Journal
Posts and long-form series on AI, startups, venture capital, and more.
All Posts
Trusting X-Forwarded-For Is How Rate Limiting Quietly Stops Working
If you read the leftmost X-Forwarded-For value, the client picks its own identity and a rotating header defeats your limiter entirely. Count hops instead.
An RSS Reader Is an SSRF Machine
An RSS-to-email service fetches arbitrary URLs on a schedule, forever. How emit guards its feed fetcher, and the hole it can only mitigate.
Deduplicating the Result Is Not Deduplicating the Work
A graph walk that collects into a set returns correct output while still enumerating every path. Why a visited set and an accumulator are two different things.
Validate At the Lowest Public Boundary
A Python wrapper that validates its arguments is not validation if the C extension underneath is importable. Anything importable is public API.
The Whole UI Is a Hashtag
Pedal Wrencher's most-used feature is a hashtag in a Strava activity title. On designing an interface inside someone else's text field.
How Date Inference Works, and Why Ambiguity Is the Problem
Guessing a strptime format from examples is a scoring problem with ties. The dangerous outputs are the wrong guesses that still parse cleanly.
Bounded Autonomy: Retry, Escalate, Never Go Silent
Every stage of an automated pipeline needs three outcomes, not two. Why automation's usual failure mode is doing nothing unnoticed, and how to design it out.
Your API Is Already an MCP Server
Emit's MCP server is an endpoint inside the existing FastAPI app, not a separate package. Why in-process beats a sidecar for a small API-first product.
Bradley-Terry: Maximum Likelihood Ratings on an Elo Scale
Bradley-Terry fits every comparison at once instead of nudging after each game. Adding it to elote, and the four design choices that made it usable next to Elo.
Five Backtest Invariants Worth Enforcing In Code
A backtest simulates information availability, and every way it leaks the future flatters your returns. Five invariants, each with the test that pins it.