Writing
Notes
Field notes on typography, tools, and the craft of building software.
A running collection of essays and working notes. The list below is generated from the posts themselves, newest first. Many articles are about me documenting what I learn from the designs and implementations of the various systems I work with.
Browse by tag 120
2026
- Don't Orchestrate What You Can Derive
Describe the work as semantic operations, establish the laws they obey, and let an interpreter derive the safe schedules.
- The Spreadsheet Always Wins
The spreadsheet is the requirement. Why the rewrite loses, and what a workbook would have to be so nobody needs two tools.
- Your Application Is a Graph
Dependency injection becomes easier to reason about when wiring is treated as a finite requirements graph: compile what is known, preserve genuine runtime choices, and keep authorization separate.
- Code From Strangers
A map of web security before the deep dives — one asymmetry that explains every attack, five questions the mechanisms answer, and the vocabulary you need so none of the rest reads as noise.
- Four Hundred Findings
A scanner report is not a list of your vulnerabilities. It is a list of your dependencies crossed with a database — and about one in thirty is reachable from code you actually run.
- HSTS: It's Time to Go HTTPS-Only
The header that makes HTTPS non-negotiable — no SSL stripping, no click-through, no fast rollback. Turn it on. Then think carefully before you preload, because that part you cannot take back.
- Nobody Shares Your Address Space
COOP, COEP and CORP are presented as three related headers. They are three doors into one process — and Spectre is why the browser cares who is inside it, not just what they are allowed to read.
- One Defect, Three Surfaces
CORS allowlists, OAuth redirect URIs and open redirects have separate vulnerability literatures and the same bug — a structured identifier tested with a string operation. The fix is one sentence, and a standards body finally wrote it down.
- Strings Do Not Remember Where They Came From
Trusted Types does not make XSS impossible — the spec says so itself. It makes unreviewed assignment impossible, which is a smaller claim and a far more useful one.
- The Credential That Predates the Origin
Cookies do not obey the same-origin policy — they never have. Thirty years of attributes, flags and name prefixes are one long retrofit, and knowing which parts actually hold is most of session security.
- The Header That Grants Nothing
CORS does not protect your server. It relaxes a rule about who may read a reply — and almost every misconfiguration comes from believing it does the opposite.
- Two Parsers Walk Into a DOM
Every HTML sanitizer is a second implementation of a parser it does not control. Mutation XSS is what happens in the gap — and it is why the fix eventually had to move inside the browser.
- Why Your Progressive Approach to Web Security Fails
Adding a security header can only tighten what reaches the browser; nothing you add can loosen it. Loosening is a hand edit of the policy already shipped — and that asymmetry is why incremental hardening degenerates into permissive sprawl, and why deny-by-default with a report-only rollout is the only shape that survives a real application.
- Don't Write the Policy. Derive It.
A security policy is a claim about every case you did not think of. State the invariant instead, enumerate what the system can actually do, and let a model checker hand you the counterexample.
- The Good, the Bad, and the Bugly
When browser bisection almost works—and why stopping can be the right result.
- Where Did This Request Come From?
The Sec-Fetch-Site, -Mode, -Dest and -User headers answer a question servers could never ask — and turn a class of cross-site attacks into a four-line check.
- The Checkbox Is a State Machine
The indeterminate square isn't a third value of a boolean — it's a report the tree makes about itself. Model that one distinction right and the classic stuck-parent bug becomes impossible to write.
- How Fast Web Apps Boot: The Architecture of Event-Delegated Shells
Dissecting the client architecture of event-delegated app shells — local service-worker restoration, BigPipe streaming, and declarative attribute event routing.
- The URL Is the Hash
Content-addressing on the wire — how the web quietly became a content-addressed store, where fingerprinted URLs and Subresource Integrity are real Merkle edges and the cache that looks most like one isn't.
- Can I Use This Library?
A strict CSP quietly turns every dependency into a security decision. Here is the tree I walk to make it — per library, and across a whole app.
- The Header That Can't Be Cached
Cache-Control from first principles — and why a page carrying a CSP nonce must be told never to be stored, not merely "don't cache."
- Trust No Script
Why a strict Content Security Policy is one of the hardest headers to deploy — and how to read one with Google's CSP Evaluator.
- You Don't Want Separate Repos
Repository topology decides whether coupled code shares one content-addressed snapshot or negotiates version strings across a registry boundary.
- A Language That Can't Loop Forever
Bazel's Starlark forbids unbounded loops and recursion on purpose, and gets analyzability, caching, and parallelism in return. Buck2 quietly allows recursion back — and the split shows which restriction is load-bearing.
- A Little Uncertainty Buys a Lot of Space
Bloom filters trade a small chance of being wrong for an enormous saving in memory — a bargain storage engines take and build systems, so far, refuse.
- node_modules Is the Heaviest Object in the Universe
The same "the hash is the identity" idea that powers a build cache also explains why pnpm stores on disk what npm copies a hundred times over.
- The Build That Restarts Itself
Inside Skyframe, Bazel's incremental engine — and the strange trick at its heart.
- The Grain of the Machine
A processor isn't a featureless calculator — it has a shape: words, cache lines, vector lanes. Code that moves with that grain runs many times faster than code that fights it, on the very same data. Here's the shape, and a measured case where the same arithmetic runs 22× slower against it.
- The Hash Is the Identity
Content-addressing in the build cache — content-addressed storage and Merkle trees turn a build cache into a shared resource, so your build is proportional to anyone's change.
- The Widest Box Is the Bug
A flamegraph turns thousands of stack samples into one picture where the slow code is, almost literally, the biggest thing on the screen.
- There Are No Phases
Buck2's DICE engine collapses load, analysis, and execution into a single graph — and the decision to rebuild rather than adopt.
- Utils Is Where Modularity Goes to Die
Module boundaries should follow the dependency graph, not your folder intuitions — and "optimal" can be defined precisely.
- With the Grain
The original turned a big integer into bytes one byte at a time, fighting the machine. The rewrite went with its grain — whole machine words, packed in C. That structural choice is why it's still ~15× faster fifteen years on, even as CPython sped up underneath it.
- The Build Is Proportional to the Change
What every build system is really doing — and the one decision that separates the ones that scale.
- Kitchen Sink Series — Part One
A fixture sibling so the kitchen sink has a real previous part to link to.
- Kitchen Sink Series — Part Three
A fixture sibling so the kitchen sink has a real next part to link to.
- Scaffolding a Typographic Portfolio Site
The design philosophy behind this site — why it's built from durable tools and a purposeful type system instead of a framework, and why every choice is aimed at lasting.
- The Patch Bram Applied
A small contribution to Vim, the man who took it, and the editor I still open every morning.
- Designing an API That Outlives You
I wrote watchdog in 2010. Fifteen years and three maintainers later it still ships the same public API I designed — here's what made it last.
2025
- Everything Is an Action
The architecture of Firebase Genkit rests on one primitive — a self-describing, observable, callable function — and the whole SDK is layers of specializations of it.
- Reading a Codebase
A method for taking real software apart at the source level — find the one type everything hangs from, extract the algebra, and learn what the designers refused to allow.
2009
- I like the way Aquamacs looks. I don’t use it because it feels different
Why I keep stock GNU Emacs over Aquamacs — one consistent editor across every OS.
- Even faster String.prototype.trim() implementation in JavaScript
A faster, non-regex String.prototype.trim() — later adopted into early JS frameworks.
- Making the browser download scripts in parallel
Loading multiple scripts concurrently instead of the browser’s serial default.
- memcache.js for Google App Engine application front-ends?
Caching AJAX responses on the client by mapping App Engine’s datastore to JS objects.
- Implementing a Pythonic range() function in JavaScript
A Python-style range() helper instead of typing out a sequence by hand.
Linked from 123
- Scaffolding a Typographic Portfolio Site
- Notes tagged “accessibility”
- Notes tagged “algebra-of-the-interface”
- Notes tagged “algebraic-effects”
- Notes tagged “alloy”
- Notes tagged “api-design”
- Notes tagged “app-shell”
- Notes tagged “architecture”
- Notes tagged “archive”
- Notes tagged “art-of-debugging”
- Notes tagged “authentication”
- Notes tagged “authorization”
- Notes tagged “automata”
- Notes tagged “bazel”
- Notes tagged “bloom-filters”
- Notes tagged “browsers”
- Notes tagged “buck2”
- Notes tagged “build-systems”
- Notes tagged “cache”
- Notes tagged “caching”
- Notes tagged “cdn”
- Notes tagged “checkboxes”
- Notes tagged “code-generation”
- Notes tagged “collaboration”
- Notes tagged “content-addressing”
- Notes tagged “cookies”
- Notes tagged “cors”
- Notes tagged “cpu”
- Notes tagged “cpython”
- Notes tagged “crdt”
- Notes tagged “csp”
- Notes tagged “csrf”
- Notes tagged “debugging”
- Notes tagged “dependencies”
- Notes tagged “dependency-injection”
- Notes tagged “derived-state”
- Notes tagged “design-system”
- Notes tagged “dice”
- Notes tagged “dissecting-systems”
- Notes tagged “effect-systems”
- Notes tagged “emacs”
- Notes tagged “event-delegation”
- Notes tagged “flamegraphs”
- Notes tagged “formal-methods”
- Notes tagged “front-end”
- Notes tagged “gen-ai”
- Notes tagged “genkit”
- Notes tagged “git”
- Notes tagged “google-app-engine”
- Notes tagged “gradle”
- Notes tagged “graphs”
- Notes tagged “hardware”
- Notes tagged “hsts”
- Notes tagged “http”
- Notes tagged “incremental-computation”
- Notes tagged “isolation”
- Notes tagged “javascript”
- Notes tagged “jsaction”
- Notes tagged “jwt”
- Notes tagged “language-design”
- Notes tagged “merkle”
- Notes tagged “methodology”
- Notes tagged “modularity”
- Notes tagged “monorepo”
- Notes tagged “npm”
- Notes tagged “oauth”
- Notes tagged “observability”
- Notes tagged “open-source”
- Notes tagged “optimization”
- Notes tagged “orchestration”
- Notes tagged “org-mode”
- Notes tagged “package-managers”
- Notes tagged “parallelism”
- Notes tagged “parsing”
- Notes tagged “partial-evaluation”
- Notes tagged “performance”
- Notes tagged “persistent-data-structures”
- Notes tagged “pnpm”
- Notes tagged “privacy”
- Notes tagged “probabilistic-data-structures”
- Notes tagged “profiling”
- Notes tagged “python”
- Notes tagged “reading-code”
- Notes tagged “refactoring”
- Notes tagged “remote-execution”
- Notes tagged “same-origin-policy”
- Notes tagged “sanitization”
- Notes tagged “sdk-design”
- Notes tagged “security”
- Notes tagged “service-worker”
- Notes tagged “sessions”
- Notes tagged “simd”
- Notes tagged “skyframe”
- Notes tagged “software-architecture”
- Notes tagged “software-design”
- Notes tagged “spectre”
- Notes tagged “spreadsheets”
- Notes tagged “standards”
- Notes tagged “starlark”
- Notes tagged “state-machines”
- Notes tagged “subresource-integrity”
- Notes tagged “supply-chain”
- Notes tagged “svg”
- Notes tagged “tla-plus”
- Notes tagged “tls”
- Notes tagged “tooling”
- Notes tagged “tools”
- Notes tagged “tribute”
- Notes tagged “trusted-types”
- Notes tagged “types”
- Notes tagged “typography”
- Notes tagged “verification”
- Notes tagged “versioning”
- Notes tagged “vim”
- Notes tagged “vulnerabilities”
- Notes tagged “watchdog”
- Notes tagged “web-architecture”
- Notes tagged “web-performance”
- Notes tagged “web”
- Notes tagged “workbook”
- Notes tagged “xss”
- Saṃhitā | संहिता
- Learn