Concepts
Mental models and definitions that make the code understandable.
896 published
Page 6 of 9
LATERAL Joins
A LATERAL join lets a subquery reference columns from rows earlier in the FROM clause, turning a correlated subquery into a set-producing join.
Layered Architecture
Layered architecture organises code into horizontal layers with downward dependencies, making separation explicit but risking a leaky, anemic domain.
Layout Thrashing
Layout thrashing is the read-write-read cycle where JavaScript reads layout geometry, mutates styles, and forces the browser to synchronously recompute layout dozens of times per frame.
LDAP Injection
LDAP injection injects filter metacharacters into directory queries, letting an attacker widen a search or bypass an authentication check.
Little's Law
Little's Law states that average concurrency equals throughput times average latency — L = lambda W — a three-variable identity that turns queue observations into capacity estimates.
Livelock and Starvation
Livelock keeps threads busy but useless — each repeatedly detects conflict and backs off in perfect sync — while starvation starves specific tasks of resources despite system progress.
Load Testing to Target Concurrency
Load testing drives realistic traffic at an expected level to verify that latency and error rates hold at the concurrency the system must serve.
Lock Fairness and Starvation
Fairness policies decide whether a lock is granted to the longest waiter or to whichever thread arrives fastest, trading throughput for predictable latency.
Centralised Log Aggregation
Centralised log aggregation ships logs from every instance into one searchable store, replacing per-host files with queryable, correlated records.
Long Animation Frames
LoAF is a browser timing API reporting frames whose duration exceeds 50ms with attribution to scripts, style, layout, and rendering stages, exposing what froze interaction.
Mass Assignment
Mass assignment binds request fields straight into model properties, letting clients set privileged attributes — role, balance, owner_id — that the endpoint never intended to expose.
Memoization
Memoization caches a pure function results keyed by its arguments, converting repeated computation into lookups — invalidation is unnecessary because identical inputs always yield identical outputs.
Memory Allocator Design
Memory allocators — malloc implementations, runtimes, arenas — decide allocation latency, fragmentation, and cache locality; swapping glibc malloc for jemalloc changes service behavior measurably.
Memory Fences and Barriers
Memory fences constrain instruction reordering and visibility of writes across cores, providing the ordering guarantees that lock-free code composes correctly on weakly ordered CPUs.
Message Broker
A message broker mediates asynchronous communication, providing persistence, routing, and delivery guarantees between producers and consumers.
Message Passing Versus Shared Memory
Message passing structures concurrency as communication — actors, channels, queues own their state — instead of threads synchronizing over shared memory, local or distributed.
Metamorphic Testing
Metamorphic testing checks relations between outputs instead of outputs themselves — adding items raises totals, doubling input doubles cost — enabling oracles where expected values are unknowable.
Metric Instrument Types
Metric instruments — counter, gauge, histogram, and variants like exponential histograms — each answer different questions; choosing wrong turns valid data into misleading aggregates.
Metrics Cardinality
Metrics cardinality is the number of unique label-combination time series a metric produces — user ids and request paths multiply it into millions — the primary cost limit of metrics systems.
MFA Fatigue
MFA fatigue floods the victim with push approvals until one is accepted by accident or to stop the noise, converting a strong factor into a social engineering channel.
Micro-Batching
Micro-batching groups arriving items into small batches over a short window, amortizing per-request overhead — network round trips, transaction commits — at the cost of window latency.
Micro Frontends
Micro frontends decompose the frontend into independently deployed units — vertical slices per team or domain — composed at runtime or build time, trading bundle purity for team autonomy.
Microtask Queue
The microtask queue drains promise callbacks and queueMicrotask work completely after each task and before rendering, enabling non-starving async continuation with strict ordering guarantees.
Database Migration Testing
Migration testing verifies schema and data changes against production-shaped data — forward, backward, and under volume — before the migration ever touches a live database.
Mock Objects and Behaviour Verification
Mock objects stand in for collaborators and let a test assert which calls were made, a style that isolates the unit but couples tests to implementation.
Modular Monolith
A modular monolith is one deployable with strictly enforced module boundaries and no cross-module data reach-ins, gaining microservice decoupling without the distributed tax.
Path MTU Discovery
Path MTU discovery finds the smallest link capacity along a route so endpoints send maximally sized packets that avoid fragmentation, now via packetization-layer probes instead of ICMP dependence.
MVCC
MVCC keeps multiple versions of rows so readers see a consistent snapshot without blocking writers and writers do not block readers, trading storage and cleanup for concurrency.
Nagle Algorithm
The Nagle algorithm delays small TCP writes to coalesce them into full segments, trading latency for efficiency; it interacts badly with delayed acknowledgments and small RPC writes.
Native Lazy Loading
The loading attribute defers off-screen image and iframe fetching until near the viewport, for free and without JavaScript, with eager behavior for above-the-fold resources.
Negative Caching
Negative caching stores not-found and error responses for a short TTL, absorbing repeated lookups for missing keys and shielding the origin from miss storms.
Negative Versus Positive Caching
Negative caching stores the absence of a result to avoid repeating an expensive miss, but it must expire quickly when the missing item may soon appear.
Nonce and IV Reuse
Reusing a nonce or IV with the same key in stream and GCM modes is catastrophic: keystream or authentication key reuse enables plaintext recovery and forgery, not a gradual weakness.
NoSQL Injection
NoSQL injection slips operator objects into queries built from user input, so a document database executes conditions the developer never intended.
NULLs and Unique Constraints
SQL NULLs compare as unknown, so multiple NULL values can coexist under a unique constraint — a permissive quirk that differs by engine and silently breaks intended exclusivity rules.
Object-Level Authorization
Object-level authorization checks that the requester owns or may access each specific object by id, not merely that they hold a valid session — the flaw behind IDOR and BOLA.
Object Pooling
Object pooling reuses preallocated instances instead of allocating per use, trading initialization cost for pool management — and in managed runtimes often fighting the collector it meant to help.
OCSP Stapling
OCSP stapling lets the server attach a signed, time-boxed certificate status proof to the TLS handshake, removing the client-side revocation lookup and its privacy and latency costs.
On-Call Rotation Design
On-call rotation design balances coverage with sustainable load, because an over-paged rotation erodes judgement and drives attrition.
Onion Architecture
Onion architecture places the domain model at the centre and treats frameworks, databases, and UI as outer details, inverting dependencies toward the domain.
Online Schema Change
Online schema change alters table structure while concurrent reads and writes proceed, by building a shadow copy and replaying changes, instead of locking the table for the full rebuild.
Open Redirects
An open redirect forwards users to a URL taken from the request without validation, letting attackers craft trusted-domain links that land on phishing or malware pages.
The Test Oracle Problem
The oracle problem is deciding what the correct output should be, which cannot be derived from code and is often the hardest part of testing.
Origin Shield
An origin shield is an additional CDN caching tier — one shield region in front of the origin — collapsing N edge POPs into one shield, multiplying effective cache depth and cutting origin load.
OS Page Cache
The OS page cache keeps file pages in RAM, serving repeated reads from memory and delaying writes — transparently to applications, which must flush and persist explicitly where durability matters.
OpenTelemetry Collector Pipeline
The OTel collector is a configurable telemetry router — receivers, processors, exporters — that decouples emission from backends, handling batching, enrichment, sampling, and multi-backend fan-out.
Output Encoding
Output encoding converts untrusted data into safe representation for the exact output context — HTML body, attribute, JavaScript string, URL — preventing it from being parsed as markup or code.
Parameterized Queries
Parameterized queries separate SQL structure from data by sending the statement and values in distinct protocol channels, so user input can never change the parsed statement.
Partial Index
A partial index covers only rows matching a predicate, shrinking hot-path indexes dramatically when most of the table is inactive or irrelevant to the query pattern.
Passive Event Listeners
Passive listeners promise the browser that touch and wheel handlers will never call preventDefault, letting scrolling start immediately instead of waiting for JavaScript to finish.
Password Salting
A salt is unique random data mixed into each password before hashing, so identical passwords produce different digests and precomputed attacks fail.
Path Traversal
Path traversal escapes an intended directory with crafted relative segments — dot-dot sequences and absolute paths — reading or writing files outside the allowed root.
Permissions Policy
Permissions Policy lets a page declare which browser capabilities — camera, geolocation, fullscreen, and more — are allowed on itself and the origins it embeds, pruning attack surface by default.
Pessimistic Row Locking
Pessimistic locking takes real locks before reading — SELECT FOR UPDATE — so concurrent transactions block instead of conflicting later, chosen when contention is high and retrying is expensive.
Pipes and Filters
Pipes and filters decompose processing into a chain of transforming components connected by pipes, enabling reconfiguration, parallelism, and independent evolution of each stage.
Polymorphic Associations
Polymorphic associations let one child table reference any of several parent tables through a type column plus an id, sacrificing foreign key integrity for schema flexibility.
postMessage Origin Checking
postMessage crosses frame boundaries with an explicit target origin and a sender identity that must be verified on receive, or any embedding page can inject commands into your widget.
Preconnect and DNS-Prefetch Hints
Preconnect and dns-prefetch warm up connections to origins needed soon, cutting latency from DNS, TCP, and TLS before the first real request.
Prefetch Versus Preload
Prefetch speculatively fetches resources for likely future navigations at low priority, while preload urgently fetches resources the current page certainly needs; confusing them wastes bandwidth.
Preload Hints
Preload hints tell the browser to fetch a critical resource early with high priority, before the parser discovers it deep in HTML or CSS, cutting latency on the critical path.
Speculation Rules Prerendering
Speculation rules let a page declare which URLs to prefetch or fully prerender, so a likely next navigation renders in a hidden context and appears instantly on click.
Priority Inversion
Priority inversion makes a high-priority task wait on a lock held by a low-priority task that itself cannot run because medium-priority work monopolizes the CPU — famously grounding a Mars probe.
Process Manager
A process manager is a stateful coordinator that drives a multi-step business process: it consumes events, maintains the workflow state, and issues the next commands toward completion.
Promise and Task Cancellation
Cancellation is cooperative: a signal tells the operation to stop, and the operation must check the signal at safe points — otherwise aborts leak resources and race completion paths.
Prompt Injection
Prompt injection embeds instructions inside untrusted content so the model follows the attacker instead of the developer, and it cannot be fully solved by prompting alone.
Prototype Pollution
Prototype pollution writes to JavaScript object prototypes through unsafe merges and path assignments, silently altering behavior of every object and enabling injected logic or auth bypass.
PROXY Protocol for Client Address Preservation
The PROXY protocol prepends the original client address to a connection so a backend behind a load balancer can see the real source IP and port instead of the proxy's.
Public Key Infrastructure
PKI binds public keys to identities through certificates signed by authorities, letting parties that have never met establish trust.
Publish-Subscribe Messaging
Publish-subscribe decouples producers from consumers through a broker and topics, letting many independent consumers react to the same event.
Queue-Based Load Leveling
Queue-based load leveling inserts a queue between producers and a rate-sensitive service so bursts queue instead of overwhelming it, and the service drains at its own sustainable pace.
QUIC 0-RTT Resumption
QUIC 0-RTT lets a returning client send encrypted application data in its very first flight using resumption secrets, removing the handshake round trip while remaining replayable and constrained.
Rainbow Tables and Lookup Attacks
Rainbow tables trade storage and computation to reverse unsalted hashes, which is why password storage needs a per-user random salt.
Reactor and Proactor Patterns
Reactor demultiplexes readiness events and dispatches handlers that perform the I/O themselves; proactor demultiplexes completion events for I/O the kernel already performed asynchronously.
Read-Through Caching
A read-through cache loads a missing entry from the origin on demand, so application code always reads from the cache and never sees a load step.
Read-Your-Writes Consistency
Read-your-writes guarantees a user sees their own completed updates on subsequent reads — demanding session affinity or propagation tracking in replicated and cached systems.
Reader-Writer Locks
Reader-writer locks allow concurrent readers or one exclusive writer, improving read-parallelism — but writer starvation, recursive hazards, and read-side caching effects often eat the gains.
Readiness APIs: epoll and kqueue
Readiness APIs report which file descriptors are ready for I/O without blocking, letting one thread supervise thousands of sockets — the kernel foundation of event-driven servers.
Recursive CTEs
Recursive common table expressions iterate a working set until exhaustion, expressing tree and graph traversals — bill-of-material explosions, org charts, dependency chains — in pure SQL.
The RED Method
The RED method instruments every service with rate, errors, and duration — three golden metrics that answer is it up, is it failing, is it slow — for request-driven endpoints.
Reentrant Locks
A reentrant lock can be acquired again by the thread that already holds it, incrementing a hold count — preventing self-deadlock when code paths legitimately re-enter guarded sections.
Referrer Policy
Referrer Policy controls how much URL detail a browser leaks in the Referer header on outbound navigations and subresource requests, from full URLs to origin-only to none.
Regular Expression Denial of Service
ReDoS exploits catastrophic backtracking in regex engines: crafted inputs make matching time grow exponentially, hanging request handlers on a single CPU core per input.
Render-Blocking Resources
Stylesheets and parser-blocking scripts delay first paint; identifying and deferring them is a direct lever on perceived load speed.
Repository Pattern
A repository presents collection-like access to domain objects, hiding persistence details and letting the domain stay independent of the database.
Request Coalescing
Request coalescing merges concurrent identical requests into one upstream fetch, with the first caller computing and the rest awaiting the shared result, at proxy or runtime level.
Request Deduplication
Request deduplication collapses identical concurrent calls for the same resource into one upstream request and shares the result with all callers.
HTTP Request Smuggling
HTTP request smuggling exploits disagreements between two chained devices about where one request ends and the next begins, letting an attacker prepend hidden requests into another user connection.
Resize Observer
Resize Observer delivers element-level size changes as frame-batched callbacks, replacing window resize handlers plus getBoundingClientRect polling for responsive components.
HTTP Response Splitting
Response splitting injects CRLF into header values so the attacker appends headers or a body, poisoning caches and enabling cross-site scripting.
Retrieval-Augmented Generation
Retrieval-augmented generation grounds a model's answer in retrieved documents, so responses reflect your data rather than only training-time knowledge.
The RETURNING Clause
RETURNING lets a modifying statement hand back column values of the affected rows, removing the extra round trip that follows an insert or update.
Savepoints and Nested Transactions
Savepoints mark intermediate positions inside a transaction that partial rollback can return to, allowing one failed step to be undone without aborting the whole transaction.
Scatter-Gather
Scatter-gather broadcasts a request to parallel handlers and aggregates their responses — with a deadline that decides whether late answers count, and quorum rules for incomplete sets.
Script Loading: async and defer
async and defer keep HTML parsing alive while scripts download: defer waits for parse completion and runs in document order, async runs whenever ready.
Scroll Anchoring
Scroll anchoring keeps the visible content stationary when content above the viewport changes size, by selecting an anchor node and compensating scroll position on layout shifts.
Semantic Caching
Semantic caching returns a stored answer when a new prompt is close enough in meaning to a previous one, cutting cost and latency but risking subtly wrong reuse.
OpenTelemetry Semantic Conventions
Semantic conventions standardize attribute names and values across telemetry — http.url, db.system, messaging.destination — making instrumentation from different libraries comparable and queryable.
Semantic Search
Semantic search matches meaning rather than exact words, using embeddings to retrieve results that share intent even when they use different vocabulary.
Seqlocks
A seqlock lets readers retry when a concurrent writer is detected, delivering fast lock-free reads for data that is written rarely.
Sequential Convoy
A sequential convoy processes messages for the same key in strict order while processing different keys in parallel, preserving per-entity causality without global serialization.