All guides, page 2 of 20

Newest first. Search or pick a topic.

476 guides, newest first

• AI Mock Interview Practice: What It Grades Well and Where It MisleadsInterview prep · A plain-English guide to AI mock interview practice: what a chat assistant grades well, where its feedback misleads, reusable prompts, a rubric and a weekly plan, shown on one running example of a student preparing a URL shortener round.21 min read · Updated 28 Oct 2026
• Black's October 2026 GitHub Action Flaw Explained: When a PR Picks CI InstallsBackend · A plain-English guide to the Black GitHub Action vulnerability fixed in 26.10.1: how one pyproject.toml line let a pull request choose what CI installs, and how to harden workflows, shown on one running example of an open-source invoice library.18 min read · Updated 28 Oct 2026
• Classifieds Marketplace System Design: Expiry, Geo Search and Scam ChecksSystem design · A plain-English guide to classifieds marketplace system design: listing lifecycle and expiry, nearby search with PostGIS and Redis, search index sync, duplicate and scam checks, seller ratings and paid boosts, shown on one running example of a city classifieds site.26 min read · Updated 28 Oct 2026
• Docker Content Trust Shutdown (December 2026) Explained: Digests and SignersBackend · A plain-English guide to the Docker Content Trust shutdown: what notary.docker.io did, how to find DCT in your pipelines, and how to move to digests plus Cosign or Notation, shown on one running example of a build pipeline.19 min read · Updated 28 Oct 2026
• DOMPurify's October 2026 Bypasses Explained: Audit Your Sanitiser ConfigFrontend · A plain-English guide to the DOMPurify bypass advisories of October 2026: which non-default options were exposed, what 3.4.17 fixes and how to audit your own config, shown on one running example of a web app with three sanitiser setups.18 min read · Updated 28 Oct 2026
• Drupal's October 2026 Field UI RCE Explained: Why Callbacks Need an AllowlistBackend · A plain-English guide to the Drupal Field UI RCE (SA-CORE-2026-014): how a table row's callback ran without a trust check, who is exposed, and how to check your version and patch, shown on one running example of a university's department websites.18 min read · Updated 28 Oct 2026
• DuckDB Agent Mode Explained: How the CLI Detects and Adapts to AI AgentsAI and GenAI · A plain-English guide to DuckDB agent mode in DuckDB 2.0: how the command-line tool spots an AI coding agent, what it prints instead, what DuckDB's own test saved, and how to copy the idea, shown on one running example of an agent checking a sales file.20 min read · Updated 28 Oct 2026
• GitOps Explained: Pull-Based Deploys, Drift Repair and Rollback by RevertBackend · A plain-English guide to GitOps: desired state in git, pull-based reconciliation, drift detection and self-heal, rollback as git revert, and where it hurts, shown on one running example of a food delivery app's orders service.20 min read · Updated 28 Oct 2026
• GitPython's October 2026 Submodule Flaw Explained: Validate Before You CloneBackend · A plain-English guide to the GitPython vulnerability fixed in 3.2.1: how a submodule path under .git/hooks was cloned before it was rejected, shown on one running example of a tool that builds submodules from user input.14 min read · Updated 28 Oct 2026
• Google Cloud's October 2026 London Outage Explained: Why Backup Power FailedSystem design · A plain-English guide to the Google Cloud outage in London on 20 October 2026: why the backup generators never started, how one zone's loss slowed the region, and how to design and test for zone failure, shown on one running example of a payments app.19 min read · Updated 28 Oct 2026
• Hydra's October 2026 Instantiate Vulnerability Explained: Config Is CodeAI and GenAI · A plain-English guide to the Hydra instantiate vulnerability: how _target_ turns config into code, why the blocklist fixes kept being bypassed and why allowlists win, shown on one running example of a model training tool.17 min read · Updated 28 Oct 2026
• Monorepo Build Systems Explained: Build Graphs, Caching and Affected TargetsBackend · A plain-English guide to monorepo build systems: build graphs, content-addressed caching, remote caches, affected-target selection and fast CI, shown on one running example of a shop monorepo with a web app, an API and a shared library.26 min read · Updated 28 Oct 2026
• Near-Duplicate Detection: Shingles, MinHash, SimHash and LSH at ScaleSystem design · A plain-English guide to near-duplicate detection: shingles, Jaccard similarity, MinHash, SimHash, LSH banding and thresholds, shown on one running example of a news app removing repeated stories.28 min read · Updated 28 Oct 2026
• OVHcloud CLI's October 2026 Supply-Chain Attack Explained: Swapped Release FilesBackend · A plain-English guide to the OVHcloud CLI supply-chain attack of 19 October 2026: how existing release binaries were swapped, why a checksum file beside them proved nothing, and how to check your copy safely, shown on one running example of a developer laptop set up with a one-line install script.22 min read · Updated 28 Oct 2026
• PagedAttention Explained: How vLLM Pages the KV Cache to Stop Memory WasteAI and GenAI · A plain-English guide to PagedAttention: why per-request KV caches fragment GPU memory, how block tables, copy-on-write sharing and preemption work in vLLM, and what paging does to batch size and cost per token, shown on one running example of a support chat assistant on one GPU.24 min read · Updated 28 Oct 2026
• Python's October 2026 Tarfile Vulnerability Explained: Which Filter Is SafeBackend · A plain-English guide to the Python tarfile vulnerability CVE-2026-114583: what the 'tar' filter missed, which releases fix it, which extraction filter to use and how to check your Python, shown on one running example of a deployment service that unpacks build bundles.19 min read · Updated 28 Oct 2026
• Rich Text Editor Design: Document Model, Selections, Paste and UndoFrontend · A plain-English guide to rich text editor design: why contenteditable alone misleads, a document model kept apart from the DOM, selections, beforeinput, safe paste and undo, shown on one running example of a web app's notes box.26 min read · Updated 28 Oct 2026
• RoPE Positional Encodings Explained: Token Order and Context ExtensionAI and GenAI · A plain-English guide to RoPE positional encodings: why attention ignores word order, how rotation gives relative positions, and how interpolation, NTK-aware scaling and YaRN stretch context, shown on one running example of a rental agreement reader.23 min read · Updated 28 Oct 2026
• Sentry's September 2026 Next.js Flaw Explained: Why Middleware-Only Auth FailsFrontend · A plain-English guide to the @sentry/nextjs vulnerability of 2026: how tunnelRoute let requests skip middleware on webpack builds, who is affected and how to fix it, shown on one running example of a two-language app.20 min read · Updated 28 Oct 2026
• Spreadsheet Frontend Design: Virtualised Canvas, Formula Graphs and Copy-PasteFrontend · A plain-English guide to spreadsheet frontend design: virtualised canvas rendering, a formula dependency graph with topological recalculation and cycle checks, selection ranges and clipboard formats, shown on one running example of a distributor's stock sheet.26 min read · Updated 28 Oct 2026
• Tailscale's October 2026 SSH Vulnerabilities Explained: Forwarding as RootBackend · A plain-English guide to the Tailscale SSH vulnerability fixed in 1.104.4: how forwarding reached root-only sockets, who was at risk and how to update, shown on one running example of a team's build server.21 min read · Updated 28 Oct 2026
• Take-Home Assignments: Scope, README, Tests and When to DeclineInterview prep · A plain-English guide to take-home coding assignments: scoping to the time box, what reviewers say they grade, the README, tests, red flags and when to decline, shown on one running example of a four-hour expense-summary task.25 min read · Updated 28 Oct 2026
• vLLM's October 2026 RCE Vulnerability Explained: Request-Chosen Processor CodeAI and GenAI · A plain-English guide to the vLLM remote code execution vulnerability fixed in 0.31.0: how one request field chose which processor code the server imported, why the API key and a pinned revision did not stop it, and how to check your server, shown on one running example of a document-reading service.19 min read · Updated 28 Oct 2026
• Columnar Databases Explained: Why Analytics Queries Read Less DataSystem design · A plain-English guide to columnar databases: column storage, dictionary and run-length compression, row groups with min-max statistics, vectorised execution and why single-row writes are slow, shown on one running example of a food delivery orders table.21 min read · Updated 27 Oct 2026