Software Development

A calendar app wants to read your Google Calendar. It should never see your Google password, not even once to throw it away. OAuth 2.0 is the protocol that makes that possible: your Google account issues the calendar app a token that lets it read your calendar and nothing else, and the app never touches your credentials. That’s delegated authorization, and it’s a different problem from authentication. JWT vs session authentication covers how a server decides who you are. OAuth answers a narrower question: can this other application act on your behalf, and for what. Most OAuth mistakes start when people mix the two up. ...

Look a key up in a Python dict with ten entries and it takes the same time as looking one up in a dict with ten million. That is not an accident of a fast language. Python’s dict, Java’s HashMap and JavaScript’s Map are all hash tables, and the whole design exists to make lookup, insert and delete run in O(1) on average. Big O notation gives that lookup the label “constant time”. Here is the mechanism that earns it. ...

A C program that frees a buffer and keeps reading from it still compiles. Then it corrupts memory, sometimes immediately, sometimes three requests later in a part of the code that never touched that buffer. Rust rejects that program at cargo build, and there’s no garbage collector involved. The compiler tracks who owns each value and who is allowed to look at it. That tracking is ownership and borrowing. What are Rust’s ownership rules? Rust’s ownership model comes down to three rules: ...

A test for place_order needs a payment gateway, an SMS client, and a tax calculator. Wire in the real ones and every test run charges a card and texts a phone number. A unit test is supposed to run in milliseconds with no network, so all three have to be swapped for something else. That “something else” comes in five kinds, each solving a different problem, and treating them as interchangeable is why “just mock it” arguments in code review go in circles. ...

You save a file, Prettier reformats it, and ESLint immediately flags an error on the line Prettier just touched. Both tools are configured, both are running, and they are fighting each other instead of helping you. The two tools do different jobs. The trouble is that both have opinions about one thing: how code looks on the page. What ESLint actually checks ESLint parses your code into an abstract syntax tree and runs rules against its structure. Most of its value comes from rules that catch real bugs: a variable that’s never defined, an unreachable return after another return, an unused import left over from a refactor, a duplicate object key that silently overwrites the first. These are semantic checks. ESLint is reading what the code does. ...

<.+> against <b>bold</b> and <i>italic</i> doesn’t match <b>. It matches the whole string, from the first < to the very last >. Nothing is broken. That is what a greedy quantifier is supposed to do, and it is also the most common “regex is matching too much” bug there is. Once you know what the engine does while it reads your pattern, this bug and most of its relatives stop being mysteries. ...

Why Does any Lose the Type You Passed In? Type a parameter as any and TypeScript stops checking everything that comes out of the function: 1 2 3 4 5 6 function firstElement(arr: any[]): any { return arr[0]; } const n = firstElement([1, 2, 3]); n.toUpperCase(); // compiles, crashes at runtime You know you passed an array of numbers. The compiler doesn’t, because any tells it to stop looking. n comes back as any, so calling a string method on a number compiles cleanly and throws TypeError: n.toUpperCase is not a function when it runs. ...

Open a file that doesn’t exist in Python and open() raises a FileNotFoundError that unwinds out of your function. Do the same thing in Go and os.ReadFile hands back an error value sitting next to a nil byte slice. Same failure, two different shapes of code around it. The difference is not cosmetic. It decides whether a caller can ignore the failure by accident, and whether the compiler notices when they do. ...

You’re three files into a feature branch, nothing committed, when a teammate pings you about a null-pointer crash in production. The usual move is git stash, check out main, fix it, push, then git stash pop and hope nothing in your half-finished feature depended on the files you switched away from. git worktree skips the shuffle. It checks out the hotfix branch into a second folder, next to your feature branch, with both backed by the same repository. ...

One client stuck in a retry loop with no backoff can put more load on your API in a minute than your other ten thousand clients combined. From your side it won’t look like an attack. It looks like a bug on their end, and it becomes an incident on yours. A rate limiter caps that client before it gets there. What does a rate limiter actually decide? On every request, the limiter asks one thing: has this key made too many requests in the current window? Three choices turn that into something you can implement. ...