TechBlog

I was deep in a research thread that was not going to become a weekend post. The topic started small: juniors asking an AI to format code that Prettier already owns, or to invent a debounce helper the repo already has. It got larger fast. Sometimes the person is not a developer at all — they have an idea, they paste a warning into ChatGPT, the “build” goes green, and they never learn that the message was ESLint. The software can become more sophisticated than the operator’s mental model. That is a different problem than “juniors are lazy,” and it is too big to finish in one sitting. ...

Command & Conquer Generals: Zero Hour is not a demanding game in 2026. On the internal panel of this ASUS Vivobook Pro 15, it stays quiet. Plug the same laptop into an old 1080p HDMI monitor, launch the same Wine/Lutris game with no prime-run, and the chassis warms up. The fans come on. Unplug the monitor, and it cools down again. That is a bad mental model if you assume “old game = Intel GPU = cool laptop.” On a hybrid machine, who renders the frames and who owns the physical connector are two different questions. My native HDMI port is wired to NVIDIA. As long as that monitor is connected, the RTX 3050 has to stay in the display path — even when Mesa Intel Arc is doing all the actual drawing. ...

Cross-team trust is one of the strongest assets a senior developer can build. People tell you what is not working before it becomes an escalation. Designers invite you into early conversations. Product asks whether an idea is feasible. Support sends you the user complaint that explains a confusing metric. You see the product beyond the boundary of your team’s backlog. Then the strength turns. Another team believes you promised a fix. Your lead learns about new work after you have started it. Your teammates feel that your review comments carry an unofficial veto. You still think you are helping, but the organization has begun treating you as the owner. ...

In the first post in this series, I called the pattern shadow ownership: a senior developer builds real cross-team influence, then commitments and product authority begin moving through that influence without a clear role. For a team lead, this can feel personal. You are accountable for delivery, but another person appears to be setting expectations. Other teams go to them first. Work enters through conversations you did not see. Their care for the product can sound like a judgment on everyone else’s care. ...

On a small development team, one senior developer often becomes the person everyone else knows. People in product, design, support, and adjacent engineering teams message them directly. They listen well. They notice the rough edge that never became a ticket. They understand why a technically correct interaction still feels wrong to the person using it. When another team is frustrated, they do not reply with a Jira link and disappear. ...

For years, frontend engineering had a comforting boundary. The backend held the real power: databases, payments, authorization, infrastructure, production secrets. The frontend rendered the interface. It ran in the browser, where users could inspect it, modify it, and ultimately distrust it. That model still contains an important truth. The browser is not a trusted environment. A serious authorization decision cannot depend on what a client-side application chooses to show or hide. ...

If you fired up yay -Syu over the past week and noticed your AUR packages silently refusing to update, you’re not imagining it — and it isn’t a bug in your helper. As of August 1, 2026, Arch Linux disabled all pushes to the Arch User Repository, meaning maintainers could no longer publish updates, new versions, or fixes to the community package collection that most of us rely on daily. The AUR stayed up and readable, but writes were locked down while the project fought off its third supply-chain attack since June. ...

Most terminal setups begin as a few helpful aliases and end up scattered across a shell profile, a terminal-emulator menu, a font download, and a handful of plugins cloned years ago. That works until you set up a new machine, connect over SSH, or need to find out why a terminal takes three seconds to open. The answer is not a single perfect terminal or shell. A maintainable command-line workspace is a set of small, replaceable layers with clear ownership. You should be able to change your shell without losing your SSH configuration, replace a terminal emulator without rewriting aliases, and bootstrap a new machine without copying your entire home directory. ...

For years, the default Angular auth tutorial looked like this: call /login, get a JWT, stash it in localStorage, attach Authorization: Bearer … from an interceptor, and sprinkle a couple of route guards on top. It ships. It demos well. And it quietly trains teams to treat the browser as a safe place for long-lived credentials. It is not. In 2026 the guidance has converged, and it is blunt: Prefer OAuth 2.0 / OIDC with a reverse proxy or dedicated auth provider — not a hand-rolled password form that mints forever-tokens for the SPA. Prefer short-lived access tokens (and refresh handled outside the SPA) over long-lived credentials in the browser. Prefer HttpOnly, Secure, SameSite cookies over storing sensitive JWTs in localStorage or sessionStorage. This post is the practical shape of that advice for Angular apps: why localStorage JWTs lose to XSS, how a Backend-for-Frontend (BFF) or reverse-proxy session keeps tokens off the client, and what Angular still owns — interceptors, CSRF headers, and guards that improve UX without pretending to enforce authorization. ...

At first glance, a client-side JavaScript framework looks like “just” UI code. It runs in the browser, the browser already has security boundaries, and most of the app logic is yours. So what exactly is a “security update” for that framework supposed to fix? The answer is the same whether you use Angular, React, Vue, or anything else in the same role: the framework is not only application code — it is part of the security boundary. It parses templates or JSX, sanitizes HTML, protects against XSS and related request attacks, and in many apps also powers server-side rendering. If the framework makes a mistake in any of those layers, an attacker may be able to steal data, inject script, or break request isolation even though the code ultimately runs in a browser or helps render content for one. ...