Thoughts on code,
craft & exploration.

Card fraud systems score every transaction in well under a second, but the legitimate orders they wrongly reject cost merchants far more than the fraud they catch. A look at risk scoring, 3-D Secure, and the error nobody instruments.

Obsidian's core Search has a real query language hiding behind the search box. Here's how file, path, line, block, section, task, and property operators replace half the plugins people install to find things.

Firefox 148 shipped Trusted Types in February 2026, making it Baseline. Here's how to turn every dangerous innerHTML assignment in your app into a TypeError you can actually catch.

Your field data says INP is 400ms. Your local profile says everything is fine. The Long Animation Frames API closes that gap by naming the script, the function, and the character position that stalled the frame.

The document-plus-selfie onboarding flow every fintech copied is quietly failing. Here is how identity verification actually works, why injection attacks broke it, and what the layered replacement looks like.

Whole-note embeds are the easy part. Block references are where transclusion in Obsidian actually pays off, and where one misplaced caret silently breaks everything.

Disabling introspection is not security. Trusted documents let your server execute only the operations your own developers wrote, and you probably already have the tooling for it.

Twelve words on a piece of paper used to be the whole story of crypto self-custody. Passkeys, MPC, and smart accounts have quietly changed what that phrase actually protects.

Dataview code blocks give you tables. Inline queries give you a single live value in the middle of a sentence, which turns out to be the feature you reach for far more often.