Information Technology and Software Engineering Topics

Backpressure First: Accept Only What You Can Finish

An unbounded queue does not absorb overload. It hides it until the system tips over. The Backpressure-First Principle says to accept only the work you can safely finish, and this article shows how: bounded queues, token-bucket rate limits, concurrency caps, timeouts that cancel the work, and 429 or 503 answers with Retry-After. Its tested Node.js code includes a load test in which a bounded server answers nearly twice as many requests in time as one that accepts everything. It also covers load shedding, clients that ignore the signal, retries, and the congestive collapse inside EC2 during the AWS outage of October 2025. Read more...

Two-Phase Commit vs. Sagas

An order that spans four services has no transaction they can share. Two-phase commit makes the steps atomic together and pays with blocking: a coordinator that fails at the wrong moment leaves participants waiting with their locks held. A saga commits each step locally and pays with compensation. This article covers what each one guarantees and where two-phase commit still belongs. Then it turns to the parts of sagas that bite: a compensation is not an undo, a failed call may have succeeded, and nothing isolates a saga from other requests. A tested C# orchestrator orders its steps around a pivot and finishes its compensation after a simulated crash. Takeaways and an exercise close the article. Read more...

Knowledge Graphs: What Every Edge Means

A knowledge graph stores facts as triples, such as Einstein, born in, Ulm, but storing them is the easy part. The hard part is deciding what every edge means: its direction, whether it holds one value or many, whether it changes over time, and how two mentions become one entity. This article defines knowledge graphs, compares RDF with property graphs, and runs two queries against Wikidata. Tested Cypher shows a friends-of-friends query that looks right and is not, and an LLM memory that stays correctable. It weighs GraphRAG against vector search with independent evidence and ends with a checklist for a first graph. Read more...

Amdahl’s Law: The Serial Ceiling

In 1985, a skeptic offered $100 to the first person to make a real application run 200 times as fast on a parallel computer. He did not think anyone could. A Sandia team won the prize. Amdahl’s Law explains both the doubt and the win: the serial part of a fixed job sets a ceiling that no number of processors can lift. This article works through the arithmetic, finds and shrinks the serial steps in a C# batch job, and measures what remains with the Karp–Flatt metric on .NET 10. It shows one shared counter making sixteen workers slower than one, explains Gustafson’s counterpoint for jobs that grow with the machine, and ends with a checklist. Read more...

Eventual Consistency: Not Yet or Never?

A service writes an order and announces it on a queue; a worker reads a replica and finds nothing. In a PostgreSQL 18 test with an in-memory queue, that happened for 1,000 of 1,000 orders, although the standby was only 2.5 milliseconds behind. Eventual consistency allows it: once the writes stop, every replica will return the last write, but not when. This article explains what the model promises, where you already depend on it, and why retrying can only guess whether “not found” means “not yet” or “never.” Then it carries the writer’s log position in the message, with tested C# for PostgreSQL 18 and PostgreSQL 19’s WAIT FOR LSN command, and ends with a security lens and a checklist. Read more...

Byzantine Faults: Know Your Failure Model

In May 2008, a cracked diode left the four computers in Space Shuttle Discovery’s redundant set disagreeing until no two of them agreed, and none of them was faulty. That is a Byzantine fault: a component that tells different parts of a system different things. This article traces the idea from NASA-funded flight-computer research to the 1982 Byzantine Generals paper and runs its algorithm in JavaScript with three and four generals. It shows why tolerating f such faults takes 3f + 1 replicas when delays have no known bound, how PBFT orders requests, and what Byzantine tolerance costs. It ends with how to choose: crash-tolerant consensus such as Raft for most systems, with arbitrary faults turned into crashes where possible. Read more...

The Recoverable Change Principle

Every significant change needs a way back, and the way back has to be proven, not just written down. This article explains the Recoverable Change Principle, starting with Google Cloud’s June 2025 outage. It shows how to tell a two-way door from a one-way door, and how a simple column rename becomes an accidental one-way door. An expand-and-contract migration fixes it, checked by a test that runs two releases against one database. The article also compares containment, rollback, compensation, and forward-fix, and shows how to set recovery objectives and judge a canary against a baseline. Read more...

Dual Writes and the Transactional Outbox

Saving an order and then publishing its event looks harmless, but the database and the broker share no transaction. A crash between the two loses the event, publishing first can announce an order that never commits, and two requests can publish in the wrong order. This article explains the dual-write problem, the fixes that do not fix it, and the transactional outbox. The event is written in the same transaction as the data, a relay publishes it at least once, and an inbox lets consumers absorb the duplicates. It compares polling with change data capture and includes EF Core code tested on SQL Server. Read more...

Observability-First: Software That Explains Itself

A failure that leaves only “error” in the logs is a design problem, not a logging problem. Observability-First is the principle of designing software so that its behavior can be understood from its signals—logs, metrics, and traces—especially when something breaks. This article explains where the idea comes from, what each signal answers, and why all three must share one context. It then works through six habits in tested Node.js and OpenTelemetry code, from child loggers and a trace carried across a queue to coded failures. Along the way, it shows default histogram buckets lumping every order of up to 5 seconds together, and a test that fails the build when promised telemetry goes missing. Read more...

NIST SP 800-53 for Developers

A one-line requirement to meet NIST SP 800-53 at the Moderate baseline selects 287 controls and enhancements. A few dozen of them shape how you build sign-in, logging, error handling, and the delivery pipeline. This article reads those controls at the source: what the bracketed parameters mean, who fills them in, and how tailoring turns a baseline into the real list. It then walks through what a sign-in page and a pipeline must meet, and covers release 5.2.0 of August 2025 and FedRAMP’s rules for 2026. Its Node.js script prints any control from NIST’s machine-readable catalog, and a warning names three errors that catalog still carried in October 2026. Read more...

ITIL for Developers

Google rolled out a new binary region by region, but nothing exercised its new code path. Two weeks later, a policy change reached every region within seconds, triggered the new code, and crashed the service that checks requests to Google’s APIs. ITIL has precise words for this: a change, a deployment, a release. This article reads ITIL’s core practices as five questions your software makes easy or hard to answer. What changed? What is broken? Why does it keep breaking? Are we keeping our promises? What is running where? It covers what ITIL (Version 5) kept from ITIL 4, DORA’s findings on change approval, and tested Node.js code for request IDs and self-reporting services, with a checklist. Read more...

Raft: One Truth at the Price of a Quorum

Two replicas cut apart by a network partition can each promise the same username, and no merge can take the promise back. For some operations, replicas must agree, not merge, and consensus buys that one truth at the price of a quorum. This article gives a precise test for when merging is enough and explains how Raft elects a leader, replicates a log, and commits entries safely. Tested C# shows Raft’s rules, including two traps that tempting shortcuts fall into. Then a three-node etcd cluster loses its leader and its majority: what fails, what still answers with stale data, and how fast a new leader takes over. A checklist covers what to ask of every quorum-backed system you run. Read more...

The OAuth 2.0 Client Credentials Grant

A nightly job that calls an API has no user to sign in, so it signs in as itself. This article walks through the OAuth 2.0 client credentials grant on Keycloak 26.8.1, with a Node.js client and an API check tested against it. It shows how a secret in a Basic header fails without the right encoding and why Keycloak’s defaults put more roles in the token than the job needs. It explains why an API must check the audience and the role, not just the signature. It then covers signed JWTs and mutual TLS, which RFC 9700 recommends over shared secrets, when not to use the grant, and a checklist. Read more...

The Pragmatic Programmer, Twenty Years On

In 2019, the authors of The Pragmatic Programmer rebuilt their 1999 classic. About a third of the topics were new, and they admitted they had explained DRY poorly the first time: it is about knowledge, not copied lines. Read in 2026, the book shows that the habits outlived the tools. The 1999 warning about wizard code still fits AI assistants. The advice to patch quickly still holds for security fixes, but self-spreading worms that publish poisoned updates make a case for letting routine updates age. The piece also argues that professionalism in software is a practice, not a credential, and ends with a short checklist. Read more...

Keeping CompTIA Security+ Active

CompTIA Security+ expires three years after you earn it. Once a thirty-day grace period for paperwork runs out, the way back is to pass the latest version of the exam. On paper, renewal takes 50 continuing education units and a $150 fee, but every shortcut has a condition. The CertMaster CE course accepts only people who passed SY0-601 or an earlier version. Before expiration, passing the exam again renews you only when a newer version exists. This article covers every renewal path as of October 2026: what counts toward the 50 units, where the caps sit, and what each path costs. It also shows when a developer’s own work counts and ends with a checklist. Read more...

CRDTs: Choose Your Merge

In 2007, Amazon’s Dynamo paper said that its shopping cart never loses an addition but can bring deleted items back. Every replicated write path has a merge policy like that cart’s, chosen or inherited. Conflict-free replicated data types, or CRDTs, choose it in advance, inside the data type, and are proven to converge. This article explains what a safe merge needs, builds a G-Counter and an observed-remove set in C#, and tests the counter’s merge and updates on random states. It shows what last writer wins and wall clocks cost, where CRDTs run, and why an invariant such as a unique username still needs coordination. Read more...

Graceful Degradation: Bend, Not Break

Around 2001, a feature that only showed shipping speeds took down Amazon’s website and halted its fulfillment centers. When its caches failed, its fallback sent every web server to the database. Graceful degradation is the alternative: when a part fails, do less, keep the core working, and keep the reduced answer honest. This article explains how it fits with failing fast and how to classify dependencies. Then it walks through code tested on Node.js 24: optional calls in parallel with honest fallbacks, timeouts that cancel the request, kill switches, and circuit breakers that recover by themselves. It ends with why fallbacks can make outages worse, what an honest fallback looks like, and how to keep degraded paths working. Read more...

The Seven SDLC Stages and Their Pitfalls

In 1970, Winston Royce drew the diagram later called the waterfall. Under it, he wrote that he believed in the concept but that the implementation he had just described “is risky and invites failure.” This article walks through the seven stages of the software development life cycle. For each, it covers what happens, the artifact that shows it happened, and where it most often goes wrong. It checks two pieces of folklore against their sources: what Royce actually recommended, and the claim that a defect’s cost grows tenfold per stage. It also covers the 2017 Equifax breach as a lesson in maintenance, how NIST’s secure software development practices line up with the stages, and a checklist for any methodology. Read more...

Acyclic Dependencies: Find the Cycle, Cut One Edge

Two ES modules import each other. A unit test passes, and the application crashes at startup, because the load order now decides whether a constant exists yet. The Acyclic Dependencies Principle, which Robert C. Martin named in 1996, rules out such loops. This article shows what a cycle costs, which toolchains refuse cycles and which load them anyway, and how to make CI catch the rest, folder-level cycles included. Three tested fixes follow: extract the shared part, invert the dependency, or publish an event. It closes with how to triage the cycles an older codebase already has, and a checklist. Read more...

Magic Numbers: Name the Decision

Naming a magic number looks like a cosmetic refactoring. This article argues that a name turns a number into a claim that a reviewer can check. It reads the names against the code in a C# shipping rule and a TypeScript retry helper. That reading finds a $63.75 jump in a shipping price, a helper that gives up at the first timeout, and a constant named for retries that counts attempts. It also explains what makes a number magic and what a bare one costs. It covers where a named number should live (a constant, validated configuration, a type, or an enum) and when a literal is fine. It ends with linters and a checklist. Read more...

Buffer Overflow Defenses

The buffer overflow helped spread the Morris worm in 1988, and by Google’s count, out-of-bounds bugs were still behind 40 percent of the memory-safety exploits Project Zero tracked in the wild from 2014 through 2023. Yet on a modern system, the classic attack ends in a crash. This article walks the layers that made a crash the default over almost three decades: stack canaries, DEP, ASLR, Control Flow Guard, shadow stacks, and memory-safe languages. None is enough alone. With tested C# on .NET 10, it shows a managed runtime turning an overflow into an exception, where the old rules quietly return, how a native library bug reached .NET apps through NuGet, and how to check that the layers are on. Read more...

The 80/20 Rule: Measure It, Mind the Tail

In 2002, Microsoft reported that 20 percent of the bugs behind its crash reports caused 80 percent of the errors. The Pareto principle runs through software, but it is a hypothesis to test, not a ratio to assume. This article traces the rule from Pareto’s income curves to Joseph Juran and checks the data for defects, run time, features, and effort. A Node.js script measures your own split from git history. Over two years of Vue.js’s core repository, 20 percent of the files took 80 percent of the fix touches, yet about a third of the fixes reached beyond them. Then the article turns to where the long tail is the job: security, error handling, and rare but essential features. Read more...

NIST CSF 2.0 for Developers

The NIST Cybersecurity Framework 2.0 is written for the people who run security programs, yet developers deliver many of its outcomes. This article reads the framework from the developer’s side: the six functions in their 2.0 wording, with the new Govern function at the center, and the subcategories that developer work delivers, from software inventories and data flows to secure development practices. It shows why generating log records and making backups are Protect outcomes, how the CSF pairs with SP 800-53 and NIST’s Secure Software Development Framework, and what the Tiers do and do not measure. It suggests four habits for everyday development work, including a pull request template keyed to CSF identifiers. Read more...

Rubber Duck Debugging: Say It Out Loud

Imagine a function that should take 20 percent off a $50 price and returns −950. Rereading it finds nothing. Explaining it out loud, line by line, finds the bug as soon as you say the numbers. This article starts with two programming books from 1999 and walks that bug through a full explanation and a failing test. Then it looks at the psychology research on why explaining works. It gives five rules for talking to a duck and names other listeners for when no duck is handy. It ends with the AI tools that have borrowed the name, and why your own explanation still comes first. Read more...

ISO/IEC 27001 for Developers

ISO/IEC 27001 is often described as ninety-three controls to tick off. It is a management system. Clauses 4 to 10 set the requirements for scope, risk assessment, internal audit, and improvement. Annex A is a reference list that each organization compares its own choices against, and the Statement of Applicability records the result. This article explains who issues a certificate and what it covers, and which controls of the 2022 edition reach code, pipelines, and data. It also shows the evidence development work leaves behind and why the certificate does not stand in for HIPAA, PCI DSS, or FedRAMP. Read more...

Miller’s Law: Count What People Hold in Mind

People quote Miller’s Law as “seven, plus or minus two” and use it to cap parameter lists, menus, and slides. This article returns to George Miller’s 1956 paper, which described two different limits and suspected that their shared seven was a coincidence. Later research puts the core limit at three to five chunks. The limit applies to what people must hold in mind, not to everything in view. That makes a seven-item menu rule a misreading, and a call with nine positional arguments a real problem. Tested JavaScript shows that problem and its fix. The article also compares the default parameter thresholds in five linters and ends with a checklist for design and code review. Read more...

The Observer Pattern in C# and TypeScript

The Observer pattern lets one object notify many others when its state changes. This article argues that one easily missed decision matters more than push versus pull: whether observers get a snapshot of what happened or a live reference to the subject’s state. It builds the pattern in C# and TypeScript and shows an audit log that describes the same order twice, because it read a live reference too late. An immutable snapshot fixes it. Then the article covers the other decisions hidden in every subject: observers that detach, throw, or trigger another notification mid-round, subscriptions that nobody ends, and several threads sharing one subject. The samples run on .NET 10 and Node.js 24. Read more...

CAP and PACELC: Choose per Operation

In 2018, a 43-second network partition left GitHub degraded for more than 24 hours. The CAP theorem explains the choice it forced: during a partition, each operation either refuses to answer or risks a stale answer. This article argues that the choice belongs to each operation and should be made in advance. It explains what the theorem says, corrects five common misreadings, and adds PACELC’s everyday trade-off between latency and consistency. On a partitioned three-node Cassandra cluster, the same lookup failed at QUORUM and, at ONE, missed a revocation recorded on the other side. It ends with a security lens, in which an attacker can cause the partition, and a checklist for each data path. Read more...

Leaky Abstractions: Learn One Layer Below

Joel Spolsky wrote in 2002 that all nontrivial abstractions leak to some degree. A loop that prints customer names shows how. With lazy loading on, EF Core sends one SQL query per customer it has not loaded yet; with lazy loading off, the same loop can throw. This article measures that N+1 leak on .NET 10, shows how to see it, and explains why the obvious fix leaks too. Then it follows the law through HttpClient’s connection pool, serverless cold starts, and the garbage collector. It ends with the habit I take from the law, learning one layer below the abstraction you use every day, and with how to build abstractions that leak honestly. Read more...

The Strategy Pattern in C#

The usual case for the Strategy pattern is that it replaces conditional logic with polymorphism. The decision does not go away, though: something still has to pick the algorithm. This article builds the pattern in C# from a shipping-cost switch and follows the switch to where it went: a lookup table, keyed services, or a framework’s own selection rule. It covers when a delegate is enough, how to shape a strategy interface for the whole family, and why changing a shared context’s strategy per request is a race. It compares Strategy with Template Method, generics, and State, and shows when the switch was the better design. Samples are tested on .NET 10. Read more...

Boundary Defense: Trust Is Not Transitive

In July 2024, a content update that had passed its vendor’s own validator affected an estimated 8.5 million Windows devices; the code that read it on each computer lacked a bounds check of its own. The Boundary Defense Principle makes the consumer’s check the rule. This article covers where the boundaries hide inside a system and why data your own services produce deserves suspicion. It explains why acceptance checks run on the normalized form, why sanitization belongs at the destination, and what to do when a check fails. Tested TypeScript samples parse an order, canonicalize usernames idempotently, check that file paths stay inside their directory, and hold on to the last good configuration file. Read more...

When a Canonical Data Model Pays Off

Five systems that publish orders and five that consume them can need twenty-five mappings, each one a fresh chance to confuse dollars with cents. A canonical data model cuts that to ten adapters around one shared format that no system owns. This article shows when the arithmetic pays and when it does not, why translation belongs only at the edges, and six ways a canonical model fails. It covers versioning and compatibility rules that last, the governance the model needs, and how to start with one data type. A tested C# example shows adapters that skip unknown fields and reject missing required ones. Read more...

Conway’s Law from the Requirements Side

Martin Fowler sums up Conway’s Law as an observation about the team that builds the software. Conway’s 1968 paper reaches further: in one of his examples, two military services told to build a common weapon system produced a copy of their organization chart. The organization you build for, whether a client or your own company’s business units, shapes the system too, through requirements written department by department, approval chains, politics, and reorganizations. This article goes back to Conway’s paper and the research since. It then gives three moves for engineers who cannot redraw that organization’s chart. Map who talks to whom, bridge the silos where the domain calls for it, and design boundaries meant to survive the next reorganization. Read more...

The Factory Pattern in JavaScript

“Use a factory here” sounds like precise advice, but three designs share the name. The Gang of Four’s 1994 book describes Factory Method and Abstract Factory. The familiar switch that turns a string into an object is neither; it is the simple factory idiom. This article separates the three in runnable JavaScript. A simple factory grows into a registry, and a factory method takes its creation step as an argument. An abstract factory makes it hard to mix the HTML and plain-text parts of an email. The article also explains when to pass a product or a factory into the code under test, and it ends with a checklist for choosing. Read more...

SOC 2 for Developers

SOC 2 is neither a standard you comply with nor a certificate. It is a CPA firm’s opinion on controls your company chose and described, judged against the AICPA’s Trust Services Criteria. None of the sixty-one criteria mentions passwords, encryption, or a number of days, so your company designs controls to meet them. In a Type 2, the auditor tests those controls over months, and much of the evidence is what engineering work leaves behind: pull requests, approvals, access changes, alerts, and incident records. This article explains the five categories, Type 1 and Type 2, and what the criteria ask of developers. It also shows how to read a vendor’s report, including 2026 warnings about reports that come too easily. Read more...

CQRS, One Step at a Time

CQRS means changing data through one model and reading it through another. The trouble starts when that small idea arrives bundled with a second database, a message bus, eventual consistency, and event sourcing. This article breaks CQRS into three steps: separate code paths, a read model in the same transaction, and a separate store fed by an outbox. It includes runnable C# and JavaScript for the second and third steps and shows that consistency depends on when the read model is updated, not on the pattern. It also treats event sourcing as a decision of its own, weighs the signals for and against CQRS, and ends with a checklist. Read more...

Availability by the Numbers

Availability is arithmetic, and the arithmetic has surprises. A service that restores twice as fast gains the same availability as one that fails half as often. A four-nines uptime target allows 4.32 minutes of downtime a month, so one incident can spend it all while a 5-minute alert waits to fire. Three independent services in a chain, each at three nines, give 99.7 percent, and redundant copies help only as far as they fail apart. The article also covers where the minutes of a restore go, the failures no fast restore can excuse, and why an average restore time makes a poor scoreboard. It includes a script to check the numbers and a checklist. Read more...

Complicated vs. Complex

Software engineers use complicated and complex as synonyms, but in software the words name two different kinds of problems. A complicated problem is knowable in advance, so specs, types, tests, and reviews pay off. A complex problem shows much of its behavior only under real load and real users, so it rewards observability, canary releases, feature flags, and experiments. This article explains the difference using the Cynefin framework and a 2021 AWS outage, in which a scaling job exposed a bug that years in production had hidden. It ends with one question to ask before you choose your tools, what to do when you cannot answer it, and a checklist. Read more...

SOLID in JavaScript

Suppose a reviewer writes “This violates the Liskov Substitution Principle” on your pull request. To answer, you need to know the principle well enough to argue about it. This article covers the five SOLID principles in JavaScript, a language without interfaces, starting from the original sources. Each principle gets a broken example and a fixed one that run on Node.js 24. Among them are a penguin that cannot fly, a printer that cannot scan, and a notifier that builds its own email sender. The article also covers what TypeScript adds, where dependency injection containers fit, and when to break the rules. Read more...

Little’s Law and Work in Progress

In 1886, William James wrote of “the eternal hanging on of an uncompleted task.” Little’s Law, proved in 1961, measures what such tasks cost the work: lead time equals work in progress divided by throughput. This article covers the law, the classroom dare behind its proof, and what a limit on work in progress can and cannot do. It shows why a team that keeps six pull requests open instead of twelve, at the same pace, halves the average time to merge. It also shows why a reviewer who is 90 percent busy makes a one-hour review wait nine hours. A short Node.js simulation checks both results, and the article ends with four habits and a checklist. Read more...

Threat Modeling with STRIDE

A records API checks every token and still lets one user delete another’s records. No test catches it, because nobody designed the check. This article shows how to find flaws like that on a whiteboard, while they cost a conversation. It covers Adam Shostack’s four questions, data-flow diagrams and boundaries, the six STRIDE threats with the per-element chart, and the four ways to answer a threat. It walks one small API through every step and turns four of its threats into checks in an ASP.NET Core handler, tested on .NET 10. It closes with how to run a session in an hour, the tools that help, and a checklist. Read more...

Idempotency in APIs

A request times out, and the client cannot tell whether the payment went through. Retrying may charge the card twice; giving up may lose the order. This article explains what idempotency means in HTTP, which methods HTTP already promises can be repeated, and why retries make idempotency mandatory. Most of it covers idempotency keys and the six decisions behind a correct implementation: concurrent duplicates, reused keys, key scope, failed attempts, replayed responses, and expiry. It ends with an ASP.NET Core middleware and a JavaScript retry client, tested against each other on .NET 10 and Node.js 22, and a checklist. Read more...

Combinatorics in Software Engineering

Three browsers, two languages, and four screen sizes make twenty-four test configurations, and ten feature flags turn them into 24,576. This article covers seven counting ideas behind everyday engineering decisions. Permutations explain why password length beats character variety. Cartesian products explain exploding test matrices, and pairwise testing tames them: six runs cover every pair of ten flags. The pigeonhole principle and the birthday bound predict hash and UUID collisions. Binomial coefficients sit under shuffle sharding and quorum availability. Inclusion–exclusion counts overlaps once, graphs count paths and cycles, and Catalan numbers count parse trees. Every calculation comes with JavaScript checked on Node.js 22. Read more...

Migrating .NET Tests to Microsoft.Testing.Platform

For a decade, dotnet test meant VSTest: a separate runner, adapters found by reflection, and results crossing a serialized channel. .NET 10 adds a second mode built for Microsoft.Testing.Platform, where each test project compiles to an executable with the runner inside. This article explains what the platform changes, shows the global.json switch and the new dotnet test options, and walks through xUnit.net v3, MSTest, and NUnit project files that were run on SDK 10.0.401. It settles the code coverage question, with coverlet.MTP as well as Microsoft’s extension, lists the exit codes and defaults that surprise pipelines, and closes with a ten-step migration checklist. Read more...

Unit, Integration, and End-to-End Tests

Engineers lose afternoons arguing whether a test is a unit test or an integration test. The layers are not defined by what a test asserts but by what it touches, how fast it runs, and where its failure points. This article turns that into a three-question decision rule, built on the test sizes Google published in 2010, and shows why the test pyramid follows from it, along with the ice-cream cone, the cupcake, and the testing trophy. C# examples in xUnit.net v3 on .NET 10 and a Jest example on Node.js 22 were run before publishing. It closes with Google's flaky-test numbers and what Meta learned from generating tests with language models. Read more...

The Courage to Delete Code

Ken Thompson counted a day spent throwing away a thousand lines of code among his most productive. Code nobody runs still has to be read, maintained, and secured: unused methods, commented-out blocks, stale feature flags, and packages nothing imports. This article counts that cost. It retells how Knight Capital’s Power Peg, unused since 2003, woke up on one missed server in 2012 and helped turn forty-five minutes into a $460 million loss. It explains why engineers keep dead code anyway and gives four steps for deleting it safely. A C# example, checked against .NET 10, shows the before and after, and two git commands find anything you deleted. Read more...

The Anatomy of a Good Code Review

In 1942, Simone Weil called attention “the rarest and purest form of generosity.” A code review is that attention, given to a colleague’s work, and both sides of a pull request have to earn it. Authors owe reviewers one intent per change, a self-review, and a description that says what, why, how to verify, and how to roll back. Reviewers owe authors attention spent in order, from intent and correctness down to style. A short C# method with four hidden bugs is reviewed twice, badly and well. The article closes with how to label and phrase comments, when to approve, and how fast to respond. Read more...

Four Falsehoods Programmers Believe about Time

On 1 November 2026, 1:30 a.m. will happen twice across most of the United States, while four Canadian provinces and territories stop changing their clocks for good. This article takes on four expensive falsehoods about time: that every day has 24 hours, that offsets are whole hours, that the rules hold still, and that clocks only move forward. It explains why the time zone database is a live dependency, what to store for past and future events, and how to fix three quiet bugs in C# and JavaScript. It closes with the dates every test suite should visit. Read more...

Spec-Driven Development for AI Coding Agents

AI coding agents made code cheap without making the right code any cheaper. Spec-driven development answers with a written specification that becomes the source of truth. A constitution holds the project rules, a spec says what and why, and a clarification pass finds what the spec leaves open. A plan, tasks, and focused reviews follow. This article walks through the workflow with a worked example and compares it with TDD, BDD, and waterfall. It also looks at what the evidence says, where the approach fails, and which tools support it as of September 2026. Read more...

Moving a Windows Server from Xen to Nitro

Resizing an EC2 instance from t2.large to t3.large sounds like a five-minute stop/change-type/start — until the box is a Windows Server 2016 install from the Xen era that lacks the NVMe and ENA drivers a Nitro instance needs to boot at all. This article walks through the migration end to end: the preparation that kept the maintenance window under an hour, the AWS driver-upgrade automation and the four IAM permission gaps its own documentation never mentions, and the small gotchas — CPU credit modes, installer quirks, multiplying backup AMIs — that would each have cost an hour. With a checklist for anyone facing the same move. Read more...

Secure Random Number Generation

Randomness is deceptively tricky: if done wrong, it can break security in subtle ways. Let us first clarify pseudo-random versus true random generation, then look at specialized hardware sources (like Intel RDRAND or TPMs), followed by software-based generators (cryptographic PRNGs). We will survey cloud services (Azure, AWS) that offer secure random bytes, and finally cover best practices in C# and JavaScript for tasks like generating tokens, password reset codes, or cryptographic keys. Read more...

Functional Completeness of Logic

Functional completeness is a powerful idea in Boolean logic: with just a few simple operations — or even a single one like NAND — you can express any logical function. This concept forms the backbone of everything from digital circuits to programming languages. The article introduces Post's lattice, a framework that shows which function sets are incomplete, and explains why NAND and NOR stand out as universal building blocks. Whether you're coding or designing hardware, understanding this principle offers deep insight into how complex systems are built from minimal components. Read more...

Foundational Principles in Software Engineering

Software engineering is more than writing code — it is a field enriched by the diverse journeys people take to enter it and strengthened by the timeless principles laid down by pioneers of the discipline. This article explores how backgrounds in science, business, and the humanities contribute to better engineering thinking, and revisits core ideas from foundational figures like David Parnas, Edsger Dijkstra, and Bertrand Meyer that continue to guide how we build and maintain great software today. Read more...

Empathy as an Engineering Skill

What does empathy have to do with software engineering? More than you might think. This article explores how empathy—often dismissed as a “soft” skill—is actually a powerful, practical force that improves software quality, strengthens team collaboration, guides ethical decision-making, and elevates leadership. Whether you are writing code, reviewing pull requests, mentoring juniors, or shaping user experiences, empathy can make the difference between functional and exceptional. Read on to discover how developing this essential human skill can transform your engineering practice. Read more...

Generate sequential GUIDs for MS SQL Server

If you're a .NET developer working with SQL Server, you may have encountered challenges using GUIDs as primary keys, particularly issues like index fragmentation and difficulties in ordering rows. This article addresses these concerns by introducing the OrderFactory.GuidGenerator library. This open-source tool generates sequential GUIDs compatible with SQL Server's UNIQUEIDENTIFIER type, effectively mitigating fragmentation and enabling natural row ordering. Targeting .NET Standard 2.0, the library is versatile across various .NET iterations. The article provides straightforward examples for integrating the library into your application, including dependency injection setup. For developers seeking to optimize database performance without abandoning GUIDs, this resource offers practical solutions and code snippets to get started. Read more...

Replacing a RAID Drive

If you're new to RAID technology and have just configured your redundant hard drive array, you might be wondering what steps to take when a drive fails. This article provides a comprehensive guide on replacing failed components and repairing the array, focusing on hardware RAID controllers with plug-and-play support under Windows Server. It discusses configurations for different server sizes, the benefits and considerations of using hot-spare drives, and the importance of understanding rebuild times and drive compatibility. Whether you're dealing with a 1U server with limited drive bays or a 2U server offering more flexibility, this article offers valuable insights to help you manage drive failures effectively. Read more...

Renewing TLS/SSL Server Certificates

Renewing TLS/SSL server certificates is a critical task to maintain secure communications across web services, email, VPNs, and more. This comprehensive guide walks you through the renewal process using Internet Information Services (IIS) Manager, detailing steps such as generating renewal requests and handling potential issues with certificate authorities. It also covers scenarios where creating a new certificate request is necessary, especially when updating certificate properties. For advanced users, the article provides insights into using command-line tools like certutil to manage and troubleshoot certificate renewals effectively. Read more...

Configuring IIS 7.5 with Embedded Fonts Media Types

If you're hosting a website on IIS 7.5 and notice that your embedded fonts aren't displaying correctly, this article provides a straightforward solution. It explains how to configure missing MIME types for modern font formats like .woff and .otf, which IIS 7.5 doesn't support by default. By following the step-by-step guide, you can prevent HTTP 404 errors and ensure that your site's typography renders as intended across all browsers. The article also offers updated MIME type values recommended by IANA, helping you maintain best practices in web font delivery. Read more...

Web Applications That Create Their Own Databases

Learn how to configure your web applications to automatically create their own Microsoft SQL Server databases using Windows Authentication. This guide walks you through resolving common permission issues and setting up the correct access for IIS Application Pool Identities, enabling a seamless and secure database creation process during deployment. Read more...

Prevent referrer form spam with IIS Rewrite Rules

Referrer spam can compromise the integrity of your web form submissions by injecting malicious URLs into referrer fields, potentially leading to malware exposure for unsuspecting analysts. This article provides a practical solution using IIS Rewrite Rules to block such spam. By implementing a specific rule in your web.config file, you can ensure that only requests from a predefined whitelist of domains are processed, effectively filtering out unwanted external referrers. The guide offers a clear, step-by-step approach to modifying your IIS configuration, enhancing your site's security against spoofed referrer attacks. Read more...

pfSense with Snort for Small Office

Discover how to build a powerful, cost-effective network perimeter device by combining pfSense with Snort in a small office setting. This comprehensive guide walks you through hardware selection—including the Lenovo TS140 server and Intel i350-T4 NICs—storage configuration with RAID1, and the full pfSense installation. It also covers integrating Snort for intrusion detection and prevention, optimizing performance, and overcoming limitations like wireless support. Whether you're a network enthusiast or a small business IT administrator, this article offers practical insights to enhance your network's security and efficiency. Read more...

Testing New Hard Drives

Discover a streamlined, open-source approach to thoroughly vetting new hard drives before deployment. This comprehensive guide walks you through a multi-stage testing process using Ubuntu and the smartctl utility, including quick and long SMART tests, as well as block-level surface scans. Designed for efficiency, the method allows simultaneous testing of multiple drives and supports hot-plugging without interrupting ongoing diagnostics. Whether you're setting up a data center or upgrading your personal NAS, this article equips you with the tools and commands needed to ensure your drives are reliable and ready for action. Read more...

Redirecting HTTP to HTTPS with URL Rewrite

In today's digital landscape, securing your website with HTTPS is not just a best practice—it's essential for protecting user data and enhancing search engine visibility. This article provides a clear, step-by-step guide on implementing automatic redirects from HTTP to HTTPS using the IIS URL Rewrite module. By configuring your site's settings correctly, you can ensure that all traffic is securely encrypted, improving both user trust and SEO rankings. Whether you're a seasoned developer or new to web server configurations, this tutorial offers practical insights to help you secure your website effectively. Read more...

Compiling Bootstrap from LESS with Grunt in Visual Studio

Discover how to seamlessly integrate Bootstrap's LESS source code into your Visual Studio ASP.NET projects using Grunt, a powerful JavaScript task runner. This comprehensive guide walks you through replacing the default Bootstrap CSS package with the LESS version via NuGet, setting up Node.js and NPM, and configuring Grunt to automate the compilation of LESS files into optimized CSS. By leveraging this approach, developers can customize Bootstrap components more efficiently, maintain cleaner codebases, and streamline their front-end workflows within the familiar Visual Studio environment. Read more...