Security & Privacy
Passwords, fraud, document leaks and keeping your own data yours.
Length and unpredictability, not punctuation theatre. And a strength meter estimates — it does not know.
Nothing the policy refuses announces itself, and a local server that sends no policy at all will look perfect right up until you deploy.
Framing, MIME sniffing, referrer leakage and forced HTTPS — four narrow jobs. Worth doing, and worth knowing exactly how narrow each one is.
Luhn is a checksum for catching typos. It says a string of digits is internally consistent — not that an account exists, and not that anyone owns it.
The first digit of an HTTP status tells you whose problem it is. The pairs that get confused — 401 against 403, 301 against 302 — are where the debugging time goes.
A diff is supposed to find the smallest set of changes between two texts. Line endings, trailing spaces and one inserted line are the three things that bury the real one.
The same string needs three different treatments in a path, a query value and a form body. Here is one string escaped all three ways, with the reasoning.
Why the four characters that break markup have to be escaped before user text reaches a page, and why escaping for text and for an attribute are not the same job.
A query string is text with conventions, not a data structure. Here is what ?a=1&a=2 means, why frameworks disagree, and why splitting before decoding is the one order that works.
What padding is for, what a decoder will and will not accept, and why decoded content is still untrusted input that has to be escaped for wherever it lands.
A pseudo-random generator given the same starting value produces the same numbers forever. That is a feature and a limitation, and knowing which is which decides what you can use it for.
Two machines that have never spoken can each invent an identifier and be confident they do not clash. The confidence comes from arithmetic, and the honest word is negligible — not zero.