Tailscale's next round of throughput work is memory management: stop copying 1 KiB packets into 64 KiB buffers, shorten queues that testing showed went unused, split one ordered pipeline into per-stream lanes, and cache the netmap on disk so devices can peer before they reach the control plane.
99.9% and 99.99% look nearly identical on a status page but differ by 10x in downtime. Jim Nielsen argues uptime percentage is a fine metric and a lousy interface — report hours affected in the last 30 days instead.
Git's packfile format assumes local disk and mmap, which makes ranged reads against object storage impossible. Xe Iaso replaced it with .bin/.cue columnar containers — push wall time fell up to 14.6x and S3 calls collapsed from thousands to dozens.
A research team built a tool that automatically generates data-only exploits — attacks that never touch control flow, only the arguments a program feeds to the kernel — and confirmed 944 of them against nginx alone.
Git reads ignore patterns from three files, not one. .gitignore is for the team, .git/info/exclude is for your clone, and a global excludes file covers your machine — the two you have never heard of keep a clean working tree without publishing your private filenames.
An SVP cut off the incident explanation with 'I don't want the details' — a declaration of trust rather than a brush-off, and a test of whether a postmortem actually changes anything.
Standardization is not dependency: retiring an independent Enterprise Linux rebuild removed a credible exit that CERN and Fermilab needed three years later.
Meta's Delta store trades write latency and storage efficiency for a strongly consistent design with no consensus protocol and no leader election.
Two engineers hiring QA programmers broke the Secretary Problem on purpose — keeping the door open to rejected candidates — and got five long-tenured hires out of 300 applicants.
JavaScript has never been more ubiquitous and its toolchain has never been less written in JavaScript. Maroun Baydoun on what the Rust rewrite buys, and what it quietly costs.
Anton Zaides on why software resists estimation: the house-renovation analogy for infrastructure, refactoring, and root causes — and why day-two slowdowns are normal.
Trail of Bits argues SAML has earned retirement: canonicalization, enveloped signatures, and kitchen-sink spec design keep producing auth bypasses 25 years in.
Gregory Gundersen memorized 100 digits of pi in a single sitting, not through talent but by turning recall into a system: a person-action-object index, a memory palace, and errors that stay local.
Seven defensive layers — spec review, near-universal unit tests, E2E gates, targeted AI quality passes, dual AI review, production monitoring — that let one team roughly double output without giving up reliability.
CI cost is mostly fixed cost per job — runner boot, checkout, install. Linear cut PR wait below five minutes and halved runner time per test by attacking setup, gates and sharding order, not the tests.
mathmain@1.0.0 hides a remote access implant behind AES-GCM: the decryption password is the LU lower factor of whatever matrix you pass to the solver, so nothing sensitive is greppable in the published code.
Boris Cherny's six-step loop for problems and products, and the two steps where plans actually break: defining the problem, and defining a clear and simple approach to it.
A libheif fix that was never marked as a security fix never got backported, so Debian still shipped the bug. Hacktron chained that decoder flaw through a forum image upload into an SSO identity failure, and from there into connected developer accounts.
MinIO was abandoned by its vendor in late 2025, breaking local S3 emulation in demos and build pipelines. Robin Moffatt tests the replacements with a working DuckDB and Iceberg smoke test, then scores each one on config, licence, and bus factor.
Ask a team what they shipped and you get a list; ask what they killed and the room goes quiet. Liam Nugent on subtraction neglect, the multi-year running cost of a feature, and why pruning is the best use of agents.
Sun's strategy was working and the company still died. Bryan Cantrill's answer: it had become bored with the mechanics of running a business. Plus what 244 HN commenters added.
In 2003 a flooded university NTP server turned out not to be an attack: 700,000 Netgear routers had the server's IP hard-coded and retried once per second until they got an answer.
For years Will Keleher could run commands but couldn't make his computer do logic. His case for shell skill: it's 20% syntax and 80% having a toolbox of programs you know well enough to compose.
Go 1.27 speeds up allocations of 80 bytes or fewer by 20–30% by generating a specialized allocator per span class — and stopping at 80 bytes because of instruction-cache pressure.
Every item on Taco Bell's menu is eight ingredients rearranged. Ted Dziuba's classic essay argues the same trick works with Unix tools — and that functionality is an asset while code is a liability.
A `while (true);` halt loop — a standard embedded idiom — was undefined behaviour in C++ until C++26, and Clang would delete it. P2809R3 defines a narrow 'trivial infinite loop' and makes it well-defined.
Companies already spend over a billion dollars a year on open source — just not on maintainers. Laurie Voss argues the registries should meter corporate use, charge for it, and pass a royalty down the dependency tree.
OpenAI's ad measurement pixel sets a one-year cookie that follows ChatGPT users to 936 advertiser sites, works signed out, and is filed under analytics in the cookie policy. OpenAI would not answer why.
The Emilua author on why Linux namespaces are the wrong tool for software sandboxing, why seccomp is OS hardening rather than privilege dropping, and how the actor model plus file descriptors as capabilities gets the job done.
A 26-configuration loop-device benchmark of ext4, XFS, ZFS, btrfs and bcachefs on the phases usual suites skip: near-full writes, 100k-file directories, snapshot scale, degraded rebuilds and a corruption probe.
Disappearing into a bigger project to prove yourself at a new senior job is the most common failure mode Sunil Pai sees — and the fix is to drop a level, not climb one.
A compression engineer's empirical case that JPEG XL is excellent technology in the wrong place: no lossy edge left over AVIF, slower decode than WebP, and a 1,918-byte file that can burn 17 seconds of CPU.
Seven years of Rust, then the same RFC 9535 JSONPath library rewritten in Zig: what the flat module layout, hand-enforced allocator discipline, and thin ecosystem actually felt like.
A practical field guide to async Rust performance: schedule latency, fairness versus batching, the mutex that stalls every worker, and why you rarely need every core for Tokio.
How one player proved Factorio's random quality rolls are just three linear-feedback shift registers — then read the RNG state and predicted every future roll using nothing but in-game combinators.
Cloudflare's Pingora backend router was burning up to 6GB of memory per process on consistent-hashing rings. Cutting hash counts by 90% and shrinking one struct reclaimed 100TB of RAM network-wide.
Emulating x86's Total Store Ordering on ARM's weak memory model costs up to 800x on the worst paths. FEX-Emu walks through the hardware fixes that shipped, and the ones that still have not.
The CEO of CrowdSec publishes the full forensics of a source code leak: backdoored npm packages, a live OAuth token sitting in a git remote, and the audit-log gap that nearly hid the root cause.
A neuromorphic researcher argues that in computational science the software is the result: reproducibility means executable and modifiable, and a paper without code is less scientific.
Cyclomatic complexity counts the independent paths through a method — and the minimum tests it needs. But the score alone is half the picture: risk is complexity times missing coverage times rate of change.
Ledger Donjon used photon-emission microscopy to locate the DEBUGEN register on Raspberry Pi's RP2350, then laser pulses to set it and read an OTP secret that permanent debug-disable was supposed to protect.
Goose replaces the heap with compiler-assigned data stacks: memory safe with no lifetime annotations or unsafe, with benchmarks claiming to beat idiomatic C++ and safe Rust on both speed and memory.
Passkeys solve phishing, the threat enterprises worry about, while raising the risk individuals actually run: permanent lockout, and losing every account when one device, platform account or hardware key goes away.
NATS's preliminary report traces a UK-wide airspace shutdown to a legacy defect in a squawk-code routine: a higher-priority message landed during a one-millisecond window, corrupted flight data — and the system's own self-healing hid it for two and a half hours.
A developer freeing up disk space found a 313MB encrypted archive of his commercial workspace, repacking itself every time he deleted it — and no setting in the app that turns it off.
One GPS card in a Melbourne chassis rebooted with six-year-old firmware, announced November 2006, and became the most authoritative NTP source for Australia's largest mobile network. NTP did exactly what it was built to do.
Three states sign the barcode on your driver's license and never published the keys — so Ryan Fahey recovered them from the cards themselves, and found the vendor already ships a verifiable version for California alone.
Jake A. Smith wrote a 174-line PHP shim in 2014 and expected it to last a year. It has been installed 20 million times — and he is retiring it rather than fixing it or handing it to a stranger.
Hillel Wayne publishes the logic chapter of Logic for Programmers free: predicates, implication, sets and quantifiers as the bridge from English requirements to code, plus the ability-guarantee tradeoff behind it.
Mark Seemann holds the .NET ecosystem constant to compare C# and F#, concludes F# is better on most axes and least popular — and that compiler-enforced dependency direction is architecture support C# tooling cannot match.