Learn
6 guides in 3 short paths. Each one works through a topic that looks simple and is not, and ends at a tool you can try it on.
1
Data formats, properly
JSON, CSV and the encodings underneath them. Mostly a tour of the places these formats do something other than what they look like they do.
Anyone who has had a CSV import mangle a column.
- 1CSV is harder than splitting on commasWhy a quoted comma breaks naive parsers, how leading zeros get destroyed, and what RFC 4180 actually requires. With the cases that matter in practice.4 min read
- 2Three ways to count a character, and when each one is rightCode points, UTF-16 units and UTF-8 bytes give different answers for the same text. Which one your database, your API and your language each mean.3 min read
2
Time and scheduling
Timestamps, time zones and cron. Three topics where the obvious reading of a value is frequently the wrong one.
Anyone who has shipped a job that ran at the wrong hour.
- 1Unix timestamps: seconds, milliseconds, and the UTC trapWhy a timestamp shows 1970, why the same date string means two different instants, and how to tell which unit you are actually holding.4 min read
- 2Cron expressions, and the rule that makes jobs run twiceThe five fields, the syntax that actually gets used, and the day-of-month and day-of-week rule that fires far more often than the expression looks like it should.4 min read
3
Security basics for web developers
Hashes, tokens and escaping — what each one actually guarantees, and the very common cases where it guarantees nothing.
Developers who use these primitives without having read their specs.
- 1What a JWT actually tells you, and what it does notA JWT payload is encoded, not encrypted. What the three segments contain, what alg none means, and why decoding is not verifying.4 min read
- 2MD5, SHA-1, SHA-256: which to use and which are brokenWhat "broken" means for a hash function, where MD5 is still fine, and why none of these belong anywhere near password storage.4 min read