Latest Articles
Explore comprehensive articles about artificial intelligence, software development, and engineering practices. From AI breakthroughs to modern development techniques and best practices.
Why does fortune-telling so often feel accurate? Perhaps not only because ancient people were good at observing patterns in life, but because the ancients were us, and we are the ancients: shaped by similar instincts, survival pressures, and the same desire to catch a piece of luck within a finite life.
Although game applications, Web2 applications, and Web3 applications all follow the same software development lifecycle, the engineering mindset behind each stage is very different. In this article, I use Web2 as the baseline, then walk through how games and Web3 change the priorities, constraints, risks, and trade-offs across requirements, design, development, testing, deployment, and monitoring.
AI can generate plans, code snippets, and polished roadmaps in seconds—but it doesn’t automatically carry the consequences: integration constraints, security, testing, deployment, and long-term maintenance. That’s how “AI confidence + 0 accountability” shows up in real projects: timelines that sound convincing, scope that quietly assumes away the hard parts, and prototypes that get mistaken for production. The antidote is simple: confirm features first, lock an MVP scope, write acceptance criteria, then design the system and implement.
Authentication and authorization aren’t “login features”—they’re a production system shaped by browser behavior, protocols, and real attack paths. This guide cuts through the misleading “sessions vs tokens” debate and instead explains what actually matters: stateful vs stateless validation, OAuth 2.0 vs OIDC, SSO and federation, and how to design permissions that don’t leak data across tenants. You’ll see practical patterns (BFF + API), common Auth0 integration pitfalls, a threat-driven defense checklist (XSS, CSRF, token replay, refresh rotation, key rotation)
Modern browsers aren’t “open internet pipes”—they’re sandboxes with sharp boundaries. This article builds a practical mental model for why a request can be sent but the response can’t be read, and how the browser decides what your code is allowed to access. We’ll connect the key pieces—Same-Origin Policy, CORS, cookies (SameSite/HttpOnly/Secure), storage tradeoffs, and CSP—then walk through the real production failure modes and the fastest ways to debug them. If you’ve ever asked “why does this work in curl but fail in the browser?”, this is the missing layer.
When you type a URL or your frontend calls fetch(), the browser runs the same end-to-end pipeline: resolve DNS, establish a transport connection (TCP or QUIC), negotiate TLS, speak HTTP/1.1–2–3, pass through CDN/edge, and finally reach your origin. This post breaks down that chain with a practical, interview-ready mindset—what each layer does, where time is spent, and how real-world issues like DNS latency variance, TLS misconfigurations, CDN caching mistakes, HTTP/2 head-of-line blocking, and HTTP/3/QUIC trade-offs show up in DevTools and how to fix them.