Krishna's Tech Blog -- Practical guides on Salesforce, AWS, AI, cloud architecture, and software engineering -- written from real-world experience.

TOCTOU Race Conditions: When Checking Isn't the Same as Doing

You check that a file exists. You open it. Between the check and the open, an attacker swapped the file with a symlink to /etc/shadow. Your code reads the wrong thing. This is a TOCTOU (time-of-check, time-of-use) bug, and it's responsible for an embarrassing number of CVEs from setuid programs to cloud APIs.

Engineering knowledge,built from experience

Learn by doing.Flashcards, quizzes, and more.

TOCTOU Race Conditions: When Checking Isn't the Same as Doing

TLS Handshake Explained: What Every Engineer Should Actually Know

Time Series Databases: Choosing Between InfluxDB, TimescaleDB, and Prometheus

Time and Calendar Programming: The Bugs You're Going to Have

Threat Modeling for Engineers: STRIDE in Practice

Thread Pool Sizing: Why Your Default Is Probably Wrong

The Page Cache: Why Linux Is Faster Than You Think (And Sometimes Slower)

The OOM Killer: When Your Process Just Disappears and Nobody Knows Why

The Linux Scheduler: Why Your Process Doesn't Always Run When You Think It Should

The Heap Data Structure: The Priority Queue That's Everywhere

The Critical Rendering Path: How Browsers Turn HTML Into Pixels

Technical Debt: How to Talk About It With Product Managers

TCP for Application Engineers: The Bits That Actually Bite

Tail Latency: Why p99 Is the Number That Actually Matters

Structured Outputs from LLMs: JSON Mode, Schemas, and Function Calling

Static vs Dynamic Linking: Why Your Binary Suddenly Doesn't Run

Sorting in 2026: Why Quicksort Lost to Timsort and Pdqsort

Software Supply Chain Security: SBOMs, Signing, and SLSA in Practice

SLOs and Error Budgets: SRE in Practice

Skip Lists: The Probabilistic Data Structure Redis Bet On

Service Discovery: How Services Find Each Other in a Cloud World

Service Catalogs: How Engineering Orgs Stop Reinventing Wheels

Server Components vs Client Components: When to Render Where

Server-Sent Events vs WebSockets: Picking the Right Real-Time Tool

Secrets Rotation in Production: Patterns That Don't Page You at 3am

Schema Design: When to Normalize and When Not To

Saga Pattern: Distributed Transactions Without Two-Phase Commit

Runbooks That Actually Work for On-Call

Reverse Proxies: nginx, HAProxy, Envoy -- What They Actually Do

Regex Catastrophic Backtracking: The Tiny Pattern That DOS's Your Service

Refactoring Legacy Code: The Patterns That Don't Make Things Worse

Reading Other People's Code: The Skill Nobody Teaches

Read Replicas: How to Scale Reads Without Breaking Things

Raft Consensus Explained for Engineers Who Have to Use It

Python's GIL: What It Actually Locks and What's Coming Next

Protobuf Schema Evolution: Changing Contracts Without Breaking Them

Property-Based Testing: Catching the Bugs Example-Based Tests Miss

Prompt Injection: The Security Vulnerability of LLM Applications

Postmortems That Actually Improve Systems

Postgres Vacuum and Bloat: The Maintenance Job You Need to Understand

Platform Engineering: Building Internal Developer Platforms That Devs Actually Use

Password Hashing: bcrypt, scrypt, Argon2, and Getting It Right

The Outbox Pattern: Reliable Event Publishing Without Distributed Transactions

Onboarding New Engineers: How to Get Them Productive in Two Weeks

Observability Cost Control: Stop Your Telemetry Bill from Eating You Alive

OAuth 2.1 and PKCE: The Modern Authorization Stack

Bringing Up a New Service: The Day-One Production Checklist

N+1 Queries: The ORM Bug That Eats Your Database

Multi-Region Active-Active: When You Actually Need It

MTU, MSS, and the Mysterious Hangs of Networks That Almost Work

Monorepos in Practice: When They Help, When They Hurt

Model Context Protocol: The Standard for Connecting LLMs to Tools

mmap and Zero-Copy I/O: When Reading a File Costs You Nothing

ML Model Serving in Production: From Notebook to API

Migrating to a New Programming Language: When It's Worth It and How to Do It

Message Brokers Compared: Kafka, RabbitMQ, NATS, SQS

Memory Ordering and Atomics: When Threads Disagree on Reality

Memoization, Caching, and Computed Values: Where Each Belongs

Logs vs Metrics vs Traces: When to Use Each and How They Relate

Local Development Environments: How to Set Up New Engineers in Hours, Not Days

Load Testing: Finding Capacity Limits Before Production Does

LLM Inference Optimization: How to Make LLM Calls Faster

LLM Cost Control: Stop Your AI Bill from Eating Your Margins

Linux Signals and Graceful Shutdown for Long-Running Services

Linux Filesystems: ext4, XFS, btrfs, and ZFS Compared

Linux Capabilities: The Privilege System Everyone Should Know

Latency Numbers Every Engineer Should Know (And How to Use Them)

JIT Compilation: How 'Interpreted' Languages Got So Fast

iptables and nftables: The Linux Firewall You're Already Using

HTTP/2 and HTTP/3: What Changed and Why It Matters

HTTP Caching Headers: Cache-Control, ETag, Vary, and the Browser Cache You Don't Understand

How Hash Maps Actually Work: Buckets, Collisions, and the Bugs You Don't See

Hexagonal Architecture: Ports and Adapters Without Layers for Layers' Sake

GraphQL Federation: Composing Schemas Across Teams

GitOps in Production: ArgoCD, Flux, and the Patterns That Work

Garbage Collection: What Every Engineer Should Actually Understand

fork, exec, and What Actually Happens When You Run a Command

Floating-Point Math: The Bugs That Don't Look Like Bugs

Learn by doing.
Flashcards, quizzes, and more.