The shelf — 24k

Stop overoptimizing everything for economy

Wed, 28 Oct 2026 00:00:00 GMT

Will you question it or turn a blind eye? - to avoid getting hurt.

Imagine an ocean, brimming with full of marine life, and you see various class of predators, preys, plants coexist. Each animal has it’s own place in the ocean purely based on its nature. By that, corals have a permanent place on the ocean rocks, and rocks root onto the ocean floor. Nobody ordered them to live so low, beneath all the other creatures, forever. It is just what they are.

Pretty cool. A fragile equilibrium guides their lives. No single creature on the ocean got the power to dictate where the others should live or what they should do with their lives. Everybody gets to live, based on what they perceive around them.

Now, based on what I perceive around me, I feel we have been dictated how to live by a selected few monopolies. Over the years, their intentions have ultimately got biased around money and time Nothing wrong with that, and we can debate it is somewhat the same case with marine life too ~~(replace money with food)~~, I don’t deny that - but the problem I see is, on one side marine animals get to live with freedom to do whatever they feel like it. On the other side, humans lack options. Their choices have been heavily constricted by monopolies. It’s often the case where you don’t get to choose what you wanted to do with the fullest of your ability or, you simply don’t care anymore - coz you have been baptized by the monopolies. Monopolies optimize their choices for money & time - the two fundamental, intertwined commodities in human lives, and their choices are passed down to humans. Anytime a circle of community goes extinct, we reason “the market moved on”, or “nobody wants this anymore” - but think deeply, who decided that? who forced those seed of thoughts into you? and who else have been affected the same way? Did you choose to accept it or were you forced to turn a blind eye? Can you deny the fact that you’ve been enslaved against your true will?

Think… draw the connections. See the truth for yourself. We have been conditioned in the name of pursuing greatness, often blindly and by not leaving enough power to the regulating bodies. Ah, but to no one’s surprise they join the party late and virtually powerless just like us.

We pay with our lives for the betterment of a company, or a country - the pool of poured life energy is what further strengthens it. When they overoptimize that process, someone has to pay for the commodities. Coupled with monopolies in this game and lessening choices to extract commodities from, the structure collapses from within.

https://www.apricitas.io/p/ai-and-the-fall-of-the-creative-class

https://news.ycombinator.com/item?id=50226419

Moral of the story? nothing… I’m just making arm chair speculations.

Named Colors

Fri, 23 Oct 2026 00:00:00 GMT

List of all colors that were named in one cube.

Names like Larksurp boquet, King lime are okay, but “Alright Then I Became a Princess” what?! who names colors like that… I wonder whether pantone colors are listed here too.

https://names.color.pizza/

Frontier nerfbench

Wed, 30 Sep 2026 00:00:00 GMT

Sometimes, the bitter day you had with your agents reflects here

see if models regress after release - https://www.bridgebench.ai/nerf-bench

Purelymail

Mon, 28 Sep 2026 00:00:00 GMT

A email client for $10/yr (or even less). Supports custom domain, with good IP reputation and has a great team.

Purelymail, I just set up one and it’s really cool! time to update all my email links on LinkedIn and stuff.
https://www.emaildiscussions.com/showthread.php?t=77218

Breaking ties with google playstore

Sat, 26 Sep 2026 00:00:00 GMT

High friction app distribution for an indie

Having the worst search results, and terrible recommendations it has for their primary users, it also bothers small indie developers so much like described here https://gultsch.de/posts/breaking-up-with-google-play/

discussions: https://news.ycombinator.com/item?id=49855315

Keep scrolling, keep scrolling until you reach

Sat, 26 Sep 2026 00:00:00 GMT

I'll oneday humbly steal this style someday

https://anoma.ly/notes/opencode-reloaded/ keep scrolling, keep scrolling… read read keep on scrolling… until you reach the end

Linux journey

Fri, 25 Sep 2026 00:00:00 GMT

Interactive guide. Gotta check the site and learn a little everyday

Learn linux basics (interactively):

Диван, давай воркай
https://labex.io/linuxjourney

Throwing a wrench into model development

Fri, 25 Sep 2026 00:00:00 GMT

A necessary deed or a sin (from company's pov) ?

Ah, another person fearing the growth of AI and quitting his job: https://robert.ocallahan.org/2026/09/goodbye-google.html

All his points had reasonable concern, but nothing is going to change.

Real reason behind layoffs and rehires

Mon, 14 Sep 2026 00:00:00 GMT

rationalizing, poor organization efficiency, negative business ROI and misaligned incentives - all this calls for a reset

THE REAL REASON BEHIND LAYOFFS: https://m.youtube.com/watch?v=fv8zpYI9n6s (absolute gem, must watch).

Layoffs are too justified it makes me slightly angry… Ah but what can you do… AHHHH the upper echelons! Stop playing with economics like that…

The single main thread

Sat, 12 Sep 2026 00:00:00 GMT

Frontend optimizations should favour time over the amount

Webapp optimizations rarely has anything to do with your code, but more on what lands on main thread often. I see frontend frameworks in a new angle now…

https://kciter.so/posts/the-expensive-main-thread/en/

Operating clickhouse at petabyte scale

Fri, 11 Sep 2026 00:00:00 GMT

He had operated petabyte-scale ClickHouse clusters for 5 years

Mostly about choosing the right storage (local / cloud), sharding vs replica with partitioning - based on latency or QPS requirement. Oh I forgot about choosing compression algorithm, problems during upgrades, injestion side-effects and handling backpressure. I could add part 2 finding here too (but more on this later).

https://www.tinybird.co/blog/what-i-learned-operating-clickhouse
https://www.tinybird.co/blog/what-i-learned-operating-clickhouse-part-ii

Discussions:
https://news.ycombinator.com/item?id=49601138

Seagate fails twice as fast as WD

Thu, 10 Sep 2026 00:00:00 GMT

Seagate drive failures are 2x compared to WD

Test setup and observations: https://www.xda-developers.com/re-evaluating-all-of-the-hdds-in-my-nas/

I’m about to crie.
[looking at my seagate external SSD]

Transaction networks

Thu, 10 Sep 2026 00:00:00 GMT

Visa, Mastercard, RuPay what do they do?

Authorization, Clearning, and settlement of funds over the wire. Also about disputes and arbitration. More on: https://tautology.town/2026/06/01/card-networks.html

Discussion: https://news.ycombinator.com/item?id=49614280

Also, europe is now building European Payments Initiative, but that is similar to UPI in india (direct account to account transfer).

Full E2E GPU rendered UI

Wed, 09 Sep 2026 00:00:00 GMT

Please delete chromium and electron apps for me pls

https://gpui.rs/ GPU rendering framework for UIs, a proper GPU UI

tldr: To me, if this can replace electron apps, and chromium wrappers (like discord), then it is totally worth to check this project. And based on quick investigation, it is certainly possible! (excluding some annoying discord nitro and other collaborative activities).

Detailed breakdown with method names: Link to ChatGPT

There is also odin, and it’s own video editor (built entirely with odin). That is interesting to check out too blick editor.

You can also check out GPU UI on neovim by teejdevries

New: someone wrote telegram desktop in rust with GPUI https://github.com/shinycake/quill
and rumours say discord is officially being rewritten under the codeword “phoenix”.

Most European pilled models for ya apps

Wed, 09 Sep 2026 00:00:00 GMT

They got iOS support primarily, then they support android. Got a macos cli too. The models are extremely lightweight, runs completely in local, so worth checking out. Shoutout to the glorious GDPR

Most European pilled models. These guys are cooking… ~~but I still don’t see how they make money.~~
https://desertant.com/blog/introducing-desert-ant-labs/

Okay, Every model is free up to 100k monthly active devices per SDK. Unlimited inference per user. Might copy this design style someday https://news.ycombinator.com/item?id=49626960.

Their site actually looks clean.

discussion thread: https://news.ycombinator.com/item?id=49625275

No internet still means yes

Sat, 05 Sep 2026 00:00:00 GMT

The push notifications, and in-app ads - sometimes they simply don't care even when you have disabled internet access in app info. Now you know why.

Content taken from https://t.me/AppManagerChannel/461

Why do certain apps have no internet permissions while they apparently connect to the internet?

They are using a separate provider application. This is true for a lot of applications that use FCM/UnifiedPush protocols to provide notifications (in which case they are either using Google Play Services or a UnifiedPush client). Large software vendors also do something similar: Gemini, for example, doesn’t have an internet permission because it does all the API calls via the Google app.

Why do certain apps connecting to the internet despite blocking its internet permission?

Again, they might be using a different provider. This is especially true for push notifications for the exact same reason above. This might actually be a good thing if it is solely used for push notifications as you do not miss out on the notifications even after blocking the internet connection. However, this also means telemetry may also be delivered via another app (e.g., Google Play Services). This is why these UID-backed firewall are often not enough (and as some of you know, I often criticize these firewall technology). An effective firewall would be the one that blocks the tracker URLs altogether: personalDNSfilter is one such tool, which is also very lightweight.

How about other firewall technologies?

The backend I have developed to enable this “permission overlay” can be utilized to add traditional ip-tables style blocking (requires root), net policy-based blocking (supported by Lineage OS), and VPN-based blocking. VPN-based blocking is probably unsuitable for App Manager, and even if it is implemented, we need to take into account my own criticisms about the VPNs: URL based blocking alongside regular app-specific blocking and support for actual VPN configurations or proxies.

How to write the perfect function

Sun, 23 Aug 2026 00:00:00 GMT

For humans, by humans. But honestly, his suggestions are really good. Try them out in your job.

No tl;dr, just watch: https://m.youtube.com/watch?v=2OMRWPOSw9s

A question for yourself after you finished watching it:
What type of function have you always written - honest or dishonest? And will you change it?

Colors immune to night shift

Sat, 15 Aug 2026 00:00:00 GMT

A specially made colorscheme, that doesn't bleed or fade even when you use extreme night shift (the "warm" color tint you use).

Ember – Redshift safe color palettes: https://github.com/carpdiem/ember

That’s a… surprisingly deep question. I’m actually a physicist by background first, so I got my start doing waaayyy too many calculations with blackbody and emissions spectra.
Then, back in 2010, when I was just getting into startups, I spent two weeks straight at Powell’s in Portland reading through their graphic design section.
After that, I never got very far away from light or perception… AR/VR -> graphics -> silicon photonics -> physical AI (now).
I’m still very much learning, but if you like this stuff and want to learn more yourself there’s a couple sources I can recommend:

Interaction of Color, by Josef Albers. Amazing book, but you really want to get a physical copy.

I really like this talk from SciPy 2015 to get a sense of how people work with and talk about color maps in practice: https://www.youtube.com/watch?v=xAoljeRJ3lU

This is a really, really thorough (and beautifully illustrated) article on what color spaces are: https://www.makingsoftware.com/chapters/color-spaces-models-and-gamuts

And last, I wrote a very technical blog post a few years back, if you want to see some math on a bunch of this: https://www.usuallypragmatic.com/projects/Generating-Color-Temperature-Equivalent-Light-with-RGB-LEDs.html

discussion: https://news.ycombinator.com/item?id=49307601

DRAM unlock nerd stuff

Fri, 14 Aug 2026 00:00:00 GMT

Stripping out security layers behind DRAM memory allocation

Despite having all this, we still see exploits like use after free in 2026. That raises a question - do they really matter or not?

They do, but not when you pass an unsanitised string into eval(), then nothing can save you. Typically those data pages have NX (no execute), W^X (either write or execute, not both) flags set, but copying it to eval() means you’ll run the bytes anyway (command injection)…

Broadly, security measures enable:

restricting access & execution of user land page files (SMAP, SMEP - supervisor mode access / execution prevention)
concealing the actual mem addresses even to the same process running in the same memory space (to avoid copying of data through a compromised part from same process)
isolation of memory resources & translation layers (the other party doesn’t even know whether a resource exists or not, let alone guess)
prevent impersonation (like devices copying data through DMA (direct memory access), by acting like one).
more hardcore restrictions (data that is only visible to ring -2, 2 level below kernel’s ring 0)
cryptographic trust (to prevent hw exploits, and runtime system tampering)

Cache mechanisms in place before reading a single bit from the DRAM (ordered, assume everything misses) ^[1]:

TLB translation buffer (virtual address -> physical address mapping + permissions)
walks 4 levels of pages (PML4, PDPT, PD, PT) + LA57 (5th), and finds a pointer to top-level page table addresses in (CR3) register. And the corresponding frame in CPU’s SRAM cache (dedicated SRAM cache to store these page tables, not the same as the cache from next point).
L1, L2, L3, LLC (last level) caches

If you do not want any of that, and wish to have a straight conversation with DRAM directly, follow https://github.com/xoreaxeaxeax/skitter-creek-bath-salts

Footnotes

based on my understanding, I’m not an expert in this topic so please cross check with actual resources. ↩︎

Best source to learn pathfinding

Sun, 09 Aug 2026 00:00:00 GMT

A set of interactive example, to learn path finding. Really well made resource.

I learned about this technique in 2007, then tried writing it up in 2015. I realized that I didn’t understand it enough to be able to explain it. I studied it off and on in 2016, 2018, 2019, 2022, 2024, and 2026. I abandoned and restarted this page many times. And by 2026 I think I understand it well enough to write this page.

https://www.redblobgames.com/pathfinding/heuristics/differential.html

Do this on your phone if you have root

Sun, 26 Jul 2026 00:00:00 GMT

Just prevent your android os from killing applications overnight.

Do you have a completely satisfying amount of RAM on your Android device? And yet still experience losing your app state overnight, as it’s now missing in recents? Be it a photo editor or incognito mode in a browser?
Turns out that in AOSP defaults, you’ll only be left with 5 tasks (or one less, if to trust some reports) after 6 hours of last use. If a TikToker commits to a test by clicking each app on home screen one by one, all of these tasks will stay in recents. But if you want to go back to something from a day or two ago, it can be missing. Now you know why.

The culprit has a simple name: config_minNumVisibleRecentTasks. It’s set to 5. Set to it to 30 and you’ll live a happier life. A tiny bit of RAM will be used to keep the task state and its visual snapshot, while the processes will still be treated exactly the same. You’ll just get to keep the state. Works best if combined with LMO’s transistor mode

source: https://t.me/TadiBlog/997

Pick a random book

Thu, 23 Jul 2026 00:00:00 GMT

A decent collection of non-fictional books, decently categorized too.

Author used to roam around in library and help people arranging the books in shelf. Super annoyed by this job, out of boredom one day he started randomly reading pages just before the moment he put them in rack. Suddenly it was fun to know a thing or two about random topics and genre: https://resobscura.substack.com/p/quality-non-fiction-books-are-the

My picks from book price index:

Stay True
How to Say Babylon
Bad Blood
Somewhere Towards the End
The Travels of a T-Shirt in the Global Economy
Far from the Tree

Also check: Book Recommendations

Cashflow from your pockets

Sat, 11 Jul 2026 00:00:00 GMT

Really interesting project, centralized hub to manage personal finance... gotta try it out.

Visualizations are looking really neat, I wish my banks are supported… sadly no first party integrations available yet… But still going to give it a shot, they support importing bank statements from pdfs and csvs. I can prepare that

project: https://github.com/we-promise/sure

Learn x in y minutes

Mon, 15 Jun 2026 00:00:00 GMT

Learning javascripts in minutes, explore other topics too

Learn javascript in y minutes: https://learnxinyminutes.com/javascript/

Find public events

Wed, 10 Jun 2026 00:00:00 GMT

I was always interesting in knowing what events happen inside the big buildings and holiday inns.

Site that aggregates public events happening in various places:

music specifically:

https://www.bandsintown.com/

Navigate without mouse

Fri, 05 Jun 2026 00:00:00 GMT

If you install this, use this for 2 weeks straight, no matter what. And then decide.

I assure you, please give it a try for 2 weeks. Just 2 weeks. Then you cannot stop. Navigating across screen becomes so natural and intuitive, it almost feels like muscle memory. Opening menu bars, selecting text, taking screenshots - you’ll be able to do everything in near instant. It is almost like the difference between talking and typing. You can talk to your computer through thoughts directly, without translating them to swipes and figuring out where the mouse pointer is.

demo: https://m.youtube.com/watch?v=kaizkf_lXPI
site: https://mouseless.click/

Envelope Encryption

Wed, 03 Jun 2026 00:00:00 GMT

Learn about envelop encryption, data encryption at rest

Best resource I’ve read to understand how KEK (key encryption key), and DEK (data encryption key) work together. The site also explains some common pitfalls, key rotation best practices, and insights on certification requirements (like PCI DSS).

site: https://devsecopsschool.com/blog/envelope-encryption/#quick-definition-3060-words

Interesting job listings from interesting companies

Fri, 29 May 2026 00:00:00 GMT

Companies that have unconventional ways of hiring, and you might like it.

Places to search interesting companies from:

Wikipedia doomscroller

Wed, 27 May 2026 00:00:00 GMT

Atleast this form of doomscrolling does not smelt your brain alive

Wikipedia Doomscroller: https://xikipedia.org/

Takes around 40MB, works offline… Wait, actually why this is still a site? Why nobody had made an app yet? (If you make one pls lmk, I’d love to try it. Also would love to see what you’ve added on top of it!)

Note: Do not get scared of the loading screen that shows up everytime - some kind of indexing happening. It does not download wikipedia data everytime on launch. So, no need to worry.

Evaluation Criteria

Sun, 24 May 2026 00:00:00 GMT

Take a transcript of your own voice and evaluate.

Use these items to create a prompt. it’s going to be nothing but a fun practice session.

Metaphor Mania

Tags: Lateral Thinking, Conciseness, Agility
Quickly build analogies without letting the pressure get to you
Button: Start Practising

Tell a Story

Tags: Articulation, Structure, Lateral Thinking
Maintain your train of thought with plot twists along the way
Button: Start Practising

No Filler

Tags: Filler Words, Articulation, Structure
Speak without using filler words like ‘um’, ‘like’, and ‘so’
Button: Start Practising

Storyteller

Tags: Articulation, Structure, Lateral Thinking
Tell a creative story with the help of your AI co-author
Button: Start Practising

Source: Yoodli.ai.

You can use the meeting option from voxtype - best voice-to-text tool I’ve ever used in linux & mac.
Also, checkout stressmark - A terminal tool I created to practice speaking with proper intonation. (you can also export pdfs / html with all highlights)

LLM tokens speed simulator

Thu, 21 May 2026 00:00:00 GMT

LLM tok/s can cross 10k+ in near future, so just imagine

Looking forward to the day when Cerebras x OpenAI happens. Can’t wait to use agents at a wallet draining speed of ~1000tok/s…

LLM token visualiser (speed): https://mikeveerman.github.io/tokenspeed

Creating redis

Sat, 16 May 2026 00:00:00 GMT

Creating your own redis from scratch.

Typa stuff ppl ask in openai interview btw. https://build-your-own.org/redis/ Do me a favour and build the same thing in another language. (Please never ever touch C++ ever again. Reason? look at their official mascot)

Cheapest VPS?

Fri, 15 May 2026 00:00:00 GMT

Maybe worth a try?

Cheapest VPS I found https://tierhive.com/r/AD3AFC1F50FF ~~(yes affiliated link)~~.

Just fucking use go

Fri, 15 May 2026 00:00:00 GMT

Just use golang. dot.

It is go today, but it will be soon become Jai or Odin. Please never ever touch C++, I pray you.

site: https://blainsmith.com/articles/just-fucking-use-go/

Salary compensation insights

Fri, 15 May 2026 00:00:00 GMT

Absurd numbers, yet companies do pay them.

Salary of devs scraped from leetcode discuss page:

https://anugrahsinghal.github.io/LeetComp/
https://0xku.github.io/leetcode-compensation/ (version 2, actively maintained)

Now, use these numbers with tactics in 10 rules for negotiating offer

Websockets 101

Tue, 12 May 2026 00:00:00 GMT

From bidirectional echoserver to building a robust multi-player game.

omg claude (I’ll share the link once it’s ready) https://claude.ai/share/ede94c96-26f1-4c1e-872d-74ce5c09364f. if you can’t see it for somereason, here’s a breakdown:

Phase 1 — WebSocket Foundations (~5 hrs)

1.1 How WebSockets work under the hood (1.5 hrs)

WebSocket is a full-duplex, persistent TCP connection initiated via an HTTP/1.1 Upgrade handshake. Understand the 101 Switching Protocols response, the Sec-WebSocket-Key/Accept handshake, and how frames are structured (FIN, RSV, opcode, MASK, payload length, masking key).

Tags: core protocol

Footgun: WebSocket has nothing to do with HTTP after the handshake. CORS does NOT apply — the server must validate the Origin header manually.

Resources:

1.2 Browser WebSocket API (1 hr)

new WebSocket(url), readyState, onopen/onmessage/onerror/onclose events, send(), close(code, reason). Sending both text and binary (ArrayBuffer / Blob). Inspecting frames in DevTools Network tab.

Tags: browser

Tip: Always set binaryType = 'arraybuffer' if you’re sending binary — the default 'blob' is awkward to work with in game loops.

Resources:

1.3 Opcodes, frames & control frames (1 hr)

Text (0x1) vs Binary (0x2) vs Continuation (0x0) frames. Control frames: Close (0x8), Ping (0x9), Pong (0xA). Fragmentation — splitting large messages across multiple frames. Close codes: 1000 normal, 1001 going away, 1006 abnormal, 1011 server error.

Tags: core protocol

Footgun: Client frames MUST be masked. Server frames must NOT be masked. Get this wrong and the peer drops the connection immediately.

Resources:

1.4 ws vs wss — TLS in production (0.5 hrs)

wss:// is WebSocket over TLS. Always use wss in production. Your load balancer terminates TLS and forwards plain ws:// internally. Browsers block mixed content (ws:// on an https:// page).

Tags: security

Footgun: Proxies that don’t understand WebSocket buffer the connection and break it. You MUST configure them to handle the Upgrade header and disable request buffering.

Resources:

nginx WebSocket proxying

1.5 Ping / Pong heartbeats (1 hr)

TCP connections silently die without data flow. The server should send Ping frames periodically (~30s) and disconnect clients that don’t Pong back within a timeout. Client-side application-level heartbeats are also common in game servers.

Tags: reliability

Footgun: NATs, firewalls, and mobile networks silently kill idle connections. Without heartbeats you’ll have thousands of zombie connections that appear open server-side but are dead.

Resources:

ws: detecting broken connections

Phase 2 — Server-Side Implementation (~6 hrs)

2.1 Choosing a WebSocket library (1 hr)

Node.js: ws (bare, fast), socket.io (batteries included), uWebSockets.js (C++ backed, highest perf). Go: Gorilla WebSocket, nhooyr/websocket. Rust: tokio-tungstenite. For a game server, prefer raw ws or uWebSockets.js.

Tags: Node.js, Go, Rust

Resources:

2.2 Connection lifecycle management (1 hr)

Tracking connected clients, associating metadata (user ID, room, session) with each connection object. Clean teardown on close — removing from maps, notifying other players. Handling the error event (which precedes close).

Tags: server

Footgun: If you store client state in a Map and forget to delete on close/error, you have a memory leak that grows forever. Always clean up in BOTH onclose and onerror.

Resources:

ws server example

2.3 Room / channel architecture (2 hrs)

Model rooms as Sets of WebSocket connections keyed by room ID. Broadcast to a room by iterating the Set and sending to each client (checking readyState === OPEN). Design a message protocol with a type field, e.g. { type: 'PLAYER_MOVE', payload: {...} }.

Tags: architecture

Tip: Use a discriminated union message protocol: { type: 'PLAYER_MOVE', payload: {...} }. This scales cleanly and lets you add message types without breaking existing handlers.

Resources:

2.4 Backpressure handling (1 hr)

If your server sends data faster than a slow client can consume, the send buffer fills up. Check ws.bufferedAmount before sending, or handle the drain event. uWebSockets.js has explicit backpressure callbacks.

Tags: reliability

Footgun: Ignoring backpressure in a game server means slow clients get their receive buffer filled, causing lag and eventual disconnection.

Resources:

uWebSockets backpressure example

2.5 Message serialization strategies (1 hr)

JSON is easy but slow for high-frequency game messages. MessagePack is JSON-equivalent but binary and 2–3x smaller. FlatBuffers/Protobuf require schema compilation but are 5–10x faster. Benchmark early — serialization is often the bottleneck.

Tags: performance

Resources:

Phase 3 — Footguns & Security (~5 hrs)

3.1 Origin validation (0.5 hrs)

WebSocket connections from any origin succeed by default — there is no CORS. Any website can connect to your ws:// server. Always validate the Origin header during the handshake.

Tags: security ⚠️

Footgun: This is the #1 most missed WebSocket security issue. A malicious site can CSRF your WebSocket endpoint unless you validate Origin.

Resources:

OWASP WebSocket cheatsheet

3.2 Authentication over WebSocket (1 hr)

Cookies are sent on the initial HTTP Upgrade request, so cookie-based auth works. For token auth: send the JWT in the first message after connect (not as a query param — those appear in server logs). Validate auth before sending any game state.

Tags: security ⚠️

Footgun: Never trust anything from the client. Re-validate permissions on every sensitive action (joining rooms, game moves), not just on connect.

Resources:

OWASP: WebSocket authentication

3.3 Rate limiting & DoS protection (1 hr)

Limit connection rate per IP, max connections per user, and max message rate per connection. Track message counts in a sliding window. Disconnect violators. Set max message size (ws: maxPayload option).

Tags: security ⚠️, reliability

Footgun: A single client can open hundreds of connections or flood your server with millions of tiny messages. Without rate limiting, your server is trivially DoS-able.

Resources:

ws maxPayload option

3.4 Input validation & message schema (1 hr)

Every message from a client is untrusted user input. Validate message type, payload shape, and field ranges before acting. Use zod or ajv on the server. Reject and log malformed messages — don’t crash.

Tags: security ⚠️

Tip: Treat WebSocket messages exactly like HTTP request bodies: validate every field, sanitize strings, check numeric ranges, and never trust client-sent identifiers without server-side verification.

Resources:

3.5 SSL termination & proxy pitfalls (1.5 hrs)

nginx must set proxy_http_version 1.1, proxy_set_header Upgrade, and proxy_set_header Connection 'upgrade'. Disable proxy_buffering and raise proxy_read_timeout above 60s. HAProxy needs correct tunnel mode on the WS backend.

Tags: ops

Footgun: proxy_read_timeout 60s is nginx’s default — it silently closes WebSocket connections after 60 seconds of no data. Set to 3600s or higher in production.

Resources:

Phase 4 — Reconnection Strategies (~4 hrs)

4.1 Exponential backoff with jitter (1 hr)

On disconnect, wait before reconnecting. Start at 1s, double each failure, cap at ~30s. Add ±20% random jitter to prevent thundering herd — thousands of clients don’t all reconnect at the same instant after a server restart.

Formula: delay = min(cap, base × 2^attempt) × (0.8 + random() × 0.4)

Tags: reliability

Tip: Implement in a useWebSocket hook or ReconnectingWebSocket wrapper class so every feature doesn’t re-implement it.

Resources:

4.2 Client-side message queue during disconnect (1 hr)

Buffer messages that arrive while disconnected. On reconnect, flush the queue or send a full state sync. Cap queue size to prevent OOM. For game state, a full state sync snapshot is usually simpler and more correct than replaying all buffered actions.

Tags: reliability

Footgun: Unbounded queues during long disconnects can OOM the browser tab. Cap queue size and drop or summarize old messages.

Resources:

javascript.info reconnect pattern

4.3 Session resumption & state recovery (2 hrs)

Issue a short-lived reconnect token on connect. On reconnect: client sends token → server restores session (room, game state, player position). Design a ‘catch-up’ snapshot mechanism to send current world state to a reconnecting player.

Tags: architecture

Tip: Design reconnection and state recovery from day 1. A player who drops for 5 seconds should rejoin seamlessly — not restart from a lobby.

Resources:

socket.io connection state recovery

Phase 5 — Scaling WebSockets (Stateless Architecture) (~10 hrs)

5.1 The statefulness problem (1 hr)

A WebSocket connection lives on exactly one server process. When you scale horizontally to N servers, a message for “room 42” must reach all connections in that room — which may span all N servers. This is the core scaling challenge.

Tags: core concept

Footgun: Naive horizontal scaling silently breaks broadcasting — messages only reach players connected to the same server instance. This is almost always the first bug in a multiplayer implementation.

Resources:

socket.io: why you need an adapter

5.2 Pub/Sub fan-out with Redis (3 hrs)

Each server subscribes to a Redis channel per room. When server A receives a message for room 42, it publishes to Redis channel room:42. All servers receive it and forward to their local connections. Use Redis Pub/Sub or Redis Streams.

Tags: scaling, Redis

Tip: This is the industry-standard approach. socket.io has @socket.io/redis-adapter. With raw ws, implement it yourself — it’s ~50 lines with ioredis.

Resources:

5.3 NATS & Kafka as alternatives (1.5 hrs)

NATS is purpose-built for high-throughput messaging with lower latency than Redis Pub/Sub — ideal for real-time game state. Kafka adds durability and replay but adds latency; better for matchmaking queues and event sourcing than live game state.

Tags: scaling

Resources:

5.4 Sticky sessions (and why to avoid them) (0.5 hrs)

Sticky sessions pin a client to one server via IP hash or cookie. This works but distributes load unevenly, makes deployments painful, and doesn’t solve the fan-out problem. Use pub/sub instead. Sticky sessions are a crutch, not a solution.

Tags: ⚠️ anti-pattern

Resources:

socket.io: using multiple nodes

5.5 Dedicated WebSocket gateway pattern (2 hrs)

Separate your connection-holding layer (WS gateway) from your business logic layer. The gateway only handles connections + pub/sub routing. Business logic runs in stateless HTTP microservices. This is the pattern used at scale by Slack, Discord, etc.

Tags: architecture

Tip: This lets you scale compute-heavy game logic independently from the connection-holding layer.

Resources:

5.6 WebSocket hibernation — Cloudflare Durable Objects (1 hr)

Cloudflare Durable Objects can hibernate WebSocket connections to zero CPU when idle — the connection stays open but the process is evicted. On the next message, the process restores in microseconds. Compelling for game lobbies and presence.

Tags: serverless

Resources:

5.7 Load balancer configuration (1 hr)

AWS ALB: natively supports WebSockets. AWS NLB: lower latency, better for long-lived connections. nginx: proxy_http_version 1.1, disable buffering, set long timeouts. HAProxy: balance by source IP only if needed; prefer pub/sub instead.

Tags: ops

Resources:

Phase 6 — Production & Observability (~5 hrs)

6.1 Metrics to track (1 hr)

Active connections, connection rate (new/sec), message throughput (in/out per sec), message size distribution, error rate, close code distribution (watch for 1006 = abnormal), round-trip ping latency, backpressure events, reconnect rate.

Tags: observability

Resources:

6.2 Graceful shutdown (1 hr)

On SIGTERM: stop accepting new connections, send Close 1001 (going away) to all clients, wait for acknowledgment, drain, then exit. Coordinate with your load balancer to drain before killing. Gives reconnect logic time to find a new server.

Tags: ops

Footgun: Hard-killing a WS server sends TCP RST packets — clients see abnormal close (1006). A graceful close lets your backoff reconnect logic work properly.

Resources:

ws graceful shutdown pattern

6.3 Connection limits & resource management (1 hr)

Each WS connection uses a file descriptor. Raise ulimit to 100k+ in /etc/security/limits.conf and tune net.core.somaxconn. Each Node.js connection uses ~50–100KB RAM. uWebSockets.js can hold 1M+ connections per GB; ws is closer to 10–50k.

Tags: ops

Tip: uWebSockets.js can hold 1M+ connections in ~1GB RAM. Node.js ws is closer to 10k–50k per GB. Design your instance sizing accordingly.

Resources:

6.4 Structured logging (0.5 hrs)

Log: connect (userId, IP, userAgent), disconnect (userId, code, reason, duration), auth failures, rate limit hits. Use structured JSON logs with correlation IDs. Don’t log every message in production — you’ll drown in noise.

Tags: observability

Resources:

pino — fast Node.js logger

6.5 Testing WebSocket servers (1.5 hrs)

Unit test message handlers with mock WS objects. Integration test with a real ws.WebSocket client in Jest/Vitest. Load test with k6 (native WS support). Chaos test: kill servers mid-game, simulate slow clients, test reconnect recovery.

Tags: testing

Resources:

Phase 7 — Multiplayer Game Architecture (~8 hrs)

7.1 Authoritative server model (2 hrs)

The server is the single source of truth for game state. Clients send intents (MOVE_LEFT, FIRE), never positions. The server validates, computes new state, and broadcasts. Prevents cheating — a client cannot lie about its position.

Tags: game architecture

Tip: This is non-negotiable for a competitive game. Client-authoritative games are trivially hackable.

Resources:

7.2 Client-side prediction & server reconciliation (2 hrs)

Apply the player’s own input immediately (prediction) so movement feels responsive. Server processes input and sends authoritative state. If client and server diverge, the client snaps to server state (reconciliation). Hides network latency from the player.

Tags: game architecture

Resources:

7.3 Entity interpolation & lag compensation (1.5 hrs)

For OTHER players, interpolate between the two most recent known positions (adds ~100ms delay but removes jitter). For hit detection, lag compensation rolls back world state to what the shooter saw when they fired.

Tags: game architecture

Resources:

7.4 Delta compression for state updates (1 hr)

Instead of broadcasting full world state every tick, send only what changed since the last acknowledged state. Track per-client what they’ve seen (sequence numbers). Can reduce bandwidth by 80–95% in a large game world.

Tags: performance

Resources:

7.5 Tick rate & game loop design (1.5 hrs)

Server-side game loop runs at a fixed tick rate (20Hz–64Hz). Each tick: collect inputs, advance simulation, broadcast delta. Decoupled from client framerate. Higher tick rate = better responsiveness but more CPU and bandwidth. Start at 20Hz, tune up.

Tags: game architecture

Resources:

Phase 8 — Matchmaking System Design (~5 hrs)

8.1 Matchmaking queue architecture (2 hrs)

Players enter a queue (Redis sorted set by ELO + timestamp). A matchmaker process polls the queue and groups compatible players. When a match is found: create a game session, notify players via WebSocket, move them to a game server. Dequeue on disconnect.

Tags: matchmaking

Resources:

8.2 ELO & skill-based matching (1 hr)

ELO for skill tracking. Expand match criteria over time: first try ±50 ELO, after 30s try ±200, after 2min try ±500. This ‘expanding window’ balances match quality vs wait time.

Tags: matchmaking

Resources:

8.3 Game session lifecycle (1 hr)

States: WAITING → IN_PROGRESS → FINISHED. Store in Redis with TTL. Each state transition sends WebSocket events. Handle player abandonment (forfeit vs reconnect window). Post-game: update ELO, persist match history, send results.

Tags: matchmaking

Resources:

XState — state machines in JS

8.4 Presence & lobby system (1 hr)

Track online players in Redis with a TTL key refreshed by heartbeats. Expose a lobby list via WebSocket subscription. Players see who’s online, in queue, or in a game. Use Redis keyspace notifications or a dedicated heartbeat channel.

Tags: matchmaking

Resources:

Redis keyspace notifications

Phase 9 — Production Checklist & Best Practices (~2 hrs)

9.1 Security checklist (0.5 hrs)

[ ] Always wss:// in production
[ ] Validate Origin header on every connection
[ ] Authenticate before sending any game state
[ ] Set maxPayload to prevent OOM from large messages
[ ] Rate limit connections per IP and messages per connection
[ ] Validate and sanitize every message payload (zod / ajv)

Resources:

OWASP WebSocket cheatsheet

9.2 Reliability checklist (0.5 hrs)

[ ] Ping/pong heartbeats with disconnect timeout
[ ] Exponential backoff with jitter on reconnect
[ ] Clean up all listeners and Maps on disconnect
[ ] Graceful shutdown with Close 1001
[ ] Session resumption tokens issued on connect
[ ] Message queue with cap during disconnect

Resources:

High Performance Browser Networking ch.17 (free)

9.3 Scaling checklist (0.5 hrs)

[ ] Pub/Sub via Redis or NATS for horizontal scaling — no sticky sessions
[ ] WS gateway separated from business logic services
[ ] Load test with k6 before launch
[ ] Monitor connection count, close code distribution, message throughput
[ ] Raise ulimit (file descriptors) on all servers
[ ] Disable proxy_buffering and raise proxy_read_timeout in nginx

Resources:

k6 WebSocket load testing

9.4 The essential reading list (0.5 hrs)

Three resources worth reading cover-to-cover — everything else is reference material:

High Performance Browser Networking ch.17 — free, authoritative, covers the protocol deeply
Gaffer on Games — the multiplayer game networking bible; read the whole blog
Gabriel Gambetta: Fast-Paced Multiplayer (4 parts) — the clearest explanation of prediction, reconciliation, and interpolation on the internet

websockets 101, I’m learning and trying them out here in https://github.com/nijuyonkadesu/79-plus/tree/main/chat (no where near completion, but really interesting)

CN flash games

Sat, 09 May 2026 00:00:00 GMT

Cartoon Network flash games from the bygone era

Flash Games (Archive): https://www.webdesignmuseum.org/flash-game-exhibitions/cartoon-network-flash-games

Discussions: https://news.ycombinator.com/item?id=48065360

Speaking of CartoonNetwork… I HATE ADVENTURE TIME!

Thankyou for listening.

Spot larpers in workplace

Thu, 07 May 2026 00:00:00 GMT

Identify and catch them. So you can be wary around them.

Appearing productive in the workplace (Ohh the sleepercells who kill an organization from the inside!!): https://nooneshappy.com/article/appearing-productive-in-the-workplace/

Discussion: https://news.ycombinator.com/item?id=48038001

Youtube updates in RSS feed

Thu, 07 May 2026 00:00:00 GMT

RSS feed for channel updates.

I had no idea YouTube has a official RSS feed: https://news.ycombinator.com/item?id=48032508

Talking to strangers at the gym

Mon, 04 May 2026 00:00:00 GMT

Try it out. See how things go.

Here’s a 5 week plan on how and what to talk to strangers at the gym: https://web.archive.org/web/20261019201000/https://thienantran.com/talking-to-35-strangers-at-the-gym/

discussions: https://news.ycombinator.com/item?id=48007438

~~I didn’t try them, I spend more than 1hr in gym just working out… I don’t have the same luxury as him. Not because I’m scared or anything!! I wanted to make that distinction very clear!!~~

Next steps for your career

Sun, 03 May 2026 00:00:00 GMT

Find what steps your next role demands

https://crackingwalnuts.com/ - A detailed roadmap for your next career. Worth checking once.

A collection of small cozy tools. You'd love these.

Sun, 03 May 2026 00:00:00 GMT

Images, Video, Audio, Colors, QR, Social Media, Typography, Printing, Dev, Calculator

https://delphi.tools - Collection of amazing tools in browser.

Haskell teaches you a very important principle

Sun, 03 May 2026 00:00:00 GMT

Get rid of the untold rules your team writes every day, and cut down the untold rituals went into codebase, while documented nowhere.

https://blog.haskell.org/a-couple-million-lines-of-haskell/

“Remember to flush the audit log after every transaction.”

“Always check the feature flag before calling this endpoint.”

“Make sure to enqueue the notification inside the database transaction, not after it.”

These are the incantations of operational lore. They live in wiki pages, onboarding documents, half-forgotten design reviews, and the memories of senior engineers who are now three teams away and booked solid until Thursday.
In a company that is hiring aggressively, the half-life of tribal knowledge is alarmingly short. When an engineer leaves, the incantations fade. When a deadline approaches, they are the first thing skipped. When a new engineer joins, they often have no way to know the incantation exists at all. Nothing says “robust system design” quite like a critical invariant living in a Slack thread from nine months ago.

UK doesn't have copyright on recipes

Wed, 29 Apr 2026 00:00:00 GMT

Stashed copies of recipies from United Kingdom - and you cannot copyright them.

idk about cooking, but gordan ramsey’s recipies are here if you want to try em out https://www.recipeninja.ai/
actualy I discovered it from this https://youtu.be/O7joqcfy-eU - interview on Briish entrepreneurs

Hierarchical state machines

Sun, 26 Apr 2026 00:00:00 GMT

An executable statemachine representation (diagramatic)

Statecharts: Hierarchical state machines https://statecharts.dev/

Please stop… why would you make an executable from a state chart!! Who thought of that terrible idea (imo)!! You’ll wake up all the resting UML enthusiasts from their coffins!

discussions: https://news.ycombinator.com/item?id=47908833

USB Cheatsheet

Sun, 26 Apr 2026 00:00:00 GMT

Cheatsheet, so the numbers do not confuse you.

USB cheatsheet: Come take a look at it before buying a random cable from amazon https://fabiensanglard.net/usbcheat/index.html

For HDMI: HDMI versions cheatsheet

Amazing board games

Thu, 23 Apr 2026 00:00:00 GMT

Why you should try playing boardgames with your friends right now.

The only board (table top) game I play that’s not in this list in Dungeons and Dragons. With enough fire power you can reignite even a dying star…

site: https://boardgamegeek.com/blog/10755/blogpost/124992/modern-board-games-and-why-you-should-play-them
discussions: https://news.ycombinator.com/item?id=47836859

Easy language acquisition as an infant

Wed, 22 Apr 2026 00:00:00 GMT

Lexfridman podcast, featuring a musician - Rick Beato. One particular incident he shared there stuck in my mind.

Rick Beato, one of the greatest musician decided to play music to his new (unborn) infant. He did that quite regularly, also played his (unborn) infant a multitude of different octaves, fundamental notes, everything he could structuredly from his piano. After some years, the (born) infant turns out to be beating his own father in his own domain.

It’s just crazy. This is not magic, it’s how humans work. I’d definitely want to try this one day. https://m.youtube.com/watch?v=1SJiTwbSI58

Language acquisition, since 15 weeks, as an infant is simply crazy.

Experimental medcert generator

Sun, 19 Apr 2026 00:00:00 GMT

Your doctor did not prescribe these!

He’s got some insane templates there - https://medicalcertificategenerator.com/

Minerals at museum

Thu, 16 Apr 2026 00:00:00 GMT

Beautiful iridescent shaded minerals

Raw minerals at natural museum for display:
https://wchambliss.wordpress.com/2026/03/03/god-sleeps-in-the-minerals/