, dates, license number — plus a jurisdiction-specific subfile (ZV in Virginia, ZN in New York, ZC in California) that generic scanners simply skip. Inside that subfile, some states have been quietly embedding cryptographic signatures for years. The problem Ryan Fahey identifies: a signature is a public act or it is nothing. New York, Virginia, North Carolina, South Carolina and Wisconsin all sign; none of them publish the construction or the public key, so no one outside the issuing DMV can check a card. ...
In 2014 Jake A. Smith needed a http_build_url() replacement while AOL’s CMS moved off PHP 5.2’s pecl_http extension. Rather than touch dozens of call sites, he wrote 174 lines that defined the function only if the real one was missing. He put it on Packagist in case anyone else needed the same patch and figured it would earn its keep for a year or two. Twelve years later it has been installed from Packagist nearly 20 million times and still picks up 400,000 a month. Where it actually ended up: ...
Hillel Wayne wrote Logic for Programmers because there were no good resources on logic aimed at programmers. With the book out, the remaining gap was the lack of good free ones — so he published its second chapter as a blog post. It covers predicates, implication, sets, and set quantifiers, using notation you can type on a normal keyboard. The organising claim is that predicates are the bridge between how we describe systems in English and how we encode them in a language. Most of the examples are problems a developer has already met: a hardware requirement, a pull-request merge rule, a set of images with fields. ...
Mark Seemann’s “Worse is better” series is about technologies that won despite better alternatives — VHS over Betamax. This entry runs the argument on the two languages he knows best, and lands somewhere uncomfortable for the more popular one. Comparing C# and F# is unusually clean, he argues, because both run on .NET: same web servers, same ADO.NET providers, same hosting options. Hold the ecosystem constant and only the languages are left to judge. His verdict: F# is better on most axes, and it is the least popular of Microsoft’s three supported .NET languages — behind even VB.NET. ...
Aleksandar Filipovski opens with a small disaster: the family photos, consolidated onto one external drive to free up disk space, then reformatted by his dad when a set-top box asked for it nicely. He refuses to blame him. One copy, no backup, no warning UI, and a non-technical user asked to make a storage decision — that is the design’s fault, not his. The rest of the essay is the ladder that “just back up my files” turns into once you take it seriously: ...
Yossi Kreinin’s June essay makes a claim about where work actually gets done: 20% of the people do 80% of the work, but that work only reaches its goals thanks to the under-5% who do things that someone else is supposed to do, but won’t. He is not talking about volunteering. He is talking about the specific move of absorbing the blocking part of someone else’s job: Learn how the adjacent system works and what its owners need — the knowledge is the point, not charity When you ship something and the people it was built for don’t adopt it, integrate it into their system yourself, the way Intel’s team wrote support for their first 32-bit CPU into Microsoft’s compiler If a manager doesn’t actually manage, go to their people directly — without calling it managing and without taking credit If you need a feature, sending a patch is faster than waiting on a planning process that is already finalized for this quarter and the next The reward is real but indirect: an organization broken enough to need this, but still healthy enough to appreciate it, will notice. So will you — you end up one of the few people who understands how the place works. His stated regret is the inverse: refusing to get into adjacent areas because they looked boring or “not my job,” then drowning in preventable problems that nobody else was ever going to fix. ...
Start with the failure this feature exists to fix. You have an embedding model with a 512-token input window — roughly 380 English words. You insert a 4,000-word document. The insert succeeds. Search works. Everything looks fine. The model read the first few hundred words and threw the other 3,600 away, and nothing anywhere told you. Anything past that point can never be retrieved. Until now the answer was to split documents yourself, embed each piece, and work out how to fold the results back into documents. Manticore moved that into the table definition — one option on a vector column: ...
Asking an LLM for a label sucks to work with — and the annoying part is that it often performs decently. Taylor, a statistician who now works on generative AI at YouTube, argues the problem is framing: you are using a feature extractor as a decision maker. Measured against the things you actually want from a classifier, the LLM verdict comes up short: Calibration. Verdicts are hard labels. Token log probabilities exist but nothing supports treating them as calibrated, and asking the model for its confidence gives you a number with no better claim. Without probabilities you cannot trade precision against recall in any principled way. Using all your information. You can paste structured fields into the prompt, but the LLM has no obligation to use them — and no way for you to check. Its baked-in prior is also a bad fit for your population: it does not know whether the positive class is rare or enriched, and telling it means editing the prompt per population with no guarantee it lands. Interpretability. A prompt reads as transparent prose, but you have no idea which parts are being followed and which are being ignored. None of that is a fault of the model. It was not designed as a classifier. ...
malloc() is the allocator most programs get for free, and it is the wrong default for anything allocation-heavy and multithreaded. The problem is not memory capacity. It is metadata contention: every thread funnels through a shared heap, so allocator calls serialize, and throughput can get worse as you add cores. Egbert Network’s survey traces how allocator design evolved to fix that, and turns the result into lookup tables. The bottleneck ...
John Wang walks the Strategic Petroleum Reserve as a design problem: store hundreds of millions of barrels for decades, keep it safe from attack, release it fast during a supply disruption, and keep maintenance cheap. The interesting part is that both obvious answers fail on the requirements rather than on engineering competence — and the solution that works gets three of those requirements out of one material. External floating roof tanks, the commercial standard, cap out near 300 feet across and 50 feet tall — about 630,000 barrels each. Full SPR capacity would need roughly 1,130 of them on ~45,000 acres, about the size of Washington, DC. And the seal between a floating roof and the tank shell is a documented lightning-fire point, which makes it an obvious target for shrapnel or an incendiary. ...
Bryan Parno — an Amazon Scholar and CMU professor who leads the Secure Foundations Lab — draws a line that Rust enthusiasm tends to blur: “more correct and secure” is not the same as “actually correct and secure.” Rust halts on an out-of-bounds array access, but a correct program would never perform the access at all. Nothing in the type system says your function computes the value you intended. Verus is an open-source automated program verifier for Rust that closes that gap, and Amazon uses it on key primitives in the Nitro Isolation Engine. ...
Sorting is one of the most heavily studied problems in computer science, so a 10x speedup claim usually means a benchmark was chosen carefully. Jan Wassenberg’s writeup from Google Brain Computer Architecture Research makes the case that the win here is real, and that it comes from one structural observation rather than a new algorithm: in quicksort, comparisons were never the bottleneck. Partitioning is. The mechanics: SIMD operates on independent lanes, while sorting re-arranges adjacent elements — so the naive expectation is that vectorization cannot help. Quicksort reduces to partitioning around a pivot, recursing, and sorting final blocks of ≤256 elements. Partitioning dominates CPU time, so that is the target. Modern ISAs (AVX-512, Arm SVE, RISC-V V) include a compress-store: given a mask of yes/no values for “element is less than the pivot”, it writes only the masked-on elements to consecutive memory. Negate the mask, run it again, and the other partition is written. AVX2 has no compress-store. Earlier work emulates it with permute instructions, and Highway picks compress-store where it exists and the emulation where it does not — so ~3,000 lines of C++ are not rewritten per platform. The result is the first vectorized quicksort portable across six instruction sets and three architectures, and it widens coverage to 16-128 bit inputs where the previous best was 32-bit integers only. The numbers, on one million values of 32/64/128 bits: ...
Will Keleher argues that a surprising share of engineering productivity comes from small pieces of knowledge rather than architecture or deep expertise. Not the obvious claim that “everything is made of smaller things” — the sharper one: some nuggets are valuable on their own, with almost no supporting mental infrastructure required. You don’t need to know Python to get use out of python3 -m http.server. The examples are the argument: ...