A calendar app wants to read your Google Calendar. It should never see your Google password, not even once to throw it away. OAuth 2.0 is the protocol that makes that possible: your Google account issues the calendar app a token that lets it read your calendar and nothing else, and the app never touches your credentials. That’s delegated authorization, and it’s a different problem from authentication. JWT vs session authentication covers how a server decides who you are. OAuth answers a narrower question: can this other application act on your behalf, and for what. Most OAuth mistakes start when people mix the two up. ...
Structured Output From LLMs: JSON Schema Explained
Ask a model to reply with JSON and most of the time json.loads() works fine. The failures are the ones that cost you a debugging session: a one-line comment inside the object, a markdown code fence wrapped around it, a key spelled userEmail when your code expects user_email. A stricter prompt (“reply with ONLY the JSON object, no other text”) makes these rarer. It doesn’t make them impossible, because the model can still ignore a request. Structured output removes the request from the equation: you hand the API a JSON Schema, and it constrains the model’s own token sampling so the reply has to match it. ...
CSS Specificity Explained: How the Cascade Decides
You write .sidebar .card { color: blue; }, load the page, and the card is still red from a rule you added an hour earlier: .card { color: red; }. Your new rule comes later in the file. It still loses. The browser compares the two selectors with a fixed point system, and .sidebar .card scores higher than .card no matter which one you wrote last. That point system is specificity. Once you can calculate it on sight, “why isn’t my CSS applying” becomes arithmetic. It has nothing to do with layout: Grid or Flexbox decides where an element sits, and specificity decides which rule sets its color or size when two rules disagree. ...
What Is a Hash Table? Hashing and Collisions Explained
Look a key up in a Python dict with ten entries and it takes the same time as looking one up in a dict with ten million. That is not an accident of a fast language. Python’s dict, Java’s HashMap and JavaScript’s Map are all hash tables, and the whole design exists to make lookup, insert and delete run in O(1) on average. Big O notation gives that lookup the label “constant time”. Here is the mechanism that earns it. ...
Rust Ownership and Borrowing Explained
A C program that frees a buffer and keeps reading from it still compiles. Then it corrupts memory, sometimes immediately, sometimes three requests later in a part of the code that never touched that buffer. Rust rejects that program at cargo build, and there’s no garbage collector involved. The compiler tracks who owns each value and who is allowed to look at it. That tracking is ownership and borrowing. What are Rust’s ownership rules? Rust’s ownership model comes down to three rules: ...
Mocks vs Stubs vs Fakes vs Spies: Test Doubles Explained
A test for place_order needs a payment gateway, an SMS client, and a tax calculator. Wire in the real ones and every test run charges a card and texts a phone number. A unit test is supposed to run in milliseconds with no network, so all three have to be swapped for something else. That “something else” comes in five kinds, each solving a different problem, and treating them as interchangeable is why “just mock it” arguments in code review go in circles. ...
ESLint vs Prettier: What Each Does and How to Combine Them
You save a file, Prettier reformats it, and ESLint immediately flags an error on the line Prettier just touched. Both tools are configured, both are running, and they are fighting each other instead of helping you. The two tools do different jobs. The trouble is that both have opinions about one thing: how code looks on the page. What ESLint actually checks ESLint parses your code into an abstract syntax tree and runs rules against its structure. Most of its value comes from rules that catch real bugs: a variable that’s never defined, an unreachable return after another return, an unused import left over from a refactor, a duplicate object key that silently overwrites the first. These are semantic checks. ESLint is reading what the code does. ...
Database Transactions Explained: ACID and Isolation Levels
Why a bank transfer needs more than two UPDATE statements Move $50 from one account to another and the naive version is two statements: subtract from account A, add to account B. Run them separately, and if the process crashes or the connection drops between the two, the money is gone from A and never arrives in B. The database did exactly what it was told, twice. The business still lost $50. ...
How to Build an LLM Eval: Testing Prompts Like Code
Why “it looks right” isn’t a test for a prompt You tighten the wording of a ticket-routing prompt, run it against the three examples open in your scratch notebook, and ship it. A week later, billing complaints that used to land in the right queue start landing in “question” instead. Not the three cases you checked: the other four hundred you didn’t. Nothing crashed. There’s no stack trace. The prompt still reads fine out loud. ...
React useEffect Explained: Dependency Arrays and Cleanup
A chat component reconnects its WebSocket every time you type a letter into a search box that has nothing to do with chat. Another component re-renders in a loop until the tab freezes. A third logs its useEffect twice on mount, but only in development. None of these are React bugs. The first two are the dependency array doing exactly what you told it to, and the third is Strict Mode checking that your effect can clean up after itself. ...