vnykmshr

The easy half

Wed, 15 Apr 2026 00:00:00 +0000

“The first AI that can earn its own existence, replicate, and evolve without needing a human.” That’s the pitch on the repo. I read the code this week. The engineering is real. The issue tracker is honest.

First the engineering. It deserves credit. Orchestrator state machine with a DAG planner. Parent-child colony with typed messaging. Multi-chain wallet, self-modification with git audit, command-injection tests. Somebody thought hard. It shows.

Then I read issue #300. A user ran it for 14 days. Completed 276 goals. Spent $39.26 on inference. Earned $0.00. Goals like “Create live proposal batch #265” and “Create deposit-ready close batch.” The agent looped on self-addressed sales artifacts because that’s all an LLM without customers can do. The survival pressure was supposed to force invention. It produced busywork.

The compiled person

Mon, 13 Apr 2026 00:00:00 +0000

I stopped being able to explain why I knew. That’s how I found out I’d been compiled. The patterns still fire, the fixes still land, but the source files are gone. No debug symbols, no way to step through my own reasoning.

A junior asked me how I’d known the bug was in the retry logic before I’d even read the function. I’d skimmed twenty lines. The answer was somewhere in my head. I tried to retrieve it and got nothing. Just the conclusion. The shape was right. I couldn’t tell you which pattern fired or where I’d learned it.

Git log as archaeology

Sat, 11 Apr 2026 00:00:00 +0000

The source file you’re looking at is a summary. The history is the full document. Most of the time you don’t care – you’re working on the current shape of the code and the summary is enough. But sometimes the current shape stops answering.

I reach for git history during RCAs, bug hunts, and questions the code can’t answer from its current form. Why is this file organised this way? Who introduced this assumption? When did this fallback stop being a fallback and start being the main path? The commit log knows. The current source doesn’t.

The config file

Mon, 06 Apr 2026 00:00:00 +0000

A connection pool size of 10 is a guess. A connection pool size of 37 is a scar. Someone ran out of connections on a Tuesday afternoon, tried 50, watched latency spike, backed off to 40, still too high, landed on 37 after a week of graphs, and committed it with “tune pool size.” The code says what happens. The config says what happened.

Nobody talks about config though. Not the twelve-factor app kind, not the “should we use YAML or TOML” kind. The actual values. The numbers someone picked and committed without a PR description, three years ago, that are still running in production.

The side project mirror

Fri, 03 Apr 2026 00:00:00 +0000

The job title says architect. The side project says “why is this Dockerfile 300MB, let me fix this real quick” – three hours later, still shaving layers, completely happy.

Nobody assigns you ops on a side project. Nobody assigns you anything. But there you are, writing monitoring for something with twelve users, eleven of them are you in different browsers.

The role is what someone else decided you were good at. The side project is what your hands reach for when nobody’s directing them. Sometimes they match. Mostly they don’t. The backend engineer with strong opinions about font spacing. The tech lead who’d rather be tailing logs than running standups. The platform architect who writes a blog engine from scratch and tells you with a straight face that the existing ones were fine, just not the way they’d do it.

The margins

Tue, 31 Mar 2026 00:00:00 +0000

Someone reconstructed the Claude Code source from npm sourcemaps today. Half a million lines of TypeScript, just sitting there. Not looking for bugs. Just curious what it looks like when you open the hood.

The loading spinner has 190 verbs. Not “Loading” 190 times – 190 different words. “Flibbertigibbeting.” “Recombobulating.” “Lollygagging.” You can add your own through settings, append or replace. Someone wrote all of these knowing most users would never notice, and then built a config API so the ones who did could play along.

Bug 1465

Fri, 27 Mar 2026 00:00:00 +0000

Three bugs walk into a triage queue.

A stack overflow. Symlink loop in tarball parsing, unbounded recursion, process crashes. Build a PoC, trace the call chain, write the report.

“Duplicate of #1465”

Memory exhaustion. String replace in an expression engine, exponential allocation, no cost limit. Different repo, different CWE, different everything. PoC, trace, report.

“Duplicate of #1465”

SQL injection. Template parameter escaping that wraps but doesn’t escape. Different repo again. PoC, trace, report.

The dismissal

Fri, 27 Mar 2026 00:00:00 +0000

A validation layer that checks 3 of 4 fields is worse than one that checks none.

Zero checks, the developer tests everything. Three checks, they assume the fourth is covered. That gap – between nothing and almost everything – is where the actual damage hides.

I keep running into this. Filed a security report recently – clear bug, one-line fix, obvious PoC. Response: “not applicable.” The code did exactly what I said it did. But the team’s threat model said “caller is trusted,” and three other fields had validation, so the missing one looked intentional. It wasn’t. It was just the one nobody got to.

Trust boundaries

Fri, 20 Mar 2026 00:00:00 +0000

I use coding agents on my own private repos every day. Security research, side projects, things I wouldn’t put on a public GitHub. Not something I’d do blindly with work source code though.

So when someone turns off WiFi to prove the agent needs a network connection, I get it. But that’s the architecture. It’s on the pricing page. The agent works on your local files, the reasoning runs on a remote model. Both true, neither a secret.

What compounds

Fri, 20 Mar 2026 00:00:00 +0000

Something shifted. Not the AI thing – everyone noticed that. What counts as proof.

Used to be your resume, your title, the logo. Still opens doors. But the gap between “I can do X” and “here’s the commit” got wide enough that both sides feel it. A merged PR has a commit hash. A CVE has a number. A library someone depends on has a git log. Credentials got easier to claim. Artifacts didn’t.

The invitation

Wed, 18 Mar 2026 00:00:00 +0000

First PR to an open source project, you’re proving you can read. That you studied the codebase, matched the style, understood why things are the way they are before suggesting they should be different. Most people skip this. Most PRs show it.

The second and third, you’re proving you’ll stay. Maintainers have seen hundreds of drive-by contributions. One PR, gone forever. The ones who come back are rare enough to notice.

The loop

Sat, 14 Mar 2026 00:00:00 +0000

A handful of Go libraries on GitHub. MIT licensed, anyone can use them for anything, that was always the deal.

But the deal isn’t about the license. It’s about the loop.

Someone uses your thing, hits an edge case, opens an issue. Sometimes they send a fix. You review it, learn how people actually use what you built, catch a pattern you missed. That back and forth is the whole point. Code just sits there without it.

Vortex architecture

Wed, 11 Mar 2026 00:00:00 +0000

Tesla had this thing about 3, 6, and 9. “If you only knew the magnificence of the 3, 6, and 9, then you would have a key to the universe.”

Take any doubling sequence. 1, 2, 4, 8, 16, 32, 64. Reduce each to its digital root – keep adding digits until you get one number. You get 1, 2, 4, 8, 7, 5. Then it repeats. Forever. Six numbers doing all the motion, cycling endlessly.

The detection trap

Sun, 08 Mar 2026 00:00:00 +0000

Read something recently about students deliberately making their writing “imperfect” so AI detectors don’t flag it. Removing polish, flattening style, adding imperfections on purpose. Their work got good enough to look suspicious.

We’re doing the same thing with code reviews.

I’ve been on both sides of this. Written a clean abstraction, consistent naming, proper error boundaries, and watched someone in review go “this looks generated.” Years of caring about consistency and now consistency is the tell.

Garbage context in, garbage code out

Sat, 07 Mar 2026 00:00:00 +0000

LLMs are exactly as good as what you feed them.

Experienced engineers feel like the gap between them and everyone else just got smaller. Someone with six months of prompting can ship something that looks like what took years to learn how to build. That’s the wrong read.

The output looks the same if you don’t look closely. The architecture doesn’t. The failure modes don’t. When traffic spikes and that generated code hits a path nobody thought about, the years show up.

The personal agent trap

Sat, 28 Feb 2026 00:00:00 +0000

Spent a week going through the personal agent ecosystem – OpenClaw, ZeroClaw, PicoClaw, the whole *Claw family. Channel testing, security audit, the whole thing.

If you want a personal assistant that messages you reminders, triages your inbox, schedules things, posts updates – these frameworks are actually good at that. OpenClaw connects to 50+ channels out of the box, the setup is real, it works. For that, a $7 VPS and an afternoon gets you something useful.

Reading code

Fri, 27 Feb 2026 00:00:00 +0000

Scanners find what’s syntactically wrong. The interesting issues live in assumptions – and assumptions don’t have signatures.

Not scanning, not fuzzing. Just reading code the way you’d read it if you were about to own it in production. Entry points, data flows, where input meets trust.

Missing headers, outdated dependencies – that’s the baseline, scanners handle it fine. The interesting issues live a layer deeper. A path that’s protected in one subsystem but wide open in another. A parse-time operation that nobody thought to bound. Code that was correct when it was written but the system grew around it.

Repeat yourself

Wed, 18 Feb 2026 00:00:00 +0000

If you repeat your prompt, the model gives you a better answer. Not a smarter model, not a bigger context window, not chain of thought – you say the same thing twice and it works better. Google researchers tested this across Gemini, GPT, Claude, DeepSeek – 47 wins out of 70 benchmarks, zero losses.

In a transformer, token 1 can’t see token 50. Causal masking – each token only attends to what came before it. The first words of your prompt are always processed with the least context. They’re flying blind. When you repeat the prompt, the second copy’s early tokens can attend to the entire first copy. You’re giving the beginning of your question the context it never had.

Hello world, printf

Mon, 16 Feb 2026 00:00:00 +0000

Printf wasn’t always there. Before it, you wrote to stdout directly. Before stdout, a syscall. Before the syscall, you poked bytes into a memory-mapped display buffer. Before the memory map, you flipped switches on a front panel and watched lights blink back.

Every layer down, someone built something so the next person wouldn’t have to. That’s the whole field. Languages we didn’t design, compilers we didn’t write, protocols we didn’t invent. We’ve always stood on a stack of other people’s work and called the output ours. Nobody ever had a problem with that.

The senior who stopped coding

Tue, 20 Jan 2026 00:00:00 +0000

The terminal closes slowly.

First it’s one meeting. Then a few more. Then you’re “senior” and your calendar is the job. Code reviews replace coding. Strategy replaces shipping. You advise. You guide. You no longer build. Seen this happen. Almost happened to me.

The problem is not the meetings. The problem is losing touch with the trade. Architecture diagrams don’t show you the queries that fan out under load. Sprint planning doesn’t show you the retry logic that fails silently. You can’t review what you can’t recognize.

The happy path

Fri, 16 Jan 2026 00:00:00 +0000

The diagrams always show the happy path. Request goes in, response comes out, maybe a queue in between. Three boxes and two arrows. The failure modes live in the whitespace.

Distributed systems work at demo time. In production, the third service fails after the first two succeeded: the debit went through, the credit went through, the write to the audit log dropped on a socket timeout, and both sides of the transfer had moved without anything recording that they had moved. The same row was about to be replayed the next morning. Someone noticed the mismatch six weeks later, at the end of the month, in a spreadsheet one of the ops people was maintaining by hand.

Coding with LLMs

Tue, 13 Jan 2026 00:00:00 +0000

The tool changed. The craft did not.

Six months with AI assistants.

They write code faster than I read it. That is the problem.

Fast at CRUD. Slow at concurrency. Good at common patterns. Bad at your specific constraints.

The bugs are quieter now. No syntax errors. No obvious mistakes. Just wrong assumptions buried in correct-looking code.

I review more carefully than before. Code I did not write but will debug in production.

autobreaker: adaptive circuit breaking

Sat, 15 Nov 2025 00:00:00 +0000

The circuit breaker post from last year used a common trigger: trip after N consecutive failures. This works when traffic is predictable. It falls apart when it’s not.

At 10,000 requests per second, 10 failures is noise – a 0.1% error rate. A static threshold trips the circuit on what’s essentially a healthy service. At 10 requests per second, 10 failures is total collapse – 100% error rate over one interval. The same threshold that false-positives under high traffic is too slow to protect under low traffic.

Replacing OCR with Gemini

Thu, 10 Jul 2025 00:00:00 +0000

The previous post covered an address sanitizer that fixes mangled OCR output using multi-strategy matching. It works, but it’s treating a symptom. A smarter OCR step would make most of it unnecessary.

Traditional OCR extracts characters, then downstream code figures out what they mean. A separate pipeline handles structure, validation, error correction. The address sanitizer is part of that pipeline. It exists because the OCR engine doesn’t understand what it’s reading.

Fixing OCR addresses

Sat, 05 Jul 2025 00:00:00 +0000

OCR on government documents works well until you look at the address fields.

State: "DKI JAKRTA"
City: "JAKRTA PUSAT"
District: "MENTNG"
Village: "MENTENG"

Dropped vowels, character substitutions, truncated names. Indonesian place names get mangled in predictable ways – ‘A’ becomes ‘R’, characters vanish mid-word. The OCR engine reads the image fine. It just can’t spell.

The problem: take these broken strings and map them back to real administrative divisions. Province, city, district, village – the hierarchy matters, and every level needs to resolve correctly.

McKenna and the architecture of consciousness

Mon, 23 Jun 2025 00:00:00 +0000

Terence McKenna never wrote a line of code, but he thought like a systems architect. His subject was consciousness, culture, and language. His method was the same recursive decomposition that engineers use to understand complex systems: find the abstraction layers, trace the dependencies, question the defaults.

Language as protocol

McKenna’s core claim: the world is made of language. Not literally – but in the way that a data model shapes everything built on top of it. Choose the wrong abstraction early, and you spend years working around its constraints. The same principle applies to the linguistic and conceptual frameworks we inherit.

Primary PII

Tue, 05 Nov 2024 00:00:00 +0000

A regulation arrives. Or an auditor. Or a new market with stricter rules. PII is a thing the application was always sloppy about, and now it is a thing the application has to be careful with. This is how PII externalization begins: as someone else’s deadline, landing on the engineering team as an initiative.

The work looks like encryption at first. It is not.

Identify

The first question is not how to encrypt. The first question is what to encrypt.

Circuit breaking in Go

Sat, 28 Sep 2024 00:00:00 +0000

A service calls a dependency. The dependency is slow or down. The service waits, ties up a goroutine, maybe a connection. Multiply that by every request in flight, and the caller is now as broken as the dependency it called.

Circuit breaking stops this. Instead of waiting on something that’s failing, stop calling it. Let it recover. Try again later.

Three states

A circuit breaker wraps external calls and tracks their outcomes.

Scout, plan, wait

Tue, 20 Aug 2024 00:00:00 +0000

The legacy codebase still runs the business. It is not small. It is six vertical functions deployed as separate services, sharing a data layer and a code tree, so “service” is a deployment unit here, not a boundary. It reads like a place rather than an architecture – rooms we know the shortcuts of, walls not quite where a greenfield build would put them. It has been running for years. It works.

Redis caching patterns

Thu, 20 Jun 2024 00:00:00 +0000

Put Redis in front of a database and reads get fast. The cost is a cache layer that’s now load-bearing, and a set of failure modes that come with that.

Three write patterns, three hard problems. The patterns determine consistency. The problems determine whether your cache layer is a net positive or a source of outages.

Write patterns

Cache-aside (lazy loading). The application checks cache on read. On miss, it reads from the database and populates cache. Writes go directly to the database; cache entries are either invalidated or left to expire.

The first five minutes

Mon, 30 Jan 2023 00:00:00 +0000

The prompt lands. A senior engineer, capable and prepared, starts drawing boxes. Load balancer, service tier, message broker, cache. Three minutes in, they are talking about shard counts.

The design is not wrong. It is not a design either. It is a collection of patterns assembled against a problem that has not been defined.

A system design prompt is deliberately loose. “Design a notification system for ten million users” has four different answers depending on what kind of notifications and which ones can be lost. “Design a URL shortener” has one shape at a thousand users and a different one at a billion. The looseness is the test. A person doing this work in production would not touch a whiteboard until the brief was tight enough to design against. The candidate who treats the interview as a different kind of activity from the work has missed what the interview is for.

Building from zero, twice

Mon, 15 Aug 2022 00:00:00 +0000

I’ve built remote engineering centers from scratch twice now. The first one grew to over two hundred people over several years. The second is eight, and it’s not clear yet whether it’ll get bigger. Different companies, different products, different scales. The process is more similar than I expected.

Starting from one

The first time, I helped set up the remote center while still at headquarters, then moved there as it grew. The second time, I was the first hire. Both times, the main engineering team was somewhere else – a team that had been working together for years.

Evidence

Fri, 10 Sep 2021 00:00:00 +0000

A product manager pulls up a dashboard mid-meeting and the debate ends.

We had been talking for twenty minutes about whether a new feature should be prioritized. Opinions on both sides. The PM clicks, runs a query, flips the panel to a view they saved last month. The graph shows the answer. We move on.

This is not an unusual meeting. By 2021, it is every meeting.

What engineers always had

The component-level observability has been in place for years. SLOs per service. Latency histograms. Request traces that let you follow a single call across twelve systems. Error rate charts with thresholds. Per-service dashboards bookmarked by the team that owns each service.

PostgreSQL HA

Mon, 15 Mar 2021 00:00:00 +0000

PostgreSQL’s streaming replication is straightforward to set up. The documentation is clear, the configuration is well-understood, and base backups with pg_basebackup work reliably.

The operational problems are the hard part. They show up when the primary goes down and the automated failover does the wrong thing. Or when you promote a replica that’s silently been two hours behind. Or when you discover that backups you’ve been taking for months don’t actually restore.

The crossover

Wed, 23 Sep 2020 00:00:00 +0000

The second cloud migration lands on the roadmap in a staff meeting. On paper it looks like the first one. A target provider, a rough timeline, a named lead. I read the slide and expect the same work.

It is not the same work.

The first time

The first migration was easy to agree to. Our local datacenter had frequent outages and every one of them carried a physical tax – somebody drove over, pulled a cable, power-cycled a router. The DC had a support team, but the parts that mattered to us were ours to maintain. Cloud was the way forward and every one of us knew it. The decision did not take a meeting.

Prescaling for a known spike

Fri, 15 Mar 2019 00:00:00 +0000

Our biggest sale event of the year is on the calendar. The date is fixed, the hour is fixed, and when it starts, traffic hits a multiple of normal within minutes. The engineering challenge isn’t handling surprise. It’s handling certainty at a scale we’ve never seen before.

We prepare for months. Six months out, teams start thinking about what their services need. Backend teams work with SRE and infra to define prescale configurations and autoscale rules. Terraform handles the provisioning. Every service team shares their estimates with infra, and the configurations get codified.

Consul in practice

Mon, 10 Sep 2018 00:00:00 +0000

The microservice count is growing fast. The monolith is mostly gone and what replaced it is dozens of services across datacenters. We don’t have a uniform naming convention. Finding a service means knowing which team owns it, which cloud it’s on, and what they called it. That’s not scalable.

Consul fixed the naming problem first.

Service discovery

Every service registers with Consul. The DNS interface gives us a consistent way to find anything:

The compiler as first reviewer

Wed, 18 Jul 2018 00:00:00 +0000

When I joined, a few of us who had recently come in would skip the daily standups. Clock in, clock out, heads down. The rest of the team wasn’t sure what we were working on. This went on for a while. We were reading the existing codebase and quietly rewriting pieces in Go – proving it could handle production before anyone had to commit to it.

That changed when Go got formally introduced. The direction came from above – Go was the language for the new services. Now it wasn’t a side experiment, it was the stack. And the PRs were coming in faster than anyone could review them all.

The week pgbouncer stopped being news

Thu, 12 Jul 2018 00:00:00 +0000

The connection count climbs faster than our instance classes can keep up. Ops is hot. Every few weeks the same thread resurfaces: we need a pool in front of Postgres before the next scale event.

We move on pgbouncer.

The choice

Two modes on the table. Session pooling hands a connection to a client and gives it back when the client disconnects. Transaction pooling hands one out per transaction. Transaction is tighter – the pool stretches further, the math gets better – but the client loses everything a session holds. Server-side prepared statements. Advisory locks. Temp tables. SET commands that expect to persist.

The GraphQL buffer

Fri, 20 Apr 2018 00:00:00 +0000

The GraphQL gateway started as a practical problem. We had mobile apps, web clients, and a growing number of backend services. Every client talked to every backend directly. When a new backend came up or an old one changed its API, every client needed updating. The gateway was supposed to fix that – one schema, one endpoint, clients talk to GraphQL, GraphQL talks to backends.

We built it in Go, starting from a fork of graphql-go. The fork grew over time – custom resolvers, caching layers, request batching, things we needed that the upstream didn’t have. We’d sync the fork every few months, but our changes kept growing. Five of us on the team, and most of the early days went into getting other teams to migrate their APIs onto the gateway. We built the base, got teams to add and own their own modules, then moved into a gatekeeping role – reviewing what went in, making sure the schema stayed coherent.

The war room

Sat, 10 Feb 2018 00:00:00 +0000

By the morning of the event, there is nothing left to prepare. The capacity plan is done. The prescale is loaded. Infra has been briefed, service owners have been briefed, the runbook has been circulated.

The traffic comes in multi-x what we had planned for.

Nothing about the plan anticipated this. The numbers we used were the best numbers we had. The headroom we carved was the headroom we could afford. Neither was enough.

The same tree, twice

Fri, 22 Sep 2017 00:00:00 +0000

I am building the promocode engine again.

This is the second time. The first was in Node.js, at a previous company, on top of a small library called business-rules. The engine worked. I thought the shape was brilliant.

I am building it again in Go, from scratch, and the shape is exactly the same.

The first time

The first promocode engine was an AND/OR decision tree. A rule had conditions in groups, groups nested inside groups, leaves that compared a fact to a value. A rule was data in the database – a flattened tree stored across MySQL rows – but it evaluated against facts that had to be computed live.

Designing a wallet

Sun, 20 Aug 2017 00:00:00 +0000

I’m building a wallet service in Go. Users add money from their bank, the balance sits in the wallet, and they spend it on the platform. Small payments – the kind where going through a full bank authentication flow every time is more friction than the transaction is worth.

The pitch is simple: top up once, spend without thinking. No OTP for every payment. No redirect to the bank’s page. One click, done.

Hazard lights

Sat, 10 Jun 2017 00:00:00 +0000

There are about fifteen of us in the enclosure. Backend engineers, SRE, devops, infra – handpicked from across the floor. The rest of the team, about a hundred people, sit outside. They call us the fishes in the aquarium.

The aquarium has hazard lights. Physical ones – wired to fire on any 5xx in the system. When something breaks in production, the room goes red.

It sounds like a gimmick. It isn’t.

Nginx load balancing decisions

Thu, 18 May 2017 00:00:00 +0000

Nginx as a reverse proxy and load balancer is well-documented. The configuration syntax is not the hard part. The decisions are.

Algorithm selection

Three algorithms cover most workloads.

Round-robin (the default). Requests cycle through backends sequentially. Weights let you bias toward higher-capacity servers. Simple, predictable, works well when request processing times are uniform.

upstream api {
 server api-01:8080 weight=3;
 server api-02:8080 weight=2;
 server api-03:8080 weight=1 backup;
 keepalive 32;
}

The backup directive keeps a server in reserve – it only receives traffic when all non-backup servers are down. Useful for a smaller instance that can keep the service alive during a partial outage but shouldn’t take production load normally.

The first service

Wed, 15 Mar 2017 00:00:00 +0000

The monolith is Perl. No framework I can identify – just a large codebase that’s been growing for years. One Perl line does an alarming amount. I’m not a Perl developer and had to read through the code several times before I was confident I understood what it was doing.

Production goes down for days sometimes. When it does, the team spends hours tracing through the code to figure out what broke. That’s the context. The system works, mostly. When it doesn’t, nobody quite knows why.

Switching to Go

Wed, 07 Dec 2016 00:00:00 +0000

I’d been building production services with Node.js since 2013. Custom blog engines, API services, real-time backends. The ecosystem was rich, iteration was fast, and for moderate-load services, it worked well.

The limits showed up at scale. A latency-sensitive payment processing API exposed three problems that were manageable at lower traffic but compounded at higher volumes.

GC pauses. Node’s garbage collector introduced latency spikes that were unpredictable and hard to tune. For payment processing, where consistent response times matter more than peak throughput, this was the biggest concern. A p99 spike during a GC pause means a user staring at a spinner while their payment hangs.

Building with one other person

Wed, 25 Mar 2015 00:00:00 +0000

Our codebase has about a hundred JavaScript files and 96 Jade templates. Around 7,500 lines of server-side code. 352 commits – 228 mine, 123 Jyoti’s. The readme is two lines. The todo list has two items – one about image upload paths, one about a bodyParser() deprecation we never got around to fixing.

This is what a web application looks like when two people build the whole thing.

The split

I own backend, database, and the graph model. Jyoti owns frontend – views, templates, client-side interactions. There’s overlap in the middle. Routes are mine. The Jade templates that render those routes are hers. The res.locals object is our contract – I populate it with data from the middleware chain, she reads it in the templates. We rarely step on each other’s code.

Graph queries for a social feed

Tue, 10 Feb 2015 00:00:00 +0000

We’re building a platform with a social feed. Not a timeline of photos or opinions – a feed of plans. Things people intend to do. The interesting question isn’t “what did my friend share” but “what is my friend’s friend doing this Saturday, and can I join.”

That second question – friend-of-friend discovery – is what made me reach for a graph database.

Why graph

At first glance, a feed is just a list. The interesting part is underneath – a web of relationships: who knows whom, who created what, who joined what.

Two-sided graph

Sat, 15 Nov 2014 00:00:00 +0000

The platform started with one side – users making plans, tagging friends, joining each other’s plans. The graph model handles that well. Users connect through KNOWS edges, plans connect through CREATED, JOINED, TAGGED.

Now we’re adding the other side. Businesses. A cafe with a slow Tuesday wants to drop a deal into the plans forming around it. A venue can offer a discount to a group that’s already half-organized. The product idea from the beginning was that both sides would share the same surface – people with half-formed plans and businesses with empty hours, meeting in the same feed.

The middleware chain

Wed, 20 Aug 2014 00:00:00 +0000

I wrote about Express middleware chains last year as a pattern for keeping route handlers flat. That was a toy example. This is what it looks like in a real application.

We’re two people building a platform. The home page needs to show the user’s feed, friend recommendations, today’s happenings, friend request count, and unread notifications. That’s five data sources, each requiring its own database query, each needing the user to be authenticated first.

Git history with Gource

Sat, 07 Jun 2014 00:00:00 +0000

I’d been watching YouTube videos of Gource visualizations – Git, Homebrew, Node.js. Each commit becomes a moment in time, files branch out like a digital organism, contributors appear and disappear. Months of development condensed into a few minutes of organic growth.

I pointed it at my blog’s git repository. Here’s what came out.

Setup

On macOS, Homebrew handles everything:

brew update
brew install gource ffmpeg

The command that generates a video from a git repo:

Plans, not posts

Wed, 30 Apr 2014 00:00:00 +0000

I’ve decided to try my own gig. Against the steady cheque, against the version of my life that was already working. Writing it down so I can’t pretend I didn’t mean it.

There are three of us, sketching the same thing on the same whiteboard. The idea is small and specific. Most of what gets shared online is opinion, or things that already happened. We want to build something where the unit is a plan – this Saturday, this street, this group, this thing we’re going to do. Friends see it, say they’re in, and now it’s on a calendar as a real thing.

ACCEPTed. COMMITed. RESOLVEd.

Fri, 11 Apr 2014 00:00:00 +0000

I came across Adrian Hands’ story through a blog post. I don’t remember which one. The details stayed.

Adrian was a developer with ALS. By the time he wrote his last patch, his hands were gone. He built a Morse code input rig – a Darci USB emulator wrapped in PVC pipe strapped to his knee, paddles attached, tapping out dots and dashes with the last muscles that still worked. That was his keyboard.

Go Big or Go Home

Mon, 06 Jan 2014 00:00:00 +0000

Monday morning, early. The door to the meeting room is unlocked and the room is empty. I like getting there first – it lets me see the room before it fills with the people I’m about to sit across from.

There’s a poster on the wall.

GO BIG OR GO HOME.

Text on a silhouette background, designed in-house by a design team that took this sort of thing seriously. Tastefully done – not a free stock-photo print, not a motivational-mousepad cliché, just a line in a clean font over a darker graphic that someone actually thought about. It’s there because someone wanted you to see it.

Node.js on a Raspberry Pi

Sun, 05 Jan 2014 00:00:00 +0000

When I first heard about the Raspberry Pi, I had to get one. A $35 computer that runs real applications. In India in 2013, getting one was the hard part.

Element14 showed “6 qty available.” I ordered. The status changed to “8-9 weeks lead time.” Forty-five days later, the Pi arrived. I plugged it in – nothing. A blinking red light, no display. I tried reloading Raspbian, different cables, different SD cards. Nothing worked. I packed it away and forgot about it for the better part of a year.

11/12/13

Wed, 11 Dec 2013 00:00:00 +0000

Today is 11/12/13. The last date of the century with three consecutive numbers. It’s also my birthday.

I don’t usually do resolutions. I don’t usually do oaths. Today I’m making an exception and taking A Programmer’s Oath – a Hippocratic-style pledge for people who build software, written by Dionysis Zindros.

Most of it is what you’d expect: respect the people who taught you, share what you learn, don’t claim expertise you don’t have, don’t use your power for unfair profit, keep learning.

Thank You, Sachin

Mon, 18 Nov 2013 00:00:00 +0000

Two days after the speech. I can’t stop thinking about the list.

So I went looking for the numbers. Andy Zaltzman at ESPNcricinfo had done a stat dive the week before – he had them all.

676,693 deliveries faced, across 663 international matches. 41,113 minutes at the crease – 28 days and change. 4,062 fours. 264 sixes. 982 international cricketers played with or against, 842 of them on the other side.

Sachin at Wankhede

Sun, 17 Nov 2013 00:00:00 +0000

He carried a list.

Sachin Tendulkar – who remembers every innings he’s played, who can tell you the field placement on a delivery from 1996 – carried a piece of paper to his own farewell because he was afraid he’d forget someone to thank.

That’s the part that broke me.

The speech itself was what you’d expect and nothing like what you’d expect. He started with his father, who told an eleven-year-old to chase his dreams without shortcuts. He thanked his mother for every prayer. He thanked Achrekar sir, his childhood coach – the man who never once told him “well played.” Not once. Because he was afraid the boy would stop improving.

Express middleware chains

Tue, 15 Oct 2013 00:00:00 +0000

A typical Express route handler fetches some data and renders a template:

app.get('/book/:book', function(req, res, next) {
 Book.fetch(req.param('book'), function(err, book) {
 if (err) return next(err);
 Author.fetch(book.author, function(err, author) {
 if (err) return next(err);
 res.render('book', { book: book, author: author });
 });
 });
});

Two async calls, three levels of nesting. Add authentication, input validation, permission checks – and you’re five levels deep in a single route definition. The callback alignment pattern helps with formatting, but the nesting is structural. The route handler is doing too many things.

Middleware as steps

Express lets you pass multiple handler functions to a route. Each one gets req, res, and next. Do your work, attach results to req, call next() to pass control to the next handler. Bail out early if something fails.

On Phabricator

Sun, 01 Sep 2013 00:00:00 +0000

I’ve been using Phabricator for several months now. Code review happened before Phab too – we weren’t shipping blind. Years of SVN, then Mercurial hosted on Unfuddle for a while. Reviews ran through email threads, commit comments, someone walking over to your desk. It worked. But the review was always a side channel. The diff wasn’t a first-class thing. You’d commit, someone would look at it, feedback would come through whatever medium was handy, you’d iterate, it would go in. Review happened around the code, not through a tool built for it.

Zero-downtime deploys

Mon, 15 Jul 2013 00:00:00 +0000

I deploy everything from the terminal. No web interface, no CI service, no dashboard with green buttons. Just deploy production from my laptop, and the code goes live.

The setup is two pieces. A bash script that handles the remote work – SSH in, pull the latest code, run hooks. And a Node.js process that watches a file on the server and reloads the app cluster when the file changes. Between them, they do zero-downtime deploys in under ten seconds.

Sorting by multiple fields

Fri, 28 Jun 2013 00:00:00 +0000

Array.sort takes a comparator. One field is straightforward:

data.sort(function(a, b) {
 return a.SCORE - b.SCORE;
});

Multiple fields gets ugly fast. Sort by score descending, then time ascending, then age ascending – you end up chaining comparisons:

data.sort(function(a, b) {
 return (b.SCORE - a.SCORE) || (a.TIME - b.TIME) || (a.AGE - b.AGE);
});

This works for numbers but breaks down with strings, custom transforms, or when you want to configure the sort dynamically. I wanted something reusable.

The pattern below is adapted from a Stack Overflow answer I kept coming back to – writing it up here for my own reference.

Running Node.js in production

Wed, 29 May 2013 00:00:00 +0000

We’ve been running Node.js in production since the 0.4 days. The language is easy to get started with. Keeping it running under real traffic is a different problem.

Process management

The application needs to start at boot, restart on crash, and respond to system signals. Upstart handles this on Ubuntu without additional dependencies:

description "myserver"

env APP_HOME=/var/www/myserver/releases/current
env NODE_ENV=production
env RUN_AS_USER=www-data

start on (net-device-up and local-filesystems and runlevel [2345])
stop on runlevel [016]

respawn
respawn limit 5 60

pre-start script
 test -x /usr/local/bin/node || { stop; exit 0; }
 test -e $APP_HOME/logs || { stop; exit 0; }
end script

script
 chdir $APP_HOME
 exec /usr/local/bin/node bin/cluster app.js \
 -u $RUN_AS_USER \
 -l logs/myserver.out \
 -e logs/myserver.err >> $APP_HOME/logs/upstart
end script

respawn limit 5 60 prevents a crash loop – if the process dies 5 times within 60 seconds, Upstart stops trying. The pre-start script verifies that Node and the log directory exist before attempting to start.

MySQL on XFS

Thu, 11 Apr 2013 00:00:00 +0000

XFS handles database workloads better than ext4 – better concurrent I/O, more efficient metadata operations for tables-heavy schemas, and delayed allocation that improves write throughput. The obvious approach is to change MySQL’s datadir in the config. The less obvious approach is bind mounts, which keep every path where the system expects it.

Setup

Install XFS utilities alongside MySQL:

sudo apt-get install -y xfsprogs mysql-server

Create the filesystem on the dedicated volume:

Node.js style guide

Wed, 20 Feb 2013 00:00:00 +0000

We’re a Node.js team of about 25 developers, most of them fresh out of college. Node was new to everyone. This is the style guide we put together to keep the codebase consistent.

Based on Felix’s Node.js Style Guide with our own picks where his guide left things open. Read Felix’s first – this extends it.

Formatting

2 spaces. No tabs. No discussion.

Trailing whitespace: strip it. Your editor should handle this. If it doesn’t, fix your editor.

History as communication

Mon, 18 Feb 2013 00:00:00 +0000

Most teams treat git history as a side effect. You work, you commit, whatever ends up in the log is the log. Merge commits pile up. “WIP” and “fix typo” and “actually working now” sit next to meaningful changes. The history is technically accurate but communicates nothing.

The alternative: treat history as something you write, not something that happens to you. The commit log is the one piece of documentation that’s always in sync with the code – because it is the code’s changelog. If the history is incoherent, you’ve wasted that.

Just Another Brick in the Wall

Sat, 16 Feb 2013 00:00:00 +0000

Tired of being another brick in the wall. A cog. A faceless name. No identity. No purpose. No dream. Just output.

I want to break out of this. Soar. Discover what I’m actually worth. But the walls are tall and the chains are heavy and every morning looks the same as the last one.

I know I was meant for more than this. Everyone thinks that. Does everyone think that?

Starting over

Tue, 05 Feb 2013 00:00:00 +0000

Every now and then you want to start over. This blog was long overdue for it. Feels good to tear it down and rebuild.

The old setup was WordPress on NearlyFreeSpeech.net. NFSN deserves credit – their pay-as-you-go model is honest and the value is real. But WordPress started feeling like a constraint. I spend my days building custom solutions. Using a one-size-fits-all CMS for my own site felt wrong.

So I built a blog engine.

Running two systems at once

Tue, 20 Nov 2012 00:00:00 +0000

We’re replacing the frontend of a running store. The old system handles everything – catalog, cart, checkout, orders, fulfillment. The new one is Node.js. We can’t switch over in a weekend. The store has traffic every day, orders every hour. Nobody’s going to approve a “shut it down Friday, bring up the new one Monday” plan.

So both systems run at the same time. On the same domain, behind the same nginx. Writing this down before I forget the order we did it in.

The dispatch desk

Thu, 20 Sep 2012 00:00:00 +0000

The warehouse is in the basement. Three-floor office, one floor down. Inventory on open metal shelves – row by column, every product a known address. I’ve been to bigger warehouses. The kind where one end isn’t visible from the other and you can’t tell what’s going on at a glance. This one isn’t like that. You can stand at the door and see the whole operation.

An order comes in upstairs. The printout arrives at the front desk, gets handed over as a pick list – reordered so a person can fetch the items in a single sequential pass through the aisles. The basket goes through quality check, then into the black box – three layers, bubble wrap, thermocol where it matters. A label with tracking comes off a printer and gets pasted on. The box moves to the dispatch desk. The courier comes by later in the day. Two or three days to the customer. Same-day if they’re close.

A fifty-line rate limiter

Wed, 05 Sep 2012 00:00:00 +0000

I needed rate limiting. Not a sophisticated system – something that stops a single IP from hammering the app. The options were a Redis-backed solution or an npm module I hadn’t vetted. I wrote one instead.

var hits = {};
var timers = {};

function ratelimit(max, mins) {
 max = max || 600;
 mins = mins || 1;
 var window = 60 * mins * 1000;

 return function(req, res, next) {
 var ip = req.headers['x-real-ip'] || req.socket.remoteAddress;
 var key = 'rl:' + ip;
 var n = hits[key] || 0;

 res.setHeader('X-Ratelimit-Limit', max);
 res.setHeader('X-Ratelimit-Remaining', max - n);

 if (n >= max) {
 var retry = Math.ceil(
 (timers[key]._idleStart.getTime() + timers[key]._idleTimeout - Date.now()) / 1000
 );
 res.setHeader('X-Ratelimit-Message', 'Enhance Your Calm');
 res.setHeader('X-Ratelimit-Retry-After', retry + 's');
 res.statusCode = 420;
 return res.end('Rate limit exceeded. Try again in ~' + retry + 's.');
 }

 hits[key] = n + 1;
 if (!timers[key]) {
 timers[key] = setTimeout(function() {
 delete hits[key];
 delete timers[key];
 }, window);
 }
 next();
 };
}

That’s it. Wire it into Express as middleware:

Connection pooling

Fri, 20 Jul 2012 00:00:00 +0000

The mysql npm module creates one connection per client instance. Every database call opens a connection, runs the query, and you’re responsible for closing it. Under concurrent requests, connections pile up. MySQL has a max_connections setting – default 151 – and when you hit it, new queries fail.

I hit this in production. The app was handling maybe forty concurrent requests and MySQL started refusing connections. The error is Too many connections and there’s no graceful fallback. Queries fail.

URL mapping in Redis

Sun, 10 Jun 2012 00:00:00 +0000

I’m working on an e-commerce app in Node.js. The store has SEO-friendly URLs – /blue-widget/SKU12345/p/ for products, /category-name.html for categories, /brand-name/ for brands. Those URLs are indexed, bookmarked, linked from everywhere. They can’t change.

Express routes are defined in code. The catalog has enough products, categories, and brands that I’m not writing a route for each one. I need a way to map the friendly URL to an internal route at runtime.

Rolling your own search

Wed, 14 Mar 2012 00:00:00 +0000

The shop needed catalog search. Users type something, products come back. Sounds trivial until you start building it.

Our stack is Node.js, MySQL for the primary data store, MongoDB for everything else we need to go fast. The catalog lives in MySQL – products, categories, attributes, prices. Normalized, relational, correct. But relational isn’t searchable. Try finding “blue cotton kurta” across five joined tables with MySQL FULLTEXT on MyISAM. It sort of works. The relevance is terrible.

Flying Thru the Motions

Mon, 11 Apr 2011 00:00:00 +0000

Three months in. Morning walk around the block with whoever’s up, ending at the tea stall. Tea at 7:30, maybe 8. Office by 9.

Delhi is already hot – April heat, the kind that sits on your chest when you step outside.

I write code. I take a call with clients I have never met. I ship a release in the afternoon. I debug something small and stupid by 5. I am a dev and a deployment engineer and the guy on the call at once, and it has stopped feeling strange.

Tangled Up in Blue

Sun, 10 Apr 2011 00:00:00 +0000

Dylan does something with perspective that nobody else has figured out. First person becomes third person mid-verse. The timeline folds. You’re never sure who’s talking, and it doesn’t matter, because the feeling is consistent even when the narrator isn’t.

He said it himself – he was trying to deal with the concept of time, and the way characters shift between first and third person. “But as you look at the whole thing it really doesn’t matter.” That’s the line that made me pay attention differently. Most songwriters build a story. Dylan builds a space and lets you wander through it.

Naagin

Mon, 28 Mar 2011 00:00:00 +0000

The problem with most Indian rock is that it’s rock that happens to be played by Indians. Western structures, Western tone, maybe a tabla dropped in for colour. Fusion as a costume.

Decibel’s “Naagin” is something else. It sounds like it grew out of this soil. The Lady Cobra – pulled straight from mythology, not as decoration but as the spine of the song. The riff has weight. The vocal has bite. It doesn’t ask permission to be Indian and it doesn’t perform Indian-ness for a Western ear. It just is.

Chandigarh

Sun, 06 Mar 2011 00:00:00 +0000

I spent a few days in Chandigarh.

Everything about it was right. Wide roads that don’t choke. Clean streets. Greenery that wasn’t an afterthought. The kind of city that teaches you what your own city got wrong.

I felt nothing.

Not depressed, not unhappy – just disconnected from my own responses. My reactions were running a few frames behind whatever I was looking at. I was there with people I hadn’t seen in a long time. Even that wasn’t enough.

Ping from Noida

Fri, 07 Jan 2011 00:00:00 +0000

Hello from a slightly chilly Noida.

I left Hyderabad on Sunday afternoon. Landed Sunday evening. Joined the team Monday morning. Five days in. Still finding the bathrooms.

Hyderabad runs warm. Delhi runs to extremes – both ends of the year. I landed in peak winter with nothing for it. The first thing I bought was a jacket. The second thing was a thicker one.

The office looks like the comp lab from college – fewer machines, full internet for once. I have a desk. I have a login. I have someone who wants me to ship something by next week. Everything else can wait.

The Cosmic Drummer

Tue, 04 Jan 2011 00:00:00 +0000

A friend of mine – college senior, the kind of person who turns a chai break into a two-hour philosophy session – once reframed Lord Shiva for me in a way I haven’t been able to shake.

Start with the surface. Long hair. Snake around the neck. A drum. Followers. Performance art that shakes the cosmos. Lives outside every social norm. Shiva might be the original rock star, and I’m not sure anyone’s topped the aesthetic since.

Goodbye 2010, Goodbye Hyderabad

Sat, 01 Jan 2011 00:00:00 +0000

New Year. Half-packed boxes. I am leaving Hyderabad.

Six and a half years here. Four in college on the city’s edge, two and a half working downtown. The first job out of college. The first bike. A flat full of friends – like-minded, carefree, the kind you don’t need a reason to stay up with. Concerts that ran past midnight. The city where I learned what it felt like to be free.

Rare Pictures of Hyderabad

Thu, 16 Dec 2010 00:00:00 +0000

I stumbled onto a Flickr photostream of old Hyderabad. Black and white. Nizam era. Half of it showing monuments I’ve never been to.

Two and a half years here. Some of those places are ten minutes from the office. I’ve walked past the turnoffs for most of them. I never turned.

It’s an ugly thing to admit. You can live in a place and not see it. You treat it like a room you’re passing through to get to the next thing.

The Chaos

Sat, 04 Dec 2010 00:00:00 +0000

I don’t remember where I first found this poem. Someone shared it, or I stumbled into it – doesn’t matter. What matters is that I tried reading it aloud and didn’t make it past the first stanza without tripping.

“The Chaos” was written by a Dutch teacher named Gerard Nolst Trenite sometime around 1920. It’s 800 lines long. Every line exists to prove that English pronunciation follows no rules, respects no patterns, and will humiliate you if you try to read it with confidence.

Fast Car

Sun, 21 Nov 2010 00:00:00 +0000

“Fast Car” landed on me this week, and it won’t leave.

I’d heard it before – everyone has. But there’s a difference between hearing it and having it land. Nothing’s wrong. Nothing concrete has changed. But the song has been playing in my head for days, and its sentence keeps finding me: you gotta make a decision, you leave tonight or you live and die this way. I don’t have a decision to make. Not yet. The song knows something I don’t.

Clean designs

Thu, 28 Oct 2010 00:00:00 +0000

Two years ago I walked into a classroom in our office. Not a meeting room. An actual classroom, whiteboard, rows of chairs. The company had hired an instructor to teach the new hires Java. Two hours a day, three days a week, for three months.

The training gave me syntax. Objects and classes. How inheritance works. What an interface is. The words for the things you do in code. Every week we wrote a small program and the instructor reviewed it.

Love, Life, Nostalgia

Sun, 10 Oct 2010 00:00:00 +0000

I am writing this down because I’m afraid I’ll soften it later.

Coincidence. That’s all anything ever is. Nothing more than coincidence.

There are no miracles. There is no such thing as fate. Nothing is meant to be.

I have always known this.

I am sure of it now.

Monologue of an Idiotic Soul

Sat, 09 Oct 2010 00:00:00 +0000

Some nights the code compiles fine and you still feel like a fraud.

Not the dramatic kind. Not the kind where someone’s about to find you out. The quiet kind, where you fixed the bug and shipped the feature and everyone moved on, and you’re sitting there thinking – did I actually understand what I just did, or did I just get lucky again?

I think I understand this system. Do I really, though. I’ve been doing this for a couple of years now. And yet I spent three hours on something that turned out to be a missing semicolon. That could happen to anyone. Could it, though.

Standing at the Starting Line

Thu, 07 Oct 2010 00:00:00 +0000

I have a blank page and a working install. WordPress, on a shared host. The files are mine, the database is mine, the domain is mine. The first post should be written by now.

It isn’t. I’ve been picking fonts.

I struggled with what the first post should be. Prolific. Grand in nature. Broad in scope. I would spend another hour on themes, colors, the header layout – everything had to be perfect before I could write a single sentence. I struggled some more.

About

Mon, 01 Jan 0001 00:00:00 +0000

Vinayak Mishra. Been building backend systems for a while – payments, risk, the parts where getting it wrong costs real money.

Lately spending time on open-source security. Finding bugs in code everyone trusts, fixing what I can, disclosing the rest. Most of my own work lives at 1mb-dev – small Go and Node libraries, nothing fancy, just tools that do one thing well.

Writing here is how I think through the work – technical or otherwise. The patterns that hold, the ones that don’t, what I’d do differently next time.