Concepts
Mental models and definitions that make the code understandable.
896 published
Page 5 of 9
The Context Window
A model's context window bounds how many tokens it can consider at once, a hard limit that governs truncation, cost, and how much retrieved text you can supply.
Continuous Profiling
Continuous profiling samples CPU, memory, and lock behavior of production code at low overhead, correlating profiles with deploys and traffic to catch regressions no benchmark reproduces.
Contract Drift
Contract drift is the silent divergence between what a provider actually serves and what consumers assume — caught only by consumer-driven contract tests and schemas, not by provider self-tests.
Cookie Prefixes
Cookie prefixes — __Host- and __Secure- — make the browser enforce attributes: __Host- requires secure, no domain, and path slash; __Secure- requires the secure flag, blocking subdomain injection.
Cooperative Versus Preemptive Scheduling
Cooperative schedulers switch tasks only at yield points — cheap and predictable, but one selfish task stalls everything; preemptive schedulers force switches — robust but costlier.
Copy-on-Write
Copy-on-write defers duplication until a shared page or object is modified: forks share physical pages, snapshots stay cheap, and immutable structures clone in O(changes) instead of O(size).
Coroutines
Coroutines are functions whose execution can be suspended and resumed, letting many logical tasks share one thread cooperatively instead of one thread per task.
Correlation IDs
Correlation ids tag each request with a unique identifier propagated across every hop, stitching logs, errors, and messages from many services into one causal timeline.
CORS Preflight Requests
A CORS preflight is the OPTIONS request a browser sends before certain cross-origin calls, checking which methods, headers, and origins the server permits before risking the real request.
Cost-Based Query Optimization
A cost-based optimizer compares alternative plans by estimated cost, so accurate statistics and selectivity estimates decide whether queries are fast.
Coverage-Guided Fuzzing
Coverage-guided fuzzing evolves random inputs toward new code paths, using instrumentation feedback to mutate seeds that reach unexplored branches — beyond human test imagination.
Covering Index
A covering index includes every column a query needs, letting the engine answer from the index alone and skip the table heap entirely, turning random reads into sequential ones.
CRDTs (Conflict-free Replicated Data Types)
CRDTs are data structures whose concurrent edits merge deterministically — commutative or lattice-based — enabling multi-leader replication without coordination and converging without conflicts.
Credential Stuffing
Credential stuffing replays username-password pairs leaked from other breaches against your login, succeeding wherever users reuse passwords, at bot scale and behind residential proxies.
Critical Rendering Path
The critical rendering path is the sequence from first HTML bytes to first meaningful paint: DOM and CSSOM construction, style, layout, paint, and composite, each stage gated by blocking resources.
Cross-Origin Isolation
Cross-origin isolation uses COOP and COEP headers to place a page in an isolated browsing context group, unlocking SharedArrayBuffer and threaded WebAssembly at the cost of strict embedding rules.
CSP Nonces and Hashes
CSP nonces and hashes replace unsafe-inline by whitelisting exact script contents — a fresh nonce per response, or a hash of the inline script — keeping inline scripts while blocking injected ones.
Cumulative Layout Shift
CLS aggregates every unexpected layout movement of visible content across the page lifetime, scoring impact by displaced area and distance; user intent movements do not count.
Custom Elements
Custom elements let you define new HTML tags with author-owned lifecycle callbacks — upgrade, attribute changes, connection — natively, without framework buy-in.
Operational Dashboard Design
A good operational dashboard answers a small set of questions at a glance, while a wall of charts hides the signal an on-call engineer needs.
Data Races
A data race is two unsynchronized accesses to the same memory where at least one is a write — undefined behavior in most language models, distinct from higher-level race conditions.
Deadlock Detection and Prevention
Deadlocks are cycles in the waits-for graph of lock holders; databases detect them, abort one victim, and applications must make victim handling and lock ordering first-class.
Distributed Caching
A distributed cache shares cached data across many application instances, giving a single logical cache that survives a single process restart.
CAA Records Constraining Certificates
A Certification Authority Authorization record names which certificate authorities may issue certificates for a domain, giving owners a hard limit backed by CA enforcement.
DNS Rebinding
DNS rebinding answers the first resolution with a public IP and later ones with a private address, letting public web pages bypass same-origin policy and reach internal services through the browser.
DNS TTL
A DNS TTL declares how many seconds a resolver may cache a record, setting the upper bound on how quickly record changes propagate and how much authoritative load you carry.
DNSSEC
DNSSEC adds a chain of digital signatures to DNS answers so resolvers can verify that records truly come from the zone owner and were not tampered with in transit.
Domain-Driven Design
Domain-driven design centres modelling on the business domain and a shared ubiquitous language, aligning code structure with how experts describe the problem.
InnoDB Doublewrite Buffer
The doublewrite buffer writes dirty pages twice — first to a sequential scratch area, then to their real positions — so a torn page during a crash can be repaired from the intact copy.
Protocol Downgrade Attacks
Downgrade attacks trick negotiating parties into choosing weaker protocol versions or cipher suites than both actually support, by tampering with handshake messages.
The Dual Write Problem
A dual write updates two systems in one code path — database plus cache, database plus queue — and any crash between them leaves permanent divergence no retry can detect.
Durable Execution
Durable execution persists every workflow step and its results as it progresses, so a crashed process resumes from the recorded state instead of restarting from scratch or losing work.
103 Early Hints
The 103 Early Hints status lets a server send preload and preconnect link headers before the final response is ready, so the browser warms connections while the app computes the answer.
Equal-Cost Multipath Routing
ECMP spreads traffic across several equal-cost network paths, improving throughput and resilience but fragmenting flows unless hashing keeps a flow on one path.
Edge Caching at the CDN
Edge caching stores responses on CDN nodes close to users, cutting latency and origin load, but demands careful cache keys and invalidation.
Environment Parity
Environment parity keeps dev, CI, and production alike — same images, same dependencies, same configuration mechanism — because every difference is a class of bug only production can find.
Error Budget Burn Rate
Burn rate measures how fast an SLO error budget is being consumed relative to plan, with multi-window alerts firing when spending outruns the budget period — fast burns page, slow burns ticket.
Native ES Modules in the Browser
Native ES modules give the browser a real module graph with static imports, deferred execution, and per-module caching, replacing bundler-only assumptions.
Event-Carried State Transfer
Event-carried state transfer includes full entity state in each event so consumers update local copies without calling back to the producer — trading storage for autonomy.
Event Delegation
Event delegation attaches one listener at a container and uses event bubbling plus target inspection to handle events for many descendants, cutting listener overhead and surviving dynamic children.
Event Upcasting
Event upcasting transforms old event versions into the current shape at read time, letting event-sourced systems evolve their event schema without rewriting stored history.
Cache Eviction Policies
Eviction policies decide which entries to discard when the cache is full — LRU, LFU, ARC, FIFO, random — trading scan resistance and recency versus frequency against implementation cost.
Executable Specifications
Executable specifications encode requirements as running tests in shared language — Given-When-Then scenarios bound to real automation — making specification and verification the same artifact.
Exemplars Linking Metrics to Traces
Exemplars attach sampled trace identifiers to metric points, letting an operator jump from a latency spike directly to a representative request trace.
Metrics Exemplars
Exemplars attach representative trace ids to histogram buckets, linking the aggregate metric to concrete slow requests — from p99 spike to an actual trace.
Expression Index
An expression index indexes the result of a function or expression — lower(email), date columns, JSON paths — so filtered or extracted queries can use an index instead of scanning.
Failure Path Testing
Failure path testing verifies degraded behavior deliberately: inject faults at dependencies, assert timeouts, retries, fallbacks, and partial states — production exercises these branches first.
False Sharing
False sharing happens when independent variables used by different cores land in the same cache line, making cores invalidate each other through coherence traffic without any logical sharing.
Fetch Priority Signals
The fetchpriority attribute tells the browser which resources matter most, letting it reorder network fetches so critical images beat lower-value work.
File Upload Validation
File upload validation must check content, not just names and headers: magic bytes, extension mapping, size caps, storage isolation, and processing sandboxing determine the blast radius.
Index Fill Factor
Fill factor leaves free space in index pages at creation time so future inserts and updates fit in place, reducing page splits at the cost of a larger, colder index.
Fixture Isolation
Fixture isolation guarantees each test starts from controlled state — setup creates, teardown restores — preventing order dependence and cross-test contamination that manifests as flakes.
FOIT, FOUT, and Font Loading
Web font loading trades invisible text while fonts download (FOIT) against a fallback flash that swaps later (FOUT); font-display and size-adjusted fallbacks control the trade-off.
Forward Secrecy
Forward secrecy derives a unique session key per connection so that a later compromise of the long-term key cannot decrypt past recorded traffic.
Full-Text Search Vectors
Full-text search turns documents into normalised lexeme vectors so queries match words and stems rather than raw substrings, ranked by relevance.
GC Pauses and Stop-the-World
GC pauses are the intervals the runtime stops application threads to enumerate and move objects; their length and frequency, governed by collector choice and allocation rate, set latency floors.
Generated Columns
Generated columns compute values from other columns in the row — stored or virtual — making derived fields first-class: indexable, selectable, and constraint-checkable without triggers.
Generational Garbage Collection
Generational GC exploits the weak generational hypothesis — most objects die young — by collecting the young space often and cheaply, promoting survivors to older spaces collected rarely.
GIN Indexes for Composite Values
A GIN index maps many keys per row to the rows containing them, making it the right structure for arrays, JSON documents, and full-text search.
Golden Master Testing
Golden master testing captures the current behaviour of legacy code as a reference and then compares future output against it, useful before a refactor.
Goroutine and Task Leaks
A task leak is a coroutine or goroutine that never finishes because it waits forever on a channel or condition, slowly exhausting resources.
Green Threads
Green threads are user-space scheduled threads multiplexed over few OS threads, enabling lightweight concurrency — millions of tasks — but requiring cooperative yields and runtime-owned I/O.
Happens-Before Relationship
The happens-before relation defines which memory writes a thread is guaranteed to observe, and it is the foundation of every correct memory model reasoning.
Happy Eyeballs
Happy Eyeballs races IPv4 and IPv6 connection attempts with a small stagger, so a broken protocol path on one family cannot stall the user while the other succeeds immediately.
Head-of-Line Blocking
Head-of-line blocking occurs when one stalled item in a shared ordered channel blocks everything queued behind it, appearing at both the HTTP application layer and the TCP byte stream layer.
Heap Profiling
Heap profiling samples or tracks allocations to show which code paths retain memory, turning a vague leak report into a specific allocation site.
Hedged Requests
Hedged requests issue a duplicate request after a delay threshold to another replica and take the first response, cutting tail latency at the cost of duplicate load.
Hermetic Test Environments
Hermetic tests run sealed from the outside world: no network, no shared services, no ambient state — every dependency is started, controlled, and torn down by the test run itself.
Hexagonal Architecture
Hexagonal architecture separates the domain core from the outside world through ports and adapters, so business logic is testable without infrastructure and infrastructure is replaceable.
Hierarchical Data Models
Tree data in SQL is modeled as adjacency lists, nested sets, materialized paths, or closure tables — each trading write complexity against subtree query speed.
Hop-by-Hop Versus End-to-End Headers
Hop-by-hop headers such as Connection and Transfer-Encoding apply only to a single link, so intermediaries must consume them rather than forward them unchanged.
Host Header Injection
Host header injection exploits servers that trust the Host header for URL construction — password-reset links, redirects, cache keys — producing poisoned links and cache entries.
HSTS Preload List
The HSTS preload list is a built-in browser roster of domains that must only be reached over HTTPS, closing the first-request downgrade window that HSTS headers alone leave open.
HTML Sanitization
HTML sanitization strips executable content from untrusted markup via an allowlist parse — safe tags and attributes only — because blocklist string filtering of HTML is a losing game.
Expect 100-Continue
The Expect 100-continue handshake lets a client ask the server whether a large request body is welcome before sending it, saving bandwidth on early rejections such as auth failures.
Cache-Control Directives
Cache-Control controls freshness, revalidation, and shared versus private storage, so the wrong directive either serves stale data or wastes origin capacity.
HTTP Keep-Alive
Keep-alive reuses one TCP connection for many sequential HTTP requests, amortizing handshake and slow-start costs; it is the default persistence model behind every modern connection pool.
HTTP CONNECT Tunneling
The CONNECT method asks a proxy to open a raw TCP tunnel to a destination, letting TLS and other protocols pass through without the proxy terminating or inspecting the payload.
HTTP Redirect Chains
Redirect chains stack multiple hops before final content, each adding a round trip that mobile users pay in full; long chains are cached differently by browsers and crawlers.
HTTP Trailer Fields
Trailer fields are headers sent after a chunked or streamed message body, letting a server report checksums or status that only become known once the body is fully produced.
HTTP/2 Multiplexing
HTTP/2 multiplexing carries many concurrent request and response streams as interleaved frames over one TCP connection, removing the per-request queuing that limits HTTP/1.1.
HTTP/3 and QUIC
HTTP/3 runs over QUIC, a UDP-based transport with per-stream loss recovery and built-in TLS 1.3, eliminating the TCP-level head-of-line blocking that HTTP/2 cannot fix.
Server-Rendered Hydration
Hydration attaches event listeners and framework state to server-rendered HTML so the page becomes interactive without re-rendering, requiring client and server markup to match exactly.
Import Maps for Module Resolution
An import map is a JSON declaration that tells the browser how to resolve module specifiers, enabling bare package names and versioned URLs without a bundler.
Incident Timeline Reconstruction
An incident timeline orders detection, diagnosis, mitigation, and resolution events, turning a chaotic outage into a reviewable sequence for learning.
Insecure Deserialization
Insecure deserialization turns serialized objects into live code and state: gadget chains in the language runtime convert crafted payloads into remote code execution or logic abuse.
Interaction to Next Paint
INP measures the latency from a user interaction to the next visual response across all interactions, reporting close to the worst meaningful one, and is the Core Web Vitals responsiveness metric.
Intersection Observer
Intersection Observer reports when elements cross visibility thresholds relative to a root viewport, replacing scroll-event geometry polling with an asynchronous, frame-aligned callback.
Intrinsic and Extrinsic Sizing
Intrinsic sizing derives an element size from its content — min-content, fit-content, max-content — while extrinsic sizing imposes sizes from the outside via width, flex, or grid tracks.
Cross-Node Cache Invalidation
Cross-node invalidation propagates cache clears through pub-sub or event streams so every instance drops stale entries — at the cost of races, at-least-once delivery, and tombstone bookkeeping.
I/O Multiplexing with epoll and kqueue
I/O multiplexing waits on many file descriptors at once, notifying the program only when one is ready, which is how single-threaded servers handle thousands of sockets.
Join Algorithms
Databases join with nested loops, hash joins, or merge joins; each has distinct memory, sort, and streaming properties that decide which wins at a given data size and index state.
JSON Columns in Relational Databases
JSON column types store semi-structured documents inside the relational model with queryable paths, trading schema flexibility for weaker constraints and different indexing ergonomics.
JWT Algorithm Confusion
JWT algorithm confusion abuses a token header that names its own algorithm — none, HS256 with an RSA public key — when verifiers trust the header instead of a pinned algorithm.
Kappa Architecture
Kappa architecture replaces the batch-plus-speed lambda layers with a single stream-processing pipeline: one codebase, one storage, reprocessed by design instead of dual-run complexity.
Key Derivation Functions
A KDF turns a low-entropy secret or a shared secret into one or more strong keys, deliberately slow for passwords and fast for key expansion.
Keyset Pagination
Keyset pagination fetches the next page by a sort-key cursor — where (created_at, id) after the last seen values — keeping every page an index seek regardless of depth.
Language Memory Models
A language memory model defines which values multithreaded reads may legally see, balancing compiler optimization freedom against the guarantees programs need for synchronization.
Largest Contentful Paint
LCP reports when the largest content element above the fold — typically the hero image or headline block — becomes visible, serving as the loading experience metric of Core Web Vitals.
Latency Percentiles and Histograms
Latency percentiles summarize distributions from histograms — p50, p99, p999 — and correct aggregation, bucket boundaries, and coordinated-omission correction decide whether they are trustworthy.