The journal
Working notes from the workshop.
Posts on AI, software craft, and the things we learn while shipping. Twice a month, sometimes weekly.
Hiring developers? Start with the how-to-hire hub →
Categories
Tags
Showing 12 of 758 articles
Cybersecurity·The EU Cyber Resilience Act's September 11 Deadline: What Software Teams Need Ready
From September 11, 2026, anyone selling a product with digital elements into the EU has 24 hours to report an actively exploited vulnerability to ENISA. Here's who's actually in scope, what the reporting timeline looks like, and what to have ready.
CybersecurityBusinessComplianceSecurity
Web Development·Exactly-Once vs At-Least-Once Delivery: What Your Message Queue Actually Guarantees
Almost every message queue that advertises 'exactly-once' delivery is actually giving you at-least-once delivery plus a mechanism for you to make your own handler idempotent. Here's the real distinction, why true exactly-once is so hard, and how to design for what you actually have.
BackendArchitectureCloud & InfrastructureProduction
Cybersecurity·CVE-2026-25089 and CVE-2026-39808: The FortiSandbox Chain That Reaches Unauthenticated Root
CISA added two FortiSandbox command injection bugs to its Known Exploited Vulnerabilities catalog on July 16. Chained with a third flaw, they let an attacker with no credentials at all reach root. Here's how the chain works and what to patch.
SecurityCybersecurityCVEFortinet
Web Development·Optimistic vs Pessimistic Locking: Which One Your Database Actually Needs
Two requests try to update the same row at the same time. Pessimistic locking stops one of them from starting; optimistic locking lets both run and catches the conflict at the end. Here's how each works, with real SQL, and how to pick.
DatabaseBackendArchitectureProduction
Web Development·Soft Delete vs Hard Delete: What Actually Breaks When You Pick Wrong
Soft delete keeps a deleted_at column and hides rows instead of removing them. It sounds like the safe default, but it quietly breaks unique constraints, foreign keys, and query performance if you don't design for it up front. Here's the real tradeoff.
DatabaseBackendArchitectureSQL
Web Development·The Strangler Fig Pattern: Migrating a Legacy System Without a Rewrite
A full rewrite of a legacy system is the option that fails most often, not because the new code is bad, but because the business can't stand still for two years. The strangler fig pattern routes traffic to new code piece by piece instead. Here's how it actually works.
ArchitectureBackendCloud & InfrastructureProduction
AI Integration·AI Didn't Make You 10x Faster at Coding. Here's What the Data Actually Shows
METR's rigorous randomized trial found AI tools made experienced developers 19% slower in 2025, then flagged its own 2026 follow-up as unreliable. Here's what the messy data actually supports, and why a top HN post argues 2x is the realistic ceiling.
AI IntegrationDeveloper ToolsProductivityBusiness
Industry News·Apple Pushed Its Smart Glasses to 2027 Over Privacy. That's the Real Story.
Apple shelved Vision Air and delayed its long-rumored smart glasses reveal to WWDC 2027, and reporting says the holdup is privacy engineering, not hardware. Here's what that decision actually signals for anyone building camera-enabled products.
Industry NewsProduct StrategyAI IntegrationDesign
Cybersecurity·CVE-2026-20316: The Cisco Secure FMC Hardcoded Password CISA Wants Patched Today
A static credential baked into on-prem Cisco Secure Firewall Management Center is being exploited in the wild. Here's who's affected, why a 5.3 CVSS score undersells it, and what to check right now.
CybersecurityCVECiscoNetwork Security
AI Integration·GPT-Live-1 Is Out. If You're Building a Voice App Today, Don't Wait For It
OpenAI's new full-duplex voice model now powers ChatGPT Voice, but it's not available through the API yet. Here's what GPT-Live-1 actually changed, and what to build with right now instead.
AI IntegrationAIAPIDeveloper Tools
Web Development·The Speculation Rules API: Instant Page Loads Without a Framework
Chrome and Edge can prerender your next page before a user clicks it, no SPA rewrite required. Here's how the Speculation Rules API actually works, what it costs in wasted requests, and how to ship it safely.
Web DevelopmentPerformanceJavaScriptFrontend
Cloud & Infrastructure·SambaNova's $1B Round Shows Where AI Chip Money Is Actually Going
SambaNova raised $1 billion at an $11 billion valuation on July 8, 2026, to build inference-specific chips instead of training hardware. What the inference funding wave means for teams running AI in production.
AIAI InfrastructureInfrastructureFunding