Concepts
Mental models and definitions that make the code understandable.
896 published
Page 7 of 9
Sequential Versus Random I/O
Sequential I/O streams contiguous blocks at device bandwidth; random I/O seeks between locations and pays per-access latency — an order-of-magnitude gap on disks, narrower but real on SSDs.
Server-Timing Metrics Header
Server-Timing reports named backend durations to the browser so performance data reaches real user monitoring without shipping a client-side probe.
Service Worker Lifecycle
The service worker lifecycle installs, waits, and activates per scope, letting new versions take over only when all old clients close, which is why updates appear to lag by a session.
Session Fixation
Session fixation sets the victim session identifier before login — via URL, subdomain cookie, or header injection — so the post-login session reuses the attacker-known id.
Shadow DOM
Shadow DOM attaches an encapsulated DOM subtree with scoped styles and controlled slot-based content distribution, letting widgets ship markup that cannot clash with the host page.
Selecting Service Level Indicators
Choosing the right service level indicator means measuring what users experience, such as successful request latency, not convenient internal counters.
Slowly Changing Dimensions
Slowly changing dimension techniques preserve historical attribute values in a warehouse — type 2 adds versioned rows with validity ranges — so reports reproduce the past as it was.
Server Name Indication (SNI)
SNI lets a TLS client send the target hostname in the handshake, so one IP address can serve many HTTPS sites with different certificates before the request is decrypted.
Snowflake Schema
A snowflake schema normalizes dimension tables into sub-dimensions by referencing keys, trading fewer join hops in star for less redundancy and smaller dimension storage.
Software Transactional Memory
STM lets threads read and write shared memory inside atomic transactions that retry on conflict, replacing fine-grained locks with optimistic concurrency.
Span Attributes
Span attributes are structured key-value metadata on spans — user id, tenant, cache hit, retry count — that turn traces from timings into queryable records of what happened and why.
Speculative Parsing and Preload Scanner
Browsers run a lightweight speculative parser ahead of the main one to discover subresources early, but scripts and DOM mutations can invalidate its assumptions.
Server-Side Request Forgery
SSRF makes the server fetch attacker-chosen URLs — cloud metadata endpoints, internal admin panels, loopback services — abusing trusted network position to reach what clients never could.
Stacking Contexts
A stacking context is a self-contained z-index universe: elements inside it stack against siblings within the same context, and the whole context stacks as one unit against outside elements.
Storage Partitioning
Storage partitioning scopes cookies, cache, and storage per top-level site, so embedded third-party frames can no longer read a shared identity across the sites that embed them.
Stress Testing Beyond Design Limits
Stress testing pushes a system past its expected capacity to find the breaking point and observe how it fails, not merely whether it meets a target.
Structured Concurrency
Structured concurrency ties child tasks to the lexical scope of their parent, so cancelation, errors, and completion propagate through a task tree instead of leaking orphans.
Structured Logging
Structured logging emits machine-parseable events with consistent fields — level, message, ids, context — replacing grep patterns with indexed queries across all services.
Subdomain Takeover
Subdomain takeover claims a dangling DNS record pointing at a released third-party resource — a deleted SaaS tenant, an unregistered bucket — and serves attacker content under your domain.
Subresource Integrity (SRI)
Subresource Integrity pins a cryptographic hash to a script or stylesheet so the browser refuses to execute content that does not match the expected digest.
Surrogate Versus Natural Keys
Surrogate keys are system-generated meaningless identifiers with no business semantics; natural keys are real-world attributes that look stable but change, leak, and merge under pressure.
Symptom-Based Alerting
Symptom-based alerting pages on user-visible problems rather than internal causes, reducing noise because many causes share one symptom.
Head Versus Tail Sampling
Tail sampling decides trace retention after the trace completes — keeping all errors and slow traces while dropping a fraction of healthy ones — trading streaming cost for representative diagnostics.
Tail Latency
Tail latency is the slowest fraction of requests — p99, p999 — and in fan-out systems it dominates user experience, because one slow component holds every page that touches it.
TCP Congestion Window
The TCP congestion window caps how many unacknowledged bytes a sender may have in flight, growing on delivery and collapsing on loss, and it often dominates throughput on long routes.
TCP MSS and Window Scaling
MSS caps the payload each TCP segment carries, and window scaling multiplies the advertised receive window beyond 64KB so long fat networks can actually be filled with data.
TCP Zero Window and Flow Control
A zero-window TCP advertisement tells the sender the receiver buffer is full, pausing transmission until the application reads data and reopens the window.
Coverage Gates
Coverage gates block merges below a threshold — effective as ratchets on changed lines, misleading as global percentages that invite gaming and hide untested critical paths.
Test Data Builders
Test data builders construct valid objects with sensible defaults plus per-test overrides, keeping fixtures readable and centralizing invariants as the domain evolves.
Test Flakiness Metrics
Flakiness metrics quantify how often a test passes and fails on unchanged code, turning a vague feeling into a ranking for repair.
Test Impact Analysis
Test impact analysis selects the subset of tests affected by a code change via dependency mapping, cutting CI time from all-tests to relevant-tests without abandoning safety.
Test Order Dependence
Test order dependence is hidden coupling between tests — one test leaves state another consumes — surfacing only when the runner shuffles or parallelizes and the suite turns red at random.
Test Parallelization and Sharding
Parallelization runs independent tests at once to shorten feedback, but shared state and ordering assumptions make unsafe tests flaky.
Test Quarantine
Test quarantine moves flaky tests out of the blocking CI path into a tracked, non-blocking lane with owners and exit criteria — containing nondeterminism instead of deleting or ignoring it.
Text Embeddings
A text embedding maps text to a dense vector that encodes meaning, letting machines compare and cluster language by proximity in vector space.
Third-Party Cookies and Storage Partitioning
Third-party cookies are set by an origin other than the one being visited, and modern browsers restrict or partition them to limit cross-site tracking.
Thread-Local Storage
Thread-local storage gives each thread its own copy of a variable, avoiding sharing but breaking under pools and async scheduling where threads are reused.
Thread Pool Sizing
Thread pool sizing matches worker count to the work shape: CPU-bound pools want core-count threads, while I/O-bound pools size by concurrency demand and downstream tolerance, not CPU.
Time Travel Testing
Time travel testing swaps the real clock for a controllable one — advancing instantly past retries, subscriptions, and expiry — making temporal behavior deterministic and testable at full speed.
Timestamps and Timezones
Timestamp storage is a policy problem: store instants in UTC, name the type honestly, and convert at boundaries — naive timestamps and per-row local times are the classic outage factory.
Timing Attack
A timing attack infers secrets from response-time differences: how long a comparison, decryption, or lookup takes leaks bits of the secret one branch at a time.
Application-Layer Protocol Negotiation (ALPN)
ALPN negotiates the application protocol such as HTTP/2 or HTTP/3 inside the TLS handshake, avoiding an extra round trip to upgrade after the connection is established.
TLS Session Resumption
TLS session resumption shortens subsequent handshakes by reusing negotiated session state, via session identifiers, session tickets, or QUIC and TLS 1.3 0-RTT early data, cutting repeat-visit latency.
Token Audience Validation
The audience claim names who a token is for; accepting tokens minted for a different API — or skipping audience checks entirely — lets one service token work everywhere.
Tokenization and Subword Units
Tokenization splits text into the subword units a model processes, and its choices shape context limits, cost, and handling of rare or non-Latin text.
Trace Context Propagation
Trace context propagation carries trace and span identifiers across process and protocol boundaries so one distributed trace spans every service.
Transactional Inbox
A transactional inbox stores received messages in the same database transaction as their processing, so consumers handle each message exactly once even under redelivery.
Trigram Indexes for Fuzzy Matching
A trigram index breaks text into three-character sequences so LIKE, ILIKE, and similarity queries can be answered without scanning every row.
TTL Jitter
TTL jitter randomizes expiration times by a fraction of the base TTL so thousands of keys do not expire in the same second, preventing synchronized expiry stampedes.
Twelve-Factor App
Twelve-factor is a methodology for deployable services: configuration from environment, stateless processes, logs to streams, and disposability — the contract cloud platforms automate around.
Unicode Collation
Collation defines how text sorts and compares — case, accents, locale rules — and mismatches between columns, literals, and indexes corrupt equality semantics and index usage.
Unit of Work
A unit of work tracks changes during a business transaction and writes them out in one coordinated commit, centralising transaction and concurrency handling.
Unit Test Boundaries
Unit test boundaries decide what counts as one unit — a function, a class with its collaborators, or a module — trading isolation and speed against mocking depth and behavioral fidelity.
Universal Scalability Law
The Universal Scalability Law extends Amdahl with a coherence term: throughput peaks and then declines as coordination overhead grows quadratically with concurrency.
Upsert with INSERT ... ON CONFLICT
Upsert inserts a row or updates it when a unique constraint is violated, collapsing a race-prone read-modify-write into one atomic statement.
The USE Method for Resource Analysis
The USE method checks utilisation, saturation, and errors for every resource, turning a vague performance complaint into a systematic checklist.
Heap Bloat and Vacuum
PostgreSQL vacuum reclaims dead tuples left by MVCC, and when it falls behind — long transactions, aggressive autovacuum settings — tables bloat and performance decays.
Vary Response Header
The Vary header lists request headers that change the representation, letting shared caches store multiple variants and preventing a compressed response from reaching the wrong client.
Vector Databases
A vector database stores embeddings and answers nearest-neighbour queries, the core primitive behind semantic search and retrieval-augmented generation.
Virtual DOM
A virtual DOM keeps a lightweight programmatic tree as the source of truth, diffs it against the previous snapshot, and applies only the resulting minimal patches to the real DOM.
Virtual Threads
Virtual threads are JVM user-mode threads scheduled onto a carrier pool, mounting and unmounting on blocking operations, so thread-per-request code scales to millions of tasks.
Visual Regression Testing
Visual regression testing screenshots rendered pages or components and pixel-diffs them against approved baselines, catching styling breakage that DOM assertions and functional tests never see.
Visual Viewport
The visual viewport is the on-screen window onto the layout viewport — what pinch zoom, keyboards, and browser chrome actually resize — distinct from the layout viewport media queries see.
WebSocket Protocol
WebSocket upgrades an HTTP connection into a persistent, bidirectional message channel with minimal framing overhead, suited to chat, collaboration, live dashboards, and game state.
SQL Window Functions
Window functions compute aggregates and rankings across row partitions while keeping every row, expressing running totals, deltas, and top-N-per-group without self-joins.
Work Stealing
Work stealing lets idle worker threads pull tasks from busy workers local queues, keeping all cores busy without global lock contention on a single shared queue.
Workload Modeling
Workload modeling designs load tests around realistic traffic mix, arrival patterns, and data distributions — because synthetic average-rate floods predict nothing about production behavior.
Write-Behind Caching
A write-behind cache acknowledges the write after updating the cache and flushes to the backing store asynchronously, trading durability for latency.
Write-Through, Write-Behind, and Write-Around
Cache write policies decide when writes reach the origin: write-through synchronously, write-behind asynchronously with queueing risk, write-around bypassing the cache for writes.
XML External Entity Injection
XXE abuses XML parsers that resolve external entities, letting an attacker read local files or reach internal services through a crafted document.
Zero-Copy I/O
Zero-copy I/O moves data kernel-to-socket or file-to-socket without copying into user space, using sendfile, splice, or mmap, cutting CPU and memory bandwidth per byte served.
Acceptance Criteria
Acceptance criteria are the testable conditions a story must satisfy to be accepted, aligning product intent, implementation, and verification before work begins.
Alert Fatigue
Alert fatigue is the desensitization that follows too many low-quality alerts, causing responders to miss or delay action on the signals that matter.
Anti-Entropy
Anti-entropy is background reconciliation that compares replicas and repairs differences, catching writes missed during failures, partitions, or dropped hints.
API Deprecation
API deprecation is a scheduled, communicated retirement of an endpoint, field, or version, with dates, telemetry, and a migration path before removal.
API Gateway vs Ingress: Which Edge Layer Do You Need?
An ingress routes HTTP traffic into a cluster, while an API gateway manages API consumers. Compare their scope, ownership, and failure modes before choosing.
Architecture Decision Records: The Why Behind the System
An ADR captures one decision, its context, and its consequences in a short versioned file, so future engineers inherit reasoning instead of rumours.
Attack Surface
Attack surface is the sum of entry points an attacker can reach, including APIs, uploads, dependencies, admin tools, and cloud identities, not just public URLs.
Authorization Models (RBAC, ABAC, ReBAC)
RBAC, ABAC, and ReBAC are complementary ways to decide who may do what, based on roles, attributes, or relationships between subjects and resources.
Batch vs Stream Processing
Batch processing runs bounded jobs over stored data; stream processing handles unbounded events continuously. Latency, cost, and correctness requirements decide the fit.
Blast Radius
Blast radius is how much damage a single failure or compromise can cause, measured in tenants, data, credentials, regions, or services affected.
Buffer Pool
The buffer pool caches database pages in memory, absorbing disk latency; hit ratio, dirty-page flushing, and replacement policy determine its effectiveness.
Cache Keys
A cache key is the derived identity of a stored response, built from method, URL, and selected request headers, and it decides when two requests may share a cache entry.
Canary Analysis: Judging a Release by Its Metrics
Canary analysis compares a small slice of production traffic against a baseline and promotes or rolls back automatically, replacing opinion with measurable criteria.
Cardinality Estimation
Cardinality estimation predicts how many rows each query step will produce; bad estimates lead to poor join orders, wrong algorithms, and memory spills.
Certificate Pinning
Certificate pinning hardcodes which keys or certificates a client trusts, blocking connections secured by fraudulently issued certificates for that host.
Change Freeze: When Stopping Change Is the Safer Move
A change freeze pauses non-essential deployments for a bounded window. Done well it protects peak events; done badly it hides risk and delays fixes.
Clock Skew
Clock skew is the difference between clocks on different machines; it breaks timestamp ordering, lease safety, and last-write-wins conflict resolution.
Conditional Requests
Conditional requests let clients revalidate or safely modify resources using validators such as ETag and Last-Modified, avoiding wasted bandwidth and lost updates.
Configuration Drift: When Reality Stops Matching the Repository
Configuration drift is the gap between declared and actual state. Detecting it early keeps infrastructure reproducible and incidents explainable.
Connection Draining: Retiring an Instance Without Dropping Requests
Connection draining removes an instance from rotation and waits for in-flight work to finish, turning a hard cutover into an invisible handover for clients.
Data Contracts
A data contract is an enforceable agreement between a data producer and its consumers covering schema, semantics, quality, freshness, and change management.
Data Lake vs Data Warehouse
A data lake stores raw files for many engines and future questions; a warehouse stores modeled, governed tables for fast SQL and trusted reporting.
Data Lineage
Data lineage records how datasets and columns are derived, so teams can trace errors, assess change impact, and prove where regulated data came from.
Data Mesh
Data mesh is a sociotechnical approach that gives domain teams ownership of analytical data products, supported by a self-serve platform and federated governance.
Data Modeling
Data modeling turns business rules and access patterns into entities, keys, relationships, and constraints so the store can reject invalid states instead of storing them.
Data Quality Dimensions
Data quality dimensions such as completeness, accuracy, consistency, timeliness, validity, and uniqueness turn vague trust into measurable checks with thresholds.
Degraded Mode
Degraded mode is an explicit operating state with reduced functionality, entered deliberately under failure and exited through defined recovery criteria.
Dependency Confusion
Dependency confusion exploits package managers that prefer a public package over a private one with the same name, letting an attacker publish a malicious higher version.
Dependency Graphs: Seeing the Blast Radius Before the Incident
Dependency graphs turn scattered imports, service calls, and package manifests into a map of what depends on what, so impact and risk become visible.