25 newsletters today.
Abandoned Futures
2026-05-25
In October 1952, at Culver City, California, a machine that looked like a derrick married to a bus lifted off the ground. The Hughes XH-17 had a two-bladed main rotor 130 feet in diameter — still the largest rotor ever flown on a helicopter, 73 years later. It was 53 feet tall. It used the front wheels from a B-25 bomber and the rear wheels from a C-54 transport because nothing else was strong enough. And it had no transmission.
That last detail is the interesting one.
The tip-jet principle. Conventional helicopters drive the rotor from a central shaft, which means the fuselage wants to spin the opposite direction (hence the tail rotor). Kellett engineers Andrew Stefan and Bernard Lindenbaum, working under a 1946 Air Force contract later transferred to Hughes Aircraft, threw that out entirely. Two General Electric 7E-TG-1 turbojets bled compressed air through ducts running up the rotor mast, out along the inside of each hollow blade, and into combustion chambers at the blade tips where fuel was injected and burned. The rotor was, in effect, a 130-foot ramjet pinwheel. No torque on the fuselage. No tail rotor needed (a small one was fitted for yaw control only).
What it could do. First flight 23 October 1952, pilot Gale Moore. It demonstrated lifting 10,284 pounds — at a time when the standard heavy-lift helicopter, the Sikorsky H-19, could manage about 2,000. The design payload was 15 tons, intended for retrieving downed aircraft and moving artillery in Korea. The XH-28 follow-on, on paper, would have lifted 27 tons.
Why it died. Three reasons, none of them fundamental:
Why this deserves a second look in 2026. The fuel-burn problem was a 1950s problem. Modern alternatives have appeared that the original engineers couldn't have used:
Hughes was solving the right problem with the wrong energy source. The architecture was sound; the combustor was the bug, not the feature.
ArXiv Paper Digest
2026-05-25
For the past few years, every conference talk and vendor pitch has told us that AI coding assistants are going to transform software engineering. But what do the people actually using them think — not in a vendor-run demo, but six months into the grind of their real day jobs? This study tries to answer that with something rare in this space: actual longitudinal data.
The authors surveyed professional software engineers at two points six months apart, ending up with 158 responses in the first round, 101 in the second, and a matched cohort of 95 people who answered both times. That matched cohort is the gold here — it lets the researchers see how individual engineers' opinions changed as the honeymoon period wore off and the tools became part of routine work.
The headline finding from the abstract is that participants reported spending less time on most development tasks. That's the productivity story everyone expected. But the more interesting parts of a study like this are usually in the texture: how task focus shifts, how the experience of being a developer changes, and where the gains actually come from versus where they evaporate.
A few things make this paper worth paying attention to:
The key insight, even at the abstract level, is that the conversation has to move past "do AI assistants make developers faster?" That's a settled question for most tasks. The harder questions are: faster at what, at what cost to deep focus and learning, and whether the productivity gains persist or fade once novelty wears off and the harder edge cases dominate the work that's left.
Daily Automotive Engines
2026-05-25
For decades, oil pumps were dumb. They spun at crankshaft speed, moved a fixed volume per revolution, and dumped 30-40% of their output straight back to the pan through a relief valve. That parasitic loss — pumping oil you don't need at pressures you don't want — was just accepted. Then CAFE standards got serious, and engineers finally attacked it.
A variable displacement oil pump changes its actual pumping volume on the fly, matching supply to demand. The most common design is the variable-vane (sliding pintle) pump. Inside the pump housing, a rotor with sliding vanes spins inside an eccentric outer ring. The eccentricity — the offset between rotor center and ring center — determines how much oil gets swept per revolution. Crucially, that outer ring is mounted on a pivot and held by a control spring opposing oil pressure fed back through a control gallery.
When the engine needs pressure (cold starts, high RPM, VVT solenoids activating, piston squirters opening), the ECU commands a solenoid to reduce control pressure on the ring. The spring pushes the ring to maximum eccentricity — full displacement. When demand drops (steady cruise, warm oil, low load), control pressure builds, pushes the ring toward concentric with the rotor, and displacement shrinks. Same RPM, far less oil moved.
Real-world example: The GM 6.2L LT1 uses a two-stage variable-displacement pump. At idle and light load it runs the low-pressure mode (~25 psi). When AFM cylinder deactivation engages or VVT demands flow, it kicks to high-pressure mode (~55 psi). GM measured roughly 1.5 horsepower reduction in pumping losses at cruise — sounds tiny, but multiplied across millions of vehicles and real-world drive cycles, it's a measurable fuel economy win (~1-2% combined).
Rule of thumb: A fixed-displacement pump consumes roughly 0.5-1% of crankshaft power per 10 psi of oil pressure at redline. A 400 hp engine running 80 psi through a fixed pump is burning 3-4 hp just to make oil pressure that gets dumped to the relief valve. Variable displacement recovers most of that.
The tradeoff: complexity. You now have a solenoid, a control gallery, a pivoting ring with a sealing surface, and software calibration to manage it. When the solenoid sticks or the ring's pivot wears (Chrysler Pentastars and certain Audi 2.0T engines have seen this), you get either chronic low pressure or constant high-pressure mode. Diagnostically, a scan tool reading oil pressure that doesn't change with engine state is a red flag — the control mechanism is stuck.
Daily Debugging Puzzle
str.strip() Argument Trap: The Prefix That Eats Your Filename2026-05-25
This function is supposed to strip a ./data/ prefix and a .json suffix from a file path. The code looks clean, reads left-to-right, and even passes a few smoke tests.
def clean_filename(path):
"""Strip './data/' prefix and '.json' extension."""
return path.lstrip("./data/").rstrip(".json")
print(clean_filename("./data/file.json")) # "file" looks good
print(clean_filename("./data/report.json")) # "repor" ...wait
print(clean_filename("./data/users.json")) # "user" missing 's'
print(clean_filename("./data/dataset.json")) # "e" 💥
str.lstrip(chars) and str.rstrip(chars) do not remove a substring. They remove any character in the given set of characters, repeatedly, from that end of the string.
So "./data/" is interpreted as the set {'.', '/', 'd', 'a', 't'}. And ".json" becomes {'.', 'j', 's', 'o', 'n'}. Walk through "./data/dataset.json":
./data/ ✓, then keeps going — d, a, t, a are all still in the set! It only stops at s. Result: "et.json".n, o, s, j, . are in the set. Then t is not. Result: "e".The function works for "file.json" by sheer luck — neither end happens to contain any "poisonous" characters beyond what we intended to strip. Every filename that does contain those characters gets silently mangled. Worst part: there's no exception, no warning. Just a corrupted string that flows downstream into database lookups, cache keys, or filenames that don't exist.
This is one of Python's most-reported "I thought it worked!" bugs, partly because the API name encourages substring intuition (we say "strip the prefix"), and partly because it often passes initial testing on tidy inputs.
Python 3.9 added str.removeprefix() and str.removesuffix() precisely for this. They do exactly what you meant:
def clean_filename(path):
return path.removeprefix("./data/").removesuffix(".json")
print(clean_filename("./data/dataset.json")) # "dataset" ✓
print(clean_filename("./data/users.json")) # "users" ✓
On older Pythons, use os.path for paths, pathlib.Path(p).stem for extensions, or write the slice yourself:
if path.startswith("./data/"):
path = path[len("./data/"):]
if path.endswith(".json"):
path = path[:-len(".json")]
The deeper lesson: lstrip/rstrip and strip are character-set operations, not substring operations. The string you pass is sugar for a set. Whenever you see them called with a multi-character argument that looks like a "word," that's a code smell — verify the author actually wanted a set, not a prefix.
str.strip("./data/") doesn't strip the substring "./data/" — it strips any of the characters ., /, d, a, t — so reach for removeprefix/removesuffix when you mean a literal prefix or suffix.
Daily Digital Circuits
2026-05-25
You have two clocks — say a 100 MHz fast clock for active mode and a 32 kHz slow clock for sleep — and a select bit that picks one. The naive solution is a 2:1 mux. The naive solution is wrong, and it will eat your chip alive.
Consider what happens when sel flips from 0 to 1 in the middle of a clock-A high pulse, while clock-B happens to be low. The mux output drops instantly to 0, then rises when B rises. You just created a runt pulse — a high period shorter than either source clock. Downstream flip-flops see this as a clock edge, but the pulse width violates their minimum pulse-width spec. Result: metastability, undefined state, sometimes a hung core that requires a power cycle.
The standard fix is the glitch-free clock mux, built from two cross-coupled enable paths, each clocked by the opposite clock's falling edge:
The key insight: a clock is only gated on or off when it is already low. Using the falling edge to register the enable guarantees the AND gate's input is 0 when the enable changes. No matter how chaotic sel is, the output transitions cleanly between full pulses of A and full pulses of B, with a guaranteed dead time of at least half a slow-clock period in between.
Concrete example: Every smartphone SoC does this. When Android tells the CPU cluster to drop from 2 GHz to a 24 MHz sleep clock, a glitch-free mux performs the handoff. If it weren't glitch-free, every screen-off transition would risk crashing the AP.
Rule of thumb for switching latency: the handoff costs roughly 1 cycle of the outgoing clock + 1 cycle of the incoming clock, because each side needs a falling edge to update its enable. Switching from 100 MHz to 32 kHz takes ~31 µs — dominated entirely by waiting for the slow clock's falling edge. Software that toggles clocks every few microseconds will spend most of its time stuck mid-handoff.
One gotcha: if either source clock stops while selected, you can never switch away — there's no falling edge to clear the enable. Real designs add a force-off override and sometimes a third "safe" always-on reference clock for this exact failure mode.
Daily Electrical Circuits
2026-05-25
PWM is the lingua franca between analog control signals and switching power electronics. The idea is simple: compare a slowly-varying control voltage against a high-frequency triangle or sawtooth ramp. When the control voltage exceeds the ramp, the output is high; otherwise low. The fraction of time spent high — the duty cycle — becomes a linear function of the control voltage.
The classic analog implementation uses three blocks you've already met: a triangle wave generator (integrator-comparator loop), a fast comparator, and the control input. Feed the triangle into the comparator's inverting input and your control signal into the non-inverting input. If the triangle swings between 1V and 4V, then a 2.5V control voltage gives 50% duty cycle, 1V gives 0%, and 4V gives 100%. The transfer function is beautifully linear:
D = (Vctrl − Vramp,min) / (Vramp,max − Vramp,min)
The PWM carrier frequency fPWM must be much higher than the bandwidth of the signal you're encoding — typically 10× to 100×. For motor control, 20 kHz is popular because it sits above the audible range (no whining) but slow enough to keep MOSFET switching losses reasonable. For Class-D audio amplifiers, you'll see 250 kHz to 500 kHz so the carrier is well above 20 kHz and easy to filter out. For LED dimming, 1–5 kHz is fine — the eye doesn't care, and lower frequencies mean cheaper drivers.
You want to drive a 12V, 2A brushed motor from a microcontroller. Generate a 20 kHz triangle wave (1V–4V swing) with a TL072 integrator and LM393 comparator pair. The MCU produces a 0–3.3V analog control voltage via its DAC. Feed both into a second comparator (LM319 for speed); the output drives a gate driver and N-channel MOSFET low-side switch. A flyback diode across the motor handles the inductive kick. Duty cycle now maps linearly: 1.0V → ~0% (motor stopped), 4.0V → ~100% (full speed).
Daily Engineering Lesson
2026-05-25
A brushed DC motor uses mechanical commutators and carbon brushes to flip current direction in the rotor windings as it spins. A BLDC motor inverts this geometry: the permanent magnets are on the rotor, the windings are on the stator, and an electronic controller handles commutation by switching power to the stator coils in sequence. No sliding contacts, no sparking, no brush dust.
Why this matters in practice:
How commutation works: Most BLDCs are three-phase. The controller energizes two of three phases at a time in a six-step sequence (trapezoidal control), or modulates all three sinusoidally for smoother torque (FOC — field-oriented control). To know when to switch, the controller needs rotor position. Two approaches:
Real-world example: A Tesla Model 3 rear motor is a permanent-magnet synchronous motor (PMSM — essentially a sinusoidally-driven BLDC) putting out ~211 kW from ~70 lb of active mass. A comparable brushed motor would weigh 3–4× as much and need brush replacement every few thousand miles.
Rule of thumb — sizing the controller: Peak phase current is roughly motor torque (N·m) divided by the torque constant Kt (N·m/A), times √2 if you're driving sinusoidally. For a 0.05 N·m/A motor at 5 N·m peak torque: 5 ÷ 0.05 = 100 A continuous, ~140 A peak. Your MOSFETs and bus capacitors must handle that — undersized power stages are the #1 cause of "mystery" BLDC failures.
Tradeoffs: BLDCs cost more upfront (magnets + electronics), demand a controller that can fail catastrophically (shorted MOSFET = locked rotor + smoke), and require startup logic for sensorless designs. For a 30-second-per-day toy or a cheap fan, brushed is still cheaper and good enough.
Forgotten Books
2026-05-25
Book: The art of preserving all kinds of animal and vegetable substances for several years by M. Appert. (1812)
Read it: Internet Archive
In 1795, the French Directory offered a 12,000-franc prize for any method that could preserve food well enough to keep Napoleon's armies fed on long campaigns. A Parisian confectioner named Nicolas Appert spent fourteen years tinkering in his kitchen and won it. His 1812 manual — translated from the second London edition — was, as its title page declares, "A WORK PUBLISHED BY ORDER OF THE FRENCH MINISTER OF THE INTERIOR, ON THE REPORT OF THE BOARD OF ARTS AND MANUFACTURES."
The table of contents reads like a culinary moonshot. Appert claimed he could preserve, for years:
Boiled Meat... Gravy... Broth, or Jelly... Round of Beef, Fillet of Mutton, Fowls, and young Partridges... New-laid eggs... Milk... Cream... Whey... Green Peas... Asparagus... Windsor Beans... Artichokes... Cauliflowers... Sorrel... Spinage... Love-Apples [tomatoes]... Cherries, Raspberries, Mulberries...
His method, distilled across sections on "Bottles and Vessels," "Corks," "Corking," and the long parade of foodstuffs, was deceptively simple: pack food into thick glass bottles, cork them tightly, wire the corks down, and submerge the bottles in boiling water for varying lengths of time. That's it. That's modern canning.
Here is the astonishing part: Appert had no idea why it worked. Louis Pasteur would not propose germ theory for another half-century. Appert was operating in the era of "miasmas" and humors. He believed, vaguely, that heat drove out some kind of vitiating principle and that air was the enemy — a hypothesis that happened to be correct enough to feed armies, sailors, and eventually astronauts.
His instincts were uncanny. The book includes preservation of milk and cream — a feat that would not be industrially repeated until Borden's condensed milk patent of 1856. It includes whey, eggs, and the juices of medicinal herbs. He understood that different foods required different boiling times, the foundational insight behind every USDA canning chart in your grandmother's kitchen.
Within a decade of his book's publication, Englishman Peter Durand patented the tin can (Appert had stuck with glass, which shattered on horse-drawn supply wagons). The British Navy adopted canned rations. By 1820, sailors on Arctic expeditions were eating Appert-method food. By 1928 — when Della Lutes was writing The Presto Book of Menus and Recipes about home canning — Appert's hot-water-bath method had become so normalized that American housewives performed it every August without a thought to its inventor.
The next time you open a can of tomatoes, you are participating in a technology whose mechanism was a complete mystery to its inventor for the rest of his life. Appert died in 1841 — eighteen years before Pasteur published on fermentation — believing he had figured out something about air. He had actually figured out something about microorganisms he could not see and did not know existed.
Forgotten Darkroom
2026-05-25
Book: SE-43: Reactions of the Non-Communist World to Current Communist Tactics by CIA Reading Room (1953)
Read it: Internet Archive
Joseph Stalin died on March 5, 1953. Six weeks later — on April 17 — the CIA quietly circulated a Special Estimate trying to read the tea leaves of what came next. The document, SE-43, is a window into one of the strangest moments of the Cold War: the brief opening when nobody, East or West, knew what the post-Stalin USSR would look like.
The analysts noted, with measured caution, that:
The Communist shift in tactics has been manifest for so brief a period that there is as yet little evidence on which to base an estimate of the effects upon the peoples and governments of the non-Communist world. The popular reactions have been on the whole at least guardedly hopeful, while the reactions of most governments and political leaders have been tentative and cautious.
What's striking is what the CIA predicts next. Buried in the bureaucratic prose is a specific forecast about Korea:
Communist concessions on the [Korean] issue sufficient to bring about an armed truce in Korea, combined with… concessions elsewhere, and a series of conciliatory gestures and statements… would be well calculated to play upon this receptivity.
The estimate identifies the exact lever the new Soviet leadership would pull — a Korean armistice — as the most plausible "peace offensive" move. Three months and ten days later, on July 27, 1953, the Korean Armistice Agreement was signed at Panmunjom. The shooting war that had killed roughly three million people simply… stopped.
The CIA also nailed the European context. The document worries about:
What makes SE-43 forgotten knowledge isn't the prediction itself — historians know about the post-Stalin thaw. It's the method. The analysts weren't doing mystical Kremlinology. They were doing something modern intelligence shops have largely abandoned in favor of signals and data: cold-eyed reasoning from political pressure points. They asked: what concession would be cheapest for the new Soviet leadership to make, and most expensive for the West to refuse? Then they wrote down the answer.
The lesson echoes today. When Putin or Xi makes a sudden conciliatory gesture, the contemporary analytical reflex is to look for hidden technical signals — troop movements, satellite imagery, intercepts. SE-43 reminds us that sometimes the answer is simpler: identify the cheapest move that creates the most receptivity, and assume that's the move that's coming.
Forgotten Patent
2026-05-25
In July and October of 1948, a 32-year-old Bell Labs engineer named Claude Elwood Shannon published a two-part paper in the Bell System Technical Journal titled "A Mathematical Theory of Communication." It was not a patent — but it was filed alongside, and underpinned, a remarkable run of Bell Labs patents on pulse-code modulation, error-correcting codes, and noise-resistant signaling that Shannon and his colleagues secured in the late 1940s and early 1950s (including US 2,605,361, Shannon's 1952 patent on differential PCM). The paper itself did something stranger than any single device patent: it invented the conceptual machinery that made every later communication patent possible.
Shannon's central move was to throw away meaning. A telegram about a death and a telegram ordering groceries, he argued, were the same engineering problem: symbols passing through a channel corrupted by noise. By stripping semantics, he could treat communication as pure mathematics. He defined a unit — the binary digit, or "bit" — borrowing the name from his Bell Labs colleague John Tukey. He defined entropy as a measure of information content, borrowing the formula (and, legend has it on von Neumann's advice, the name) from statistical thermodynamics: H = -Σ p(x) log p(x).
Then came the bombshell: the Noisy Channel Coding Theorem. Shannon proved that every communication channel has a fixed capacity C (in bits per second), and that as long as you transmit below C, you can achieve arbitrarily low error rates by clever encoding — no matter how noisy the channel is. Above C, no scheme works. Before Shannon, engineers assumed noise inevitably corrupted messages and you simply traded power for clarity. Shannon proved this was wrong. Reliability was a coding problem, not a power problem.
He didn't say how to build such codes. He just proved they existed. That gauntlet launched 75 years of research: Hamming codes (1950), Reed-Solomon (1960, the patent behind CDs and QR codes), convolutional codes, turbo codes (1993), and finally LDPC and polar codes — the latter actually approaching the Shannon limit and now standard in 5G.
The modern relevance is total. Every time your phone pulls a clean signal from a weak cell tower, every Wi-Fi packet that survives a microwave's interference, every Voyager image transmitted from beyond Neptune at fractions of a watt, every QR code you scan after coffee spilled on it — all of these work because Shannon proved they could work, and gave engineers the yardstick (C) to measure how close they were getting. Modern 5G systems operate within a fraction of a dB of the Shannon limit. There is no "better than Shannon." There is only "closer to Shannon."
The same paper also formalized data compression. Shannon's source coding theorem proved that any data source has an irreducible entropy below which lossless compression is impossible. Every ZIP file, every MP3, every H.265 stream is a practical attempt to approach that bound. The whole field of data compression is, essentially, applied Shannon.
What's surprising is the era. In 1948 the transistor had just been invented (also at Bell Labs, eight months earlier). There was no internet, no digital storage, no cell phones, no satellites. Shannon described their mathematical foundations before any of them existed — sketching the rules of a game whose players hadn't been born.
Daily GitHub Zero Stars
2026-05-25
Language: TypeScript
Cube-snap is a delightfully ambitious browser-based tool that solves a Rubik's cube from just two phone photos. You snap pictures of opposite corners of your scrambled cube, and the app reconstructs the full color state, then hands you a step-by-step solution rendered in 3D.
What makes this repo a genuine hidden gem is the breadth of computer-vision techniques crammed into a zero-star side project:
The "two photos" trick is the clever bit. A Rubik's cube has six faces, but a single corner shot reveals three of them at once. Two opposite-corner shots therefore cover all six faces while keeping the UX dead simple — no awkward "rotate and capture each side" choreography.
Who benefits? Computer-vision learners get a compact, real-world homography example without wading through OpenCV C++. Cubers get a frictionless solver that beats typing in 54 sticker colors by hand. Web devs curious about doing serious vision work entirely client-side will find a tidy reference for combining getUserMedia, canvas pixel sampling, and three.js. And anyone interested in what a polished Claude-Code-assisted weekend project looks like has a clean specimen to study.
It's the kind of project that feels like it should be a paid app — and instead it's sitting at zero stars waiting to be discovered.
Daily Hardware Architecture
2026-05-25
Modern out-of-order CPUs schedule dependent instructions before they know if their inputs will arrive on time. When a load is issued, the scheduler optimistically assumes it will hit L1 (typically 4-5 cycles on x86). Instructions consuming that load's result are woken up and dispatched to execution units speculatively, timed to grab the value off the bypass network exactly when L1 delivers it. But what happens when L1 misses?
This is where the replay mechanism earns its keep. When the load goes to L2 instead, the dependent instructions have already left the scheduler. They're in the pipeline, consuming execution port bandwidth, expecting data that won't arrive for another 8-10 cycles. The CPU must either stall them mid-flight or — more commonly — let them execute with garbage operands, detect the staleness, and replay them once the real data arrives.
Intel's implementation (sometimes called the "replay queue" or "checker") works by re-injecting failed instructions back into the scheduler. AMD's Zen uses a similar approach with its "load replay" path. The instruction keeps its scheduler slot until it confirms successful execution — only then is it truly retired from issue.
The cascade problem: If one load misses and its dependents replay, their dependents may also have been scheduled speculatively. Replay storms cascade through the dependency chain, and each replay re-occupies an execution port that could be doing useful work. A single L2 hit can cost 15-30 wasted micro-op slots in a wide superscalar.
Real-world example: Pointer-chasing code — linked list traversal — is the worst case. Each load's address depends on the previous load's result, and each load is unpredictable. On Skylake, traversing a list where 30% of nodes miss L1 can run at half the throughput of a list that always hits, even though the average load latency only doubles. The replay overhead, not the cache latency, dominates.
Rule of thumb: Effective load cost ≈ hit_latency + miss_rate × (miss_penalty + replay_cost), where replay_cost is roughly 2-4 cycles per dependent instruction in the cascade. For a 4-deep dependency chain with 20% miss rate, you're paying ~3 extra cycles per load just for replays — separate from the actual L2 access.
This is why Intel's MEM_LOAD_RETIRED.L1_HIT performance counter is so prized: it's not just about cache efficiency, it's about avoiding the entire speculative-then-replay cascade. Software prefetching helps here too — not because it makes the load faster, but because it converts an unpredictable miss into a predictable hit, eliminating the replay entirely.
Hacker News Deep Cuts
2026-05-25
Link: https://ciamweekly.substack.com/p/a-good-reason-to-stop-me-from-pasting
HN Discussion: 1 points, 0 comments
For roughly fifteen years, the security community has treated "disabling paste in password fields" as one of the canonical examples of security theater. The argument is well-rehearsed: blocking paste breaks password managers, which forces users back toward weak, reused, memorable passwords — the exact failure mode strong authentication is supposed to prevent. The UK's NCSC published a famous 2017 post titled "Let them paste passwords," and it became gospel.
This article, on a Customer Identity and Access Management (CIAM) newsletter, appears to push back — and that contrarian framing is precisely why it's worth a click. A piece from someone who works in identity infrastructure, arguing that there is a defensible reason to block paste, is the kind of post that either contains a genuinely novel threat model or sharpens your thinking by giving you something rigorous to disagree with. Both outcomes are valuable.
The likely angles the author explores:
For a technical audience, this matters because security defaults calcify. "Allow paste in password fields" became received wisdom during a specific threat environment (2010s desktop browsers, nascent password managers). The threat surface in 2026 — clipboard-syncing OSes, browser extension ecosystems, mobile keyboards with telemetry, and passkey-capable platforms — is materially different. Periodically re-examining inherited security advice is exactly the kind of work that prevents your threat model from going stale.
Even if you finish the article disagreeing, you'll have a sharper version of why you disagree.
HN Jobs Teardown
2026-05-25
Source: HN Who is Hiring
Posted by: hartator
Of the ten postings, SerpApi (ID 22669436) is the most revealing because it openly describes a business model that exists in a legal and technical gray zone — and the job description quietly admits it.
The stack: Ruby on Rails, MongoDB, and React.js. Rails is a deliberately boring choice for an API-only product in 2020 — most "real-time API" companies of this era reached for Go or Elixir for concurrency. The Rails choice suggests a small team optimizing for shipping velocity over raw throughput, and probably a solo or near-solo founder (hartator) who already knew the framework. MongoDB for what is essentially scraped-result caching is pragmatic: schemaless storage makes sense when you're parsing wildly inconsistent HTML from a dozen search engines that change layouts without notice.
What the posting reveals: The bullet list of "pulses" is the tell — "Experience in Ruby, Javascript, Proxies, CAPTCHA solving, or Browser tech." Three of those five skills (proxies, CAPTCHA solving, browser tech) are not normal backend engineering competencies. They are the skills of an adversary playing cat-and-mouse with Google's anti-bot infrastructure. SerpApi isn't a search company; it's a scraping company that has productized its own evasion stack so customers don't have to maintain proxy pools or solve reCAPTCHA themselves.
Skills and trends highlighted:
Green flags: Continuous deployment, code reviews, pair programming, and profit sharing all signal a mature engineering culture for a company this small. The founder posting directly under his own HN handle suggests a flat structure where the new hire will have real influence.
Red flags: The business is structurally dependent on Google not winning the arms race. Every CAPTCHA improvement, every TLS fingerprinting upgrade, every Cloudflare change is an operational fire. The new engineer is signing up for permanent reactive firefighting, not greenfield product work. The "Austin, TX" location paired with "remote-first" also hints that the team may still be quite small — possibly only the founder full-time.
Daily Low-Level Programming
2026-05-25
When you call pthread_kill, invalidate a TLB entry on another core, or wake a thread on a different CPU, something has to physically deliver that message across silicon. That something is the Local APIC (Advanced Programmable Interrupt Controller) — one per logical core — and the messages it sends are Inter-Processor Interrupts (IPIs).
Every core has its own Local APIC, memory-mapped at 0xFEE00000 by default (or accessed via x2APIC MSRs starting at 0x800). To send an IPI, you write to the Interrupt Command Register (ICR): target APIC ID, vector number, and delivery mode. The destination core's APIC raises an interrupt at the specified vector, and the receiving CPU jumps to the IDT entry for that vector — the same mechanism as a device interrupt, just sourced from another core.
The killer use case: TLB shootdowns. When you munmap() a page, the kernel must invalidate that page's TLB entry on every core that might have cached it. The local core does invlpg, but remote cores can't be poked directly. So the kernel sends an IPI (vector 0xFD on Linux x86_64, CALL_FUNCTION_VECTOR's cousin) to each affected core. Each remote core takes the interrupt, executes invlpg, acks, and resumes. The originating core spins waiting for all acks.
Why this is expensive: An IPI takes ~1–3 microseconds round-trip — easily 5,000+ cycles. With 64 cores, a single page unmap can take 50+ microseconds of pure shootdown overhead, with every target core taking a pipeline-flushing interrupt mid-execution. This is why hyperscalers obsess over MADV_FREE (lazy, no shootdown) over munmap(), and why mprotect() on a hot region can tank latency across an entire socket.
Rule of thumb: Cost of an IPI-based operation ≈ 2µs × number_of_target_cores. Munmapping one 4KB page across 32 cores costs ~64µs — more than the unmap itself by orders of magnitude.
Delivery modes worth knowing:
perf sampling — interrupts even with IRQs disabled.You can watch IPIs live: watch -n1 cat /proc/interrupts | grep -E 'TLB|Resched|Call'. The TLB row counts shootdowns; RES counts scheduler reschedule IPIs; CAL counts smp_call_function invocations. High numbers here often explain mysterious tail-latency spikes.
RFC Deep Dive
2026-05-25
RFC 6066 is the unsung hero behind every modern HTTPS connection. It defines the core TLS extensions that make it possible to host thousands of HTTPS sites on a single IP address — most importantly, Server Name Indication (SNI). If you have ever wondered how CloudFlare, Fastly, or AWS CloudFront can serve millions of distinct certificates from the same edge IP, the answer starts here.
The problem. Original SSL/TLS had a chicken-and-egg flaw. The server presents its certificate during the handshake, but at that point it has no idea which hostname the client is asking for — the HTTP Host: header comes later, inside the encrypted tunnel. With IPv4 exhaustion looming and shared hosting ubiquitous, this meant either one cert per IP (expensive, wasteful) or wildcard/SAN certs covering everything on the box (operationally painful and a security blast-radius nightmare). The web could not scale TLS without solving this.
The fix: SNI. RFC 6066 adds a server_name field to the TLS ClientHello. The client tells the server, in cleartext, which hostname it wants before the server picks a certificate. The server then selects the matching cert and proceeds. It is a beautifully small protocol change with enormous infrastructure consequences — it is the reason Let's Encrypt could realistically ship in 2015, the reason virtual hosting works over HTTPS, and the reason CDNs are economically viable.
The other extensions. 6066 is a grab-bag spec; it consolidates several useful additions:
max_fragment_length — lets constrained clients negotiate smaller record sizes (important for IoT and mobile where the default 16 KB is wasteful).status_request — the foundation of OCSP stapling. Instead of every client phoning the CA to check certificate revocation (slow, privacy-leaking), the server fetches an OCSP response itself and "staples" it to the handshake.trusted_ca_keys and truncated_hmac — niche, rarely deployed.server_certificate_type / client_certificate_type — later extended to support raw public keys and other cert formats.Key design decisions. SNI is sent unencrypted. This was pragmatic — the server needs it before keys are negotiated — but it became one of TLS's most enduring privacy problems. Censors and middleboxes can see exactly which sites you visit even over HTTPS. This eventually motivated ESNI and then Encrypted Client Hello (ECH), which are still being rolled out in 2026. So 6066 simultaneously enabled the modern web and created the surveillance vector ECH is trying to close.
History. 6066 supersedes RFC 4366, which itself fragmented an earlier omnibus extensions document. Donald Eastlake — a prolific IETF contributor also responsible for DNSSEC work and TRILL — split the registry mechanism from the actual extension definitions, which is why the IANA "TLS ExtensionType Values" registry is governed separately. That split lets new extensions like ALPN (RFC 7301, which gave us HTTP/2 negotiation) slot in cleanly.
Why engineers still care. If you debug TLS in 2026, you read ClientHellos. The first thing you look for is the SNI value — load balancers route on it, WAFs filter on it, and observability tools key on it. Tools like openssl s_client -servername, curl --resolve, and tshark -Y tls.handshake.extensions_server_name all exist because of this RFC. TLS 1.3 kept SNI essentially unchanged precisely because the ecosystem depends on it.
Daily Software Engineering
2026-05-25
In a distributed system, you can't trust wall-clock timestamps to order events. Clocks drift, NTP corrects them backward, and two machines can record "the same moment" seconds apart. If you've ever seen a comment appear before the post it replies to in an event log, you've hit clock skew. Vector clocks solve this by tracking causality instead of time.
A vector clock is a map of {node_id → counter} attached to every event. The rules are simple:
To compare two events A and B: if every entry in A ≤ the matching entry in B (and at least one is strictly less), A happened-before B. If neither dominates, they're concurrent — you cannot order them, and your application must decide what to do.
Real-world example: Amazon's Dynamo (and DynamoDB's ancestor, Riak) uses vector clocks on shopping carts. If two replicas accept writes during a partition — one adds milk, the other adds bread — the vector clocks are concurrent, not ordered. Riak doesn't pick a winner; it returns both versions to the client (called "sibling values") and lets the cart-merge logic union them. Result: no items vanish from your cart just because your phone hit one replica and your laptop hit another.
Rule of thumb on size: a vector clock grows linearly with the number of writers it has ever seen. For N active clients, you're carrying N × 8 bytes of metadata per object. With 10,000 mobile clients each writing once, that's 80KB of clock attached to a 200-byte cart. This is why production systems use dotted version vectors or prune entries for nodes that haven't written in days — keep the writer set bounded, or your metadata will dwarf your data.
When to reach for them: multi-master replication, CRDTs, collaborative editing, any system where two writers can legitimately disagree and you need to detect — not hide — the conflict. When not to: single-leader systems (a monotonic sequence number is enough) or anything with strict linearizability via consensus (Raft already gives you total order).
The deeper insight: vector clocks don't tell you what time something happened. They tell you what must have happened before it. In distributed systems, that's the only kind of "when" that's actually reliable.
Tool Nobody Knows
2026-05-25
You know the drill. Something's broken between your service and an upstream API. You reach for tcpdump, capture a pcap, then squint at hex dumps or load it into Wireshark just to read a few HTTP requests. There's a better tool that's been sitting in Debian since the early 2000s: tcpflow, written by Jeremy Elson and now maintained by Simson Garfinkel (yes, that one).
tcpflow reassembles TCP streams in real time and writes each flow to its own file. No pcap reading step. No Wireshark. Just one file per direction of each connection, containing exactly the bytes that flowed across it.
sudo tcpflow -i eth0 port 80
That spits out files like 192.168.010.005.45122-093.184.216.034.00080 (client→server) and the reverse. Open them with less. You're reading the HTTP request and response directly, in order, with retransmissions and out-of-order packets already reassembled for you.
The killer flag is -c, which dumps reassembled flows straight to stdout with colorized client/server tagging:
sudo tcpflow -c -i lo port 6379
# watch your Redis traffic live, RESP protocol and all
sudo tcpflow -c -i any port 5432
# every Postgres wire-protocol exchange, tagged by direction
For HTTP debugging, combine it with the BPF filter and a quick grep:
sudo tcpflow -c -i any 'port 8080' | grep -E '^(GET|POST|PUT|HTTP/)'
Want only the headers of every request hitting your dev server? -e http turns on the HTTP scanner, which extracts requests, responses, and even decompresses gzipped bodies into separate files:
sudo tcpflow -i any -e http port 8080
# produces *.HTTP and *.HTTPBODY files, decompressed
Other scanners worth knowing: -e netviz generates a GraphViz visualization of who-talked-to-whom, -e tcpdemux handles arbitrary protocols, and -e md5 hashes each flow so you can spot duplicates.
The -r file.pcap mode reads existing captures, so you can keep using tcpdump for collection on a production box (smaller, more universal) and process the pcap with tcpflow on your laptop:
ssh prod 'sudo tcpdump -i any -w - port 443' > capture.pcap
tcpflow -r capture.pcap -o /tmp/flows
Where it beats tcpdump: tcpdump shows you packets. tcpflow shows you conversations. If you've ever caught yourself manually following a TCP stream in Wireshark just to read what was actually sent, that's the entire workflow tcpflow replaces. For plaintext protocols (HTTP, Redis, Postgres, SMTP, IRC, gRPC over h2c, custom TCP services) it's the fastest path from "something's weird on the wire" to "oh, the client is sending a malformed Content-Length."
Where it loses: TLS. tcpflow gives you the encrypted bytes, which are useless. For that you need SSLKEYLOGFILE + Wireshark, or an intercepting proxy like mitmproxy. tcpflow is for plaintext on the wire.
One more gem: -a turns on all scanners at once, and -S enable_post_processing=true lets each scanner do its thing as flows close, so you get fully decoded artifacts when the connection ends rather than partial dumps.
Install: apt install tcpflow, brew install tcpflow, or build from the github.com/simsong/tcpflow tarball. It's a single static binary with libpcap as the only real dependency.
What If Engineering
2026-05-25
Lithium-ion cells store energy. Carbon-fiber composites carry load. Both are heavy. What if a single material did both — your car's roof, doors, and floor pan acting simultaneously as crash structure and traction battery? Chalmers University and Imperial College have actually built laminates that do this: carbon-fiber electrodes separated by a structural electrolyte (a glass-fiber matrix soaked in a solid polymer ion conductor). Today's lab samples reach about 24 Wh/kg and 25 GPa elastic modulus — roughly aluminum-stiff while storing energy.
The mass math. A Tesla Model 3 weighs ~1,800 kg. The battery pack is ~480 kg (75 kWh at 156 Wh/kg pack-level). Body-in-white plus chassis is ~400 kg of structural metal. Total dead mass devoted to "hold the car together" plus "store energy": ~880 kg.
Now swap. Imagine structural-battery composite at a near-future 75 Wh/kg (roughly the 2030 roadmap target) replacing both the 400 kg body and the 480 kg pack. To hit the same 75 kWh you need 1,000 kg of composite. That's more than the 880 kg you removed — a 120 kg penalty. Bad.
But cars don't actually need 75 kWh of range. Two-thirds of trips are under 50 km. Right-size to 40 kWh:
Lighter car needs less energy per km. Rolling + aerodynamic energy for a Model 3 is ~150 Wh/km; remove 347 kg and you cut roughly 25 Wh/km, so 40 kWh now goes ~320 km instead of 270. You've matched a lot of real-world range with half the stored energy.
Why this is hard. Three brutal trade-offs:
Where it wins first. Drones and small satellites. A quadcopter's frame is ~30% of its mass; converting it to a 50 Wh/kg structural battery roughly doubles flight time before any aerodynamic gains. CubeSat structures are pure mass overhead — turning the chassis into a battery is essentially free capacity. Cars come later, when cycle life climbs past 2,000 and impact behavior is certified.
The deeper idea: every kilogram of passive mass in a vehicle is a design failure. Wheels store kinetic energy. Springs store elastic energy. Why shouldn't the roof store electrons?
Wikipedia Rabbit Hole
2026-05-25
Wikipedia: Read the full article
Squeeze a quartz crystal hard enough and it will literally spit out electricity. Bend it the other way — apply voltage across its faces — and it physically deforms, growing or shrinking by a few nanometers. This bizarre two-way street between mechanical force and electric charge is called piezoelectricity, and once you start looking for it, you'll find it everywhere in your house.
The effect was discovered in 1880 by Pierre Curie (yes, that Curie, before he married Marie) and his older brother Jacques. They noticed that certain crystals — quartz, tourmaline, topaz, Rochelle salt — generated measurable voltages when squeezed. The reverse effect, deformation under voltage, was predicted mathematically by Gabriel Lippmann the following year and confirmed by the Curies almost immediately. For thirty years it remained a laboratory curiosity with no practical use.
Then came World War I. In 1917, French physicist Paul Langevin built the first practical sonar using a quartz transducer to bounce ultrasonic pulses off submarines. Suddenly piezoelectricity wasn't a parlor trick — it was a war-winning technology. The principle is elegant: apply alternating voltage to a quartz disc and it vibrates at a precise frequency, sending sound waves into the water. When the echo returns, the same crystal converts the pressure back into a voltage you can amplify and read.
That same precision is why every quartz wristwatch on Earth works. A tiny tuning-fork-shaped sliver of quartz, cut along very specific crystallographic axes, vibrates at exactly 32,768 Hz when voltage is applied. A digital circuit counts those oscillations and ticks the second hand forward once per 32,768 cycles. Your computer's CPU clock, your phone's radio tuning, your microwave's timer — all of them are choreographed by piezoelectric crystals oscillating millions or billions of times per second.
Now think about the cigarette lighter or gas grill you've used. That satisfying click that produces a spark? A small hammer slams into a piezoelectric crystal, momentarily generating thousands of volts across a tiny air gap. No battery required. The same effect, run in reverse, drives the inkjet printer on your desk — voltage pulses make piezo elements squeeze ink droplets out of nozzles at thousands of dots per second.
It gets stranger. The effect exists in biological tissues too. Bone is piezoelectric — when you walk, the mechanical stress on your bones generates tiny electric fields, and there's strong evidence this is part of how bones know to remodel themselves under load (Wolff's law). Tendon, DNA, and even individual proteins show piezoelectric behavior. Researchers are now building self-powered medical implants that harvest energy from heartbeats.
And here's the kicker: scientists are seriously developing piezoelectric flooring that generates electricity from footsteps, piezo-harvesting shock absorbers for cars, and nanogenerators woven into clothing. A future where your morning walk charges your phone isn't science fiction — the underlying physics has been sitting in a quartz crystal for 145 years.
Daily YT Documentary
2026-05-25
Channel: History by Nature (21 subscribers)
Note: this batch leans heavily on hashtag-spam shorts and AI-narrated history clips. This one is the least bad — it tackles a genuinely fascinating piece of climate history that deserves more attention.
In April 1815, Mount Tambora in the Dutch East Indies produced the largest volcanic eruption in recorded human history — a VEI-7 event that ejected roughly 150 cubic kilometers of material and launched sulfate aerosols into the stratosphere. The result was the infamous "Year Without a Summer" in 1816, when global temperatures dropped, crops failed across Europe and North America, snow fell in New England in June, and famine killed tens of thousands.
The video walks through the chain of cause and effect: how a single tropical eruption could chill the entire planet, why sulfate aerosols are more climatically potent than ash, and the downstream consequences — from Mary Shelley writing Frankenstein during a gloomy Swiss summer to the migration waves that reshaped American agriculture. It's a good entry point into volcanic forcing of climate, a mechanism still used to model geoengineering scenarios today.
Short and surface-level, but the underlying story is one of the best real-world demonstrations of how fragile global food systems are to atmospheric disruption.
Daily YT Electronics
2026-05-25
Channel: Hardware Team (1080 subscribers)
Electromagnetic interference and compatibility is one of those topics that separates hobbyist boards from production-ready hardware. A circuit can simulate perfectly, pass functional tests on the bench, and still fail field deployment because of radiated emissions, susceptibility to nearby noise sources, or coupling between traces that the schematic never hinted at. This video tackles EMI/EMC as a design-time concern rather than a post-mortem debugging exercise.
The premise framed in the description — that many PCB failures stem from poor EMI/EMC design rather than software bugs or bad components — is exactly the lesson most self-taught designers learn the hard way. Topics typically covered in this area include return current paths, ground plane integrity, decoupling strategy, trace routing for high-speed signals, shielding considerations, and the geometry choices that determine whether a board will pass FCC/CE certification on the first try or require costly respins.
At only 1,080 subscribers, Hardware Team is a small channel, but EMI/EMC content is notoriously underserved on YouTube — most tutorials stick to layout mechanics and ignore the physics. Even an introductory treatment of the subject is valuable because it shifts your mental model from "does it work?" to "will it work in a noisy environment, and will it stop interfering with everything around it?"
Daily YT Engineering
2026-05-25
Channel: Electroviral_Official (507 subscribers)
Power quality harmonics are one of the most under-discussed failure modes in industrial electrical systems. When non-linear loads — VFDs, rectifiers, switch-mode power supplies — pull current in distorted, non-sinusoidal waveforms, they inject harmonic currents back upstream. These harmonics don't just cause inefficiency; they overheat neutral conductors, saturate transformer cores, trip protection relays at "impossible" fault levels, and silently degrade capacitor banks until something catastrophically fails.
This podcast episode takes a case-study approach to a real factory incident where harmonic distortion was the hidden root cause. The format is worth highlighting: instead of generic theory, it walks through how the problem manifested, what the symptoms looked like to maintenance staff, and how the diagnosis was eventually pinned to harmonic content rather than a "normal" electrical fault. That diagnostic narrative is the most valuable part — recognizing that your relays tripping on phantom faults or your neutral running hotter than your phases is a harmonics signature, not a wiring problem.
Honest caveat: this is the strongest pick from a weak batch. Most other candidates here are Shorts, hashtag spam, or generic "engineering failure" clickbait. A long-form podcast on a real power quality phenomenon at least teaches a concept you can act on — and harmonics are exactly the kind of topic that small specialist channels cover better than mainstream content.
Daily YT Maker
2026-05-25
Channel: doon prefab project (63 subscribers)
Note: this batch of candidates is uniformly weak — mostly hashtag-heavy shorts with minimal descriptions and no narration. This pick is the least bad of the lot.
This clip from a small Dehradun-based prefab outfit shows a finished bison board prefabricated home. Bison board (a high-density cement-bonded particle board made from wood fibers and Portland cement) is an interesting alternative to gypsum or plywood for prefab construction: it's fire-resistant, termite-proof, dimensionally stable in humid climates, and structural enough to serve as a wall panel when framed properly.
For viewers curious about low-cost modular housing in the Indian market, the channel offers a glimpse at how small fabricators are using cement-board panels with steel framing to put up rooms and small dwellings on short timelines. The video itself is light on technical explanation — it's mostly a walkaround of a completed unit — but the underlying construction method (steel skeleton + bison board cladding + insulation core) is genuinely worth understanding if you're interested in alternatives to traditional brick-and-mortar or shipping-container builds.
Treat this as a starting point for a rabbit hole rather than a standalone tutorial: search "bison board construction detail" afterward for the actual joinery and fastener specs.
Daily YT Welding
2026-05-25
Channel: Freeman's Garage (6440 subscribers)
Trunk lid fitment on a 70-year-old unibody-adjacent body shell is one of those jobs that looks like five minutes of bolting and turns into a multi-day exercise in panel alignment, gap chasing, and metalwork triage. This installment of the abandoned 1956 Chevy revival tackles exactly that — and the title is honest about the surprise: the hard part wasn't the part you'd predict from the outside.
What makes Freeman's Garage worth following on a build like this is the willingness to show the diagnostic process, not just the result. When a trunk lid won't sit flush, the cause could be a tweaked hinge mount, a sprung quarter panel, a sagging deck filler, or accumulated body filler from a previous repair hiding the real geometry. Working through that decision tree on camera — measuring gaps, checking reveals from multiple angles, deciding whether to shim, massage metal, or move a mounting point — is genuinely instructive for anyone doing classic sheet metal work.
The 1956 Chevy is also a good platform for this kind of content because the panels are heavy-gauge, the hinges are robust, and the failure modes are well-documented in the hobby. Watch for how they handle the gap consistency along the deck-to-quarter seam — that's where most amateur restorations betray themselves.
