Category git
Dependency Update and Artifacts Promotion in Multi-repo Project
Istio's multi-repo layout loses monorepo atomicity and leaves Bazel dependency SHAs stale. A cron job opening update PRs settles for eventual consistency.
Git as Version Vector
Branches as concurrent updates: happened-before causality, why Lamport clocks can't detect concurrent commits, and how vector clocks reveal when to merge.
Git: Branch off An Unmerged Branch While Committing Often - Disasters and Salvage
Squashing a branch you've already branched off rewrites history and makes rebasing a conflict nightmare. The fix: squash both, cherry-pick, and hard reset.
Category web
How to Configure Applications for High Availability in Kubernetes
Pods are ephemeral. Stay available with graceful SIGTERM handling, health probes, PodDisruptionBudgets, anti-affinity, autoscaling, and monitoring.
Service API Changes: Prefer Blue-green Update to Rolling Update
Kubernetes rolling updates mix old and new servers, so API changes must be forward compatible too. Blue-green updates need only backward compatibility.
JWT + Third-party Oauth in Single Page App
Returning a JWT to a single page app after OAuth login: why session cookies and URL params fall short, and a tiny HTML page that saves it to localStorage.
System Design Interview: Scaling Single Server
Scaling past one server: stateless API servers, sharded memory caches, consistent hashing, Raft or Paxos replication, and DNS to balance load balancers.
Killer Apps of Message Queues
When message queues beat RPC: absorbing traffic spikes with pull-based flow control, pub/sub to cut reverse dependencies, and async results for slow calls.
Session Consistency in Replicated Frontend Servers
Keeping HTTP sessions consistent behind a reverse proxy: gossip sync, consistent hashing, cookies, and why stateless frontends with durable storage win.
Pagination Ordered by Secondary Keys on Sharded Stores
Offset/limit breaks when a table is sharded by primary key but sorted by time or price. Three fixes: external merging, next-page only, and lookup twice.
Kip’s Warehouse: Building Scalable, Reliable, Consistent Web Application from the Ground Up
Building an inventory management app for Duke ECE labs with React, Node.js, Express and MySQL, and why Sequelize transactions became a debugging headache.
Service-Oriented Architecture: Why did Microservices Catch On
What a service tier fixes: duplicated SQL, cache changes forcing every server to upgrade, coupled library versions, and one full scan hogging the DB.
Category microservices
Scaling Istio
Trim xDS config and metrics to stop istio-proxy OOMKills, and keep istiod alive through scale-outs with discoverySelectors, HPA tuning, and idle timeouts.
JWT + Third-party Oauth in Single Page App
Returning a JWT to a single page app after OAuth login: why session cookies and URL params fall short, and a tiny HTML page that saves it to localStorage.
Istio: Noninvasive Governance of Microservices on Hybrid Cloud
How Istio injects an Envoy proxy into each Kubernetes pod for canary releases, secure RPC, policy enforcement, and telemetry with no service code changes.
Killer Apps of Message Queues
When message queues beat RPC: absorbing traffic spikes with pull-based flow control, pub/sub to cut reverse dependencies, and async results for slow calls.
Session Consistency in Replicated Frontend Servers
Keeping HTTP sessions consistent behind a reverse proxy: gossip sync, consistent hashing, cookies, and why stateless frontends with durable storage win.
Pagination Ordered by Secondary Keys on Sharded Stores
Offset/limit breaks when a table is sharded by primary key but sorted by time or price. Three fixes: external merging, next-page only, and lookup twice.
Kip’s Warehouse: Building Scalable, Reliable, Consistent Web Application from the Ground Up
Building an inventory management app for Duke ECE labs with React, Node.js, Express and MySQL, and why Sequelize transactions became a debugging headache.
Service-Oriented Architecture: Why did Microservices Catch On
What a service tier fixes: duplicated SQL, cache changes forcing every server to upgrade, coupled library versions, and one full scan hogging the DB.
Category distributed systems
A Brilliant Hack: Why does Layer 2/3 Checksum use 1’s Complement, Not 2’s
One's complement sums are endianness-independent, so routers verify checksums without ntohs and htons swaps; receivers simply check for all ones.
System Design Interview: Scaling Single Server
Scaling past one server: stateless API servers, sharded memory caches, consistent hashing, Raft or Paxos replication, and DNS to balance load balancers.
A Primer on Secure Communication Channels
Why clear text, symmetric keys, and raw public keys fail, how PKI and certificate authorities solve key distribution, and what a compromised CA breaks.
Git as Version Vector
Branches as concurrent updates: happened-before causality, why Lamport clocks can't detect concurrent commits, and how vector clocks reveal when to merge.
Sloppy Quorum And Eventual Consistency
Choosing availability over consistency: NWR quorums where W + R exceeds N keep reads fresh; smaller ones give eventual consistency, measured by t-visibility.
Reliable & Consistent Service: Linearizable RPC and Replicated State Machine
Why at-least-once RPC with idempotent operations isn't linearizable, how a reply cache gives exactly-once semantics, and why it must survive failover.
Category signal processing
Fourier, Phasors, LTI and All That
A signal is a vector and the Fourier transform a change of basis. Its basis vectors are eigenfunctions of LTI systems, scaled by the frequency response.
Category networking
Scaling Istio
Trim xDS config and metrics to stop istio-proxy OOMKills, and keep istiod alive through scale-outs with discoverySelectors, HPA tuning, and idle timeouts.
Work Around Max Count of Security Group Rules on EKS
EKS NLB Services can exhaust the 1000 security group rules allowed per ENI. Managing rules yourself with consecutive static NodePorts cuts 5 per Service to 2.
Layer-4 Load Balancer & Zero-downtime Autoscaling and Upgrade
externalTrafficPolicy: Local drops NLB traffic on scale-in and rolling upgrades. IP targets or ProxyTerminatingEndpoints, plus a preStop drain, fix it.
Kubernetes Networking From the First Principles
How Pod-to-Pod, ClusterIP, and NodePort traffic flows through network namespaces, veth pairs, the cbr0 bridge, VXLAN, and kube-proxy iptables NAT.
The Good, Bad, and Ugly: Istio for Short-lived Pods
Envoy sidecars keep Istio Job Pods alive and may lag app startup. A webhook-injected wrapper waits for proxy readiness; a controller stops Envoy when done.
DNS, UDP, IP Anycast, and All That
Why DNS prefers UDP: BGP anycast route changes can break TCP connections, and a UDP query takes 2 packets versus 11 for TCP, with no connection state.
Lessons from Scaling GKE: L4 ILB Tops at 250 Nodes
GKE's internal load balancer health-checks only 250 nodes. With externalTrafficPolicy Local, only Nginx nodes pass, so a subset lacking them broke ingress.
A Brilliant Hack: Why does Layer 2/3 Checksum use 1’s Complement, Not 2’s
One's complement sums are endianness-independent, so routers verify checksums without ntohs and htons swaps; receivers simply check for all ones.
JWT + Third-party Oauth in Single Page App
Returning a JWT to a single page app after OAuth login: why session cookies and URL params fall short, and a tiny HTML page that saves it to localStorage.
A Primer on Secure Communication Channels
Why clear text, symmetric keys, and raw public keys fail, how PKI and certificate authorities solve key distribution, and what a compromised CA breaks.
Sloppy Quorum And Eventual Consistency
Choosing availability over consistency: NWR quorums where W + R exceeds N keep reads fresh; smaller ones give eventual consistency, measured by t-visibility.
Category istio
Scaling Istio
Trim xDS config and metrics to stop istio-proxy OOMKills, and keep istiod alive through scale-outs with discoverySelectors, HPA tuning, and idle timeouts.
The Good, Bad, and Ugly: Istio for Short-lived Pods
Envoy sidecars keep Istio Job Pods alive and may lag app startup. A webhook-injected wrapper waits for proxy readiness; a controller stops Envoy when done.
Istio: Noninvasive Governance of Microservices on Hybrid Cloud
How Istio injects an Envoy proxy into each Kubernetes pod for canary releases, secure RPC, policy enforcement, and telemetry with no service code changes.
Dependency Update and Artifacts Promotion in Multi-repo Project
Istio's multi-repo layout loses monorepo atomicity and leaves Bazel dependency SHAs stale. A cron job opening update PRs settles for eventual consistency.
Category security
A Primer on Secure Communication Channels
Why clear text, symmetric keys, and raw public keys fail, how PKI and certificate authorities solve key distribution, and what a compromised CA breaks.
Category docker
Docker Multi-stage Build: Fast, Minimal and Secure Images
Docker multi-stage builds run independent stages in parallel, shrink images without chaining RUN commands, and keep private-repo SSH keys out of the image.
Docker: The Container Metaphor with Profound Revolution
Docker is more than virtualization: hermetic images bundle app, config, and dependencies for universal tooling, atomic upgrades, and stateless containers.
Category kubernetes
Scaling Istio
Trim xDS config and metrics to stop istio-proxy OOMKills, and keep istiod alive through scale-outs with discoverySelectors, HPA tuning, and idle timeouts.
Work Around Max Count of Security Group Rules on EKS
EKS NLB Services can exhaust the 1000 security group rules allowed per ENI. Managing rules yourself with consecutive static NodePorts cuts 5 per Service to 2.
Layer-4 Load Balancer & Zero-downtime Autoscaling and Upgrade
externalTrafficPolicy: Local drops NLB traffic on scale-in and rolling upgrades. IP targets or ProxyTerminatingEndpoints, plus a preStop drain, fix it.
Kubernetes Networking From the First Principles
How Pod-to-Pod, ClusterIP, and NodePort traffic flows through network namespaces, veth pairs, the cbr0 bridge, VXLAN, and kube-proxy iptables NAT.
Lessons from Scaling GKE: L4 ILB Tops at 250 Nodes
GKE's internal load balancer health-checks only 250 nodes. With externalTrafficPolicy Local, only Nginx nodes pass, so a subset lacking them broke ingress.
How to Configure Applications for High Availability in Kubernetes
Pods are ephemeral. Stay available with graceful SIGTERM handling, health probes, PodDisruptionBudgets, anti-affinity, autoscaling, and monitoring.
Service API Changes: Prefer Blue-green Update to Rolling Update
Kubernetes rolling updates mix old and new servers, so API changes must be forward compatible too. Blue-green updates need only backward compatibility.
CD Tricks for Kubernetes Deployment + ConfigMap
Two kubectl tricks: update a ConfigMap from file via dry-run piped to apply, and use a CONFIG_HASH env var so config edits trigger a zero-downtime rollout.
Docker Multi-stage Build: Fast, Minimal and Secure Images
Docker multi-stage builds run independent stages in parallel, shrink images without chaining RUN commands, and keep private-repo SSH keys out of the image.
Category operation
Navigating Shell for Productivity and Profit
Shell tricks and my setup: brace expansion, process substitution, heredocs, aliases, fzf history search, and zsh with oh-my-zsh and powerlevel10k.
How to Configure Applications for High Availability in Kubernetes
Pods are ephemeral. Stay available with graceful SIGTERM handling, health probes, PodDisruptionBudgets, anti-affinity, autoscaling, and monitoring.
Service API Changes: Prefer Blue-green Update to Rolling Update
Kubernetes rolling updates mix old and new servers, so API changes must be forward compatible too. Blue-green updates need only backward compatibility.
CD Tricks for Kubernetes Deployment + ConfigMap
Two kubectl tricks: update a ConfigMap from file via dry-run piped to apply, and use a CONFIG_HASH env var so config edits trigger a zero-downtime rollout.
Category career
More Career Advice
Ask for help, build influence through thought leadership, invest in peers early, lean into conflict, apologize well, and go straight to the job you want.
Life and Investment Through the Lens of Uncertainty
Judge decisions, not outcomes: why holding longer makes a loss less likely, why the past was uncertain too, and why you must avoid getting wiped out.
Software Engineering Levels and Promotion
What's expected of new grad, senior, staff, and principal engineers (L3 to L7+), and why promotion comes from consistently delivering next-level scope.
What to Talk about in Effective 1-on-1s
Bring your manager questions, not status updates: expectations at your level, gaps to your next career goal, and how happy you are with projects and team.
Advice I wish I got at the start of my career
Prioritize learning over pay, join a breakout-stage company, build prestige through writing and talks, and vet your future manager before taking an offer.
Category go
Parameters with Defaults in Go: Functional Options
Option structs can't tell zero from unset, pointer fields are clumsy, and variadics cover one parameter. Functional options give Go overridable defaults.
Category cloud
Scaling Istio
Trim xDS config and metrics to stop istio-proxy OOMKills, and keep istiod alive through scale-outs with discoverySelectors, HPA tuning, and idle timeouts.
Work Around Max Count of Security Group Rules on EKS
EKS NLB Services can exhaust the 1000 security group rules allowed per ENI. Managing rules yourself with consecutive static NodePorts cuts 5 per Service to 2.
Layer-4 Load Balancer & Zero-downtime Autoscaling and Upgrade
externalTrafficPolicy: Local drops NLB traffic on scale-in and rolling upgrades. IP targets or ProxyTerminatingEndpoints, plus a preStop drain, fix it.
Lessons from Scaling GKE: L4 ILB Tops at 250 Nodes
GKE's internal load balancer health-checks only 250 nodes. With externalTrafficPolicy Local, only Nginx nodes pass, so a subset lacking them broke ingress.
Category investment
Notes: Venture Deals
Notes on Venture Deals by Brad Feld and Jason Mendelson: option pools, liquidation preference, pay-to-play, anti-dilution, board control, and no-shop clauses.
Life and Investment Through the Lens of Uncertainty
Judge decisions, not outcomes: why holding longer makes a loss less likely, why the past was uncertain too, and why you must avoid getting wiped out.
Category startup
Notes: The Lean Startup
Notes on Eric Ries's The Lean Startup: validated learning, MVPs, Build-Measure-Learn, vanity vs cohort metrics, pivots, and sticky, viral and paid growth.
Notes: Venture Deals
Notes on Venture Deals by Brad Feld and Jason Mendelson: option pools, liquidation preference, pay-to-play, anti-dilution, board control, and no-shop clauses.
Enterprise Sales
Layering enterprise sales onto PLG: features worth a premium, the $1M ARR rule of thumb, your first sales hire, 10-80-10 outbound, and when to discount.
Interviewing Adrien Treuille, Founder CEO of Streamlit
Streamlit's founder on the $800M Snowflake acquisition, OSS metrics, Apache 2 licensing, PLG vs sales, community contributions, and hiring leaders sooner.
Accounting Advice for Founders
Notes on a PwC partner's lecture: collect sales tax early, classify expenses so less is reported as overhead, run a 409A yearly, and guard against fraud.
Intellectual Property and Entrepreneurship
IP law notes for founders: patents, copyright, trademarks, trade secrets, NDAs, California IP assignment rules, and open-source licenses from GPL to MIT.
Category oss
Interviewing Adrien Treuille, Founder CEO of Streamlit
Streamlit's founder on the $800M Snowflake acquisition, OSS metrics, Apache 2 licensing, PLG vs sales, community contributions, and hiring leaders sooner.
Category artificial intelligence
Trace a Token Through TP + CP + SP + EP + DP + PP in MoE Inference
How tensor, context, sequence, expert, data and pipeline parallelism compose in MoE prefill on 32 GPUs, and why experts force DP replicas into lockstep.
5.5x Faster HuggingFace Tokenizers for a Single Sequence
Use all cores on one long input with output identical to serial: Llama 3 tokenizes 4MB in 163ms, not 805ms, cutting text only where it's proven safe.
Accelerate LLM Inference with Speculative Decoding
Verify a draft model's tokens in one forward pass without changing the output distribution, or drop the draft model for Medusa heads and tree attention.
Parallelizing Multi-Head Attention
Why multi-head attention code transposes Q, K, V to (B, heads, T, head_dim) after the reshape: so one batched matmul computes every head in parallel.
Category llm
Trace a Token Through TP + CP + SP + EP + DP + PP in MoE Inference
How tensor, context, sequence, expert, data and pipeline parallelism compose in MoE prefill on 32 GPUs, and why experts force DP replicas into lockstep.
5.5x Faster HuggingFace Tokenizers for a Single Sequence
Use all cores on one long input with output identical to serial: Llama 3 tokenizes 4MB in 163ms, not 805ms, cutting text only where it's proven safe.
Accelerate LLM Inference with Speculative Decoding
Verify a draft model's tokens in one forward pass without changing the output distribution, or drop the draft model for Medusa heads and tree attention.
Parallelizing Multi-Head Attention
Why multi-head attention code transposes Q, K, V to (B, heads, T, head_dim) after the reshape: so one batched matmul computes every head in parallel.
Never miss a story from me, subscribe to my newsletter