Latest Posts
RSSArticles and insights about shipping software. Mostly things I figured out the hard way.
Unicode usernames without homoglyph attacks
Zod username validation for Japanese, Korean, and Cyrillic names, with homoglyph, impersonation and script-mixing checks.
2026
Post-quantum JWT signing: ML-DSA is here
What RFC 9964 adds for JWS, when ML-DSA actually matters versus keeping ES256, and why post-quantum JWE encryption is further off than you think.
Timing-safe equal: comparing secrets without leaking them
Why a normal string comparison can leak confirmation tokens byte by byte, how timingSafeEqual fixes it, and a live benchmark you can run in the browser.
When postMessage is too slow: Shared Memory patterns for Web Workers
An overview of Web Worker communication: Comlink for control, transferables for big handoffs, and SharedArrayBuffer patterns for high-frequency updates.
Optimizing an Astro Site for 100 PageSpeed
A practical guide to pushing an Astro site to a 100 PageSpeed score: CSS budgets, fonts, images, and the Speed Index fixes that actually matter.
2023
Meet WebTransport: The Future of WebSockets
How WebTransport overcomes WebSockets and WebRTC limits using QUIC, datagrams, and bidirectional streams—for games and real-time apps.
Visual Regression Testing with Cypress and Storybook
Use Cypress and Storybook to catch visual regressions in React apps and keep every UI update consistent across browsers and screen sizes.
2016
Streaming a video with Media Source Extensions
Learn how Media Source Extensions let you inject partial WebM video into an HTML5 player—useful for streaming and progressive playback.