Dev Blog
Articles, guides and deep dives for developers. Written by developers, for developers.
The UUID Regex Everyone Copies Rejects UUID v7
The most-copied UUID regex caps versions at 5, so it rejects the v7 and v8 that RFC 9562 standardised in 2024. I tested it against eleven inputs.
llms.txt After Eighteen Months: What the Request Logs Show
Adoption reached 10% of domains, but AI crawlers fetched llms.txt 408 times across 500M visits. The evidence, the audience that does read it, and what to ship.
Your Link Preview Is Broken Because the Crawler Never Saw the Page
Blank or wrong link previews are usually a crawler problem, not a tag problem: bot protection, client-side rendering, WebP images - and how to reproduce it.
Same Lightness, 12× the Brightness: HSL vs OKLCH
At HSL lightness 50% the measured luminance swings 12.9x across hue. At OKLCH lightness 0.62 it swings 1.2x. Here is the maths, and what it costs you.
Claude Now Watermarks Everything It Writes, and There Is No Flag to Turn It Off
Anthropic swapped the sampler's randomness for a keyed choice. The mechanism, the length threshold, what survives editing, and why there is no opt-out.
Why "Unexpected Token" Is Almost Never a Typo in Your JSON
The JSON parse errors that actually reach production: HTML error pages, BOMs, truncated bodies, Python's NaN - and how to read V8's rewritten messages.
What Your JSON Parser Does When the Spec Says Nothing
I ran identical payloads through PHP, Node, Python and Go. They disagree on big integers, NaN, lone surrogates and nesting depth - usually in silence.
UUID v4 vs v7 vs ULID: What the Public Benchmarks Actually Show
Published benchmarks range from 35% faster inserts to 3x throughput collapse. Reconciling Percona, PostgreSQL 16 and Shopify - and which number is yours.
Catastrophic Backtracking: How One Regex Can Take Your Site Down
What ReDoS is, why backtracking engines explode exponentially, how to spot vulnerable patterns before an attacker does, and the fixes that work.
Cron Job Not Running? A Field-Tested Debugging Checklist
A checklist for cron jobs that never fire or run at the wrong time: logs, environment differences, the % gotcha, missing newlines and DST skips.
GEO in 2026: Getting Cited by AI Answer Engines
Generative Engine Optimisation for developers: llms.txt, AI-crawler access, content chunking, citation density and measuring share of voice.
Where AI Actually Went in 2026: Agents, Context, and the Quiet Wins
Past the hype: agents that ship, context engineering, MCP as a standard and multi-agent orchestration - what's real in 2026 and what's still a demo.
What Actually Happens Inside a Password Generator
Inside a secure password generator: CSPRNG vs PRNG, modulo bias and rejection sampling, and guaranteeing character classes without leaking entropy.
AI Is Eating Search. These SEO Fundamentals Still Win.
AI answer engines changed discovery, but titles, canonicals, sitemaps and structured data matter more than ever. What changed, and what gets neglected.
The AI Releases That Actually Mattered This June
An opinionated roundup of the June 2026 model releases - GPT-5.5, Gemini 3.5, Claude Sonnet 4.8, Mellum2 and Nemotron 3.5 - and which ones matter.
Password Generator or Passphrase? How I Choose in 2026
When to use a random password generator versus a diceware passphrase, how passkeys change the picture, and a use-case matrix for every secret.
Diceware Passphrases: Why I Stopped Memorising Random Strings
The EFF Large word list, the entropy maths, separator and capitalisation trade-offs, and where passphrases beat random strings - with code examples.
Rich Text to Markdown: How to Convert Google Docs, Word, and Notion Cleanly
Practical guide to converting rich text and HTML to clean Markdown. What survives, what breaks, source-specific quirks, and how to clean up the output.
HTML, CSS and JavaScript Minification: Complete Guide to Benefits, Risks and Best Practices
What minifiers actually remove, the real size savings, common breakage patterns, source maps, and when minification is simply not worth doing.
RSA Key Pair Generation: Fifteen Years of `genpkey` and the Decisions Tutorials Skip
Generating RSA keys with OpenSSL and Web Crypto: key sizes, PEM vs JWK, PKCS standards, storage and rotation - and when to use elliptic curves.
JSON-LD in 2026: Which Schema.org Types Actually Matter and Which Are a Waste of Time
Which Schema.org types trigger Google rich results and which you can ignore: the supported list, ROI by type, and how to prioritise your markup.
Structured Data for Developers: JSON-LD, Schema.org, and Rich Results in Google
Implementing Article, FAQ, HowTo, Product and BreadcrumbList schema with JSON-LD, with examples in PHP and Next.js, plus testing and CI validation.
CSV vs JSON for Data Exchange: When Each Format Wins
CSV or JSON for APIs, pipelines and exports? Structure, parsing, streaming, schema enforcement and size compared, with clear rules for choosing.
SEO for AI Search: How to Optimise for ChatGPT, Perplexity, and Google AI Overviews
How AI answer engines discover, evaluate and cite content - and how to optimise pages for ChatGPT Browse, Perplexity and Google AI Overviews.
Image to Base64 Data URIs: When to Inline and When Not To
The data URI format, size overhead, caching and CSP implications - and clear rules for when inlining an image as Base64 helps rather than hurts.
Open Graph Meta Tags: What They Are, Why They Matter, and How to Set Them Up
Required properties, type-specific tags, Twitter Card fallback, image specs per platform, cache invalidation, and what breaks link previews.
The Developer's Meta Tag Checklist: SEO, Social Sharing, and Beyond
Every meta tag that matters: title, description, canonical, robots, Open Graph, Twitter Cards, structured data, hreflang - and how to audit them in CI.
NanoID vs UUID vs ULID: Choosing the Right ID for Your Project
Size, collision probability, alphabet customisation, URL safety and database performance compared - and when each ID format makes sense.
Markdown Syntax Reference: CommonMark, GFM, and the Gotchas
A full Markdown reference: CommonMark, GitHub Flavored extensions like tables and task lists, escaping rules and platform rendering differences.
HEX, RGB, HSL, HSV: Colour Formats Every Developer Should Know
HEX encoding, RGB channels, HSL vs HSV, alpha channels, sRGB vs linear colour spaces and the conversion formulas, for CSS and image processing.
URL Slugs: Rules, SEO Impact, and Transliteration
What makes a good URL slug, how slugification works, Unicode transliteration for non-Latin scripts, and Google's rules - with code patterns.
UUID vs GUID: Same Thing, Different Ecosystem
GUID is UUID v4 in a Microsoft costume. Uppercase, braces, newsequentialid() and Guid.NewGuid() - and when the distinction actually matters.
QR Code Internals: Encoding, Error Correction, and Capacity
How QR codes work: versions and sizes, encoding modes, Reed-Solomon error correction, masking patterns and capacity tables, with code examples.
Diff Algorithms Explained: LCS, Myers, and How Git Tracks Changes
How diff works: longest common subsequence, the Myers algorithm behind Git, unified diff format, and word-level vs line-level diffing, with examples.
HMAC Explained: Data Signing, JWT, and Protection Against Tampering
How HMAC works with inner and outer padding, why it beats plain hashing, JWT signing, API request signatures and timing attacks - with examples.
Six Months with Claude Code: The Workflow Habits That Cut My Token Spend
Six months with AI coding agents: when to delegate, how to manage context, and the habits that separate productive agent use from expensive frustration.
MongoDB ObjectID Explained: Structure, Timestamp, and When to Use It
Inside the 12-byte ObjectID: timestamp extraction, sorting behaviour, security trade-offs and comparison with UUID, with PHP and Python examples.
Model Context Protocol, Honestly: What MCP Solves and Where It Still Hurts
What MCP is, how its client-server architecture works, how it compares with function calling, and an honest assessment of where it still hurts.
URL Encoding Explained: Percent-Encoding, Reserved Characters, and Common Mistakes
RFC 3986 in practice: reserved vs unreserved characters, query string and form encoding, double encoding, and the mistakes that corrupt parameters.
Eight Prompt Engineering Patterns I Use Daily — and Four That Did Nothing
Structured output, chain-of-thought, few-shot examples, role framing and constraints - the prompt patterns that hold up, and four that did nothing.
Cron Expressions: A Complete Guide to Scheduling Syntax
Cron syntax in full: the five fields, special characters, predefined schedules, timezone pitfalls, cloud schedulers and the mistakes that bite most.
MD5, SHA-1, SHA-256, SHA-512: Which Hashing Algorithm to Choose
Hash functions compared: MD5, SHA-1, SHA-2 and SHA-3, real collision attacks, password hashing with bcrypt and Argon2, and what to use today.
AGENTS.md Makes Your AI Coding Agent Worse - and Now There's Research to Prove It
ETH Zurich's research confirms it: bloated AGENTS.md files make AI coding agents slower, pricier and less accurate. What the paper found, and what works.
The 4.5× Token Tax of Bloated AI Custom Instructions (and How to Cut It)
How custom instructions for ChatGPT, Claude and Cursor inflate every prompt, what that costs in tokens, and how a lean instruction set compares.
JSON vs YAML: Which Format to Choose for Configs, APIs, and Data
Syntax, readability, strictness and performance compared - plus YAML pitfalls like the Norway problem, and when each format is the right call.
UUID Versions Explained: v1, v3, v4, v5, v6, and v7
Every UUID version explained: time-based, name-based and random, with code in PHP, Python and JavaScript and a practical guide to picking one.
Password Security and Entropy: Why Length Beats Complexity
How password entropy is calculated, character sets versus length, passphrases vs random strings, and what brute force really costs an attacker.
A Local RAG Chatbot for Your Internal Wiki: Ollama, ChromaDB, Docker, Zero API Keys
A local RAG assistant that indexes your docs with vector embeddings and answers from a local LLM. FastAPI backend, browser UI, full Docker Compose setup.
After a £47 OpenAI Bill on a Side Project, I Moved to Local LLMs. Here's the Stack.
Run Ollama in Docker Compose and build a Python CLI that clusters customer reviews by theme and writes a structured report. No API keys, no monthly bill.
Base64 Encoding Explained: How It Works and When to Use It
How Base64 works: the encoding algorithm, standard vs URL-safe vs MIME variants, real use cases and common mistakes, with code in PHP and Python.
Regular Expressions: Practical Guide with 20 Ready-to-Use Patterns
Regex fundamentals, flags, groups and lookaheads, 20 tested patterns, plus the Unicode, trailing-newline and engine differences that silently break them.
Unix Timestamps: The Developer's Complete Guide
What Unix timestamps are, why 1970, timezone pitfalls, milliseconds vs seconds and the Year 2038 problem, with PHP, Python and JavaScript examples.
UUID vs ULID: Which Unique ID Should You Use?
UUID v4, ULID and UUID v7 compared: internal structure, database index performance, security trade-offs and how to pick one for your table.
JWT Deep Dive: Structure, Algorithms, and Security Pitfalls
JSON Web Tokens in depth: the three-part structure, HS256 vs RS256 vs ES256, standard claims, and the security mistakes that keep showing up.