Blog

We measured catastrophic backtracking in Node 20: /^(a+)+$/ takes 6.5 seconds at 30 characters and doubles with each one added. Why it happens, the outages it caused at Stack Overflow and Cloudflare, and how we patched our own regex tester.

Real numbers from Node 20 on an M2 Pro: 24M v4/sec vs 2.7M v7/sec, why v7 is only 50% sorted in bursts, and a 35× index-locality gap. Code included.

PMI runs about $30-$70/month per $100,000 borrowed when you put under 20% down. What it costs, when it cancels at 78%-80% LTV, and how to skip it.

The four main naming styles and where each is the standard: camelCase for JS variables, snake_case for Python (per PEP 8), and kebab-case for URLs and CSS.

A JWS (signed JWT) has 3 parts; a JWE (encrypted JWT) has 5. Learn what each JOSE acronym means, when a token is signed vs encrypted, and which you need.

RFC 7519 defines 7 registered JWT claims: iss, sub, aud, exp, nbf, iat, jti. Learn what each means, how to validate it, and the checks that stop attacks.

JSON, XML, and YAML compared on syntax, readability, and real use cases. YAML 1.1 has 22 ways to write a boolean — here is exactly when to pick each one.

The exact amortization formula behind your mortgage payment, why a $400,000 loan at 6.75% costs about $2,594 a month, and how to run the numbers yourself.

How compound interest works, the A=P(1+r/n)^nt formula, why starting early beats investing more, the Rule of 72, and how $10,000 at 7% becomes $81,165.

JSON allows just 7 value types and zero comments. Fix the most frequent syntax errors — trailing commas, single quotes, unquoted keys — with the exact fix.

Base64 encode and decode in browser JS, Node.js, Python, and the shell. Why btoa only takes code points 0-255, plus the UTF-8 fix and URL-safe variant for each.

Base64 and Base64URL share one algorithm but differ in two characters: + and / become - and _. Learn why JWTs use Base64URL and how to convert in one line.

A 128-bit UUID gives 2^122 random values, so collisions are practically impossible. Learn the versions, the collision math, and when to pick UUIDs over integers.

WebP is 25-34% smaller than JPEG with ~95.6% global browser support. A decision guide to PNG vs JPEG vs WebP: compression, transparency, and when to use each.

JavaScript has 8 regex flags — g, i, m, s, u, y, d, and the newer v. Learn what each one really does, when you need it, and the bug each one quietly fixes.

Principal, Interest, Tax, Insurance — your monthly mortgage payment broken into four parts, with worked examples and how PMI adds 0.3-1.5% per year.

A JWT is 3 Base64URL parts split by dots. Decode the header and payload in ~10 lines of plain JavaScript — and learn why decoding never proves a token is real.

Format JSON the right way: 2-space vs tab indentation, minification for transport, key ordering, and validation. Includes JSON.stringify code examples.

Base64 explained from scratch: how it turns 3 bytes into 4 ASCII characters (a ~33% size increase), the 64-character alphabet, padding, and URL-safe variants.