[{"content":"This is the first post of a beginner series, Go Fundamentals. The plan is to cover the language basics here, and then move on to a second, backend-oriented series: HTTP services, databases, concurrency in real systems. I already used Go in an earlier post on NATS JetStream, but that one assumed you could read Go. This series starts from zero.\nToday we install Go, create a module, and learn the handful of commands you will type every day. Everything below was run with Go 1.26.0 on macOS (arm64).\nWhy Go for backend Go is a statically typed, compiled language with a small spec. A few reasons people pick it for backend work:\ngo build produces a single binary, which makes deployment and Docker images simple. Concurrency (goroutines and channels) is built into the language. The standard library covers HTTP, JSON, testing and more. The toolchain (formatter, test runner, dependency management) ships with the language, so teams argue less about setup. Installing Follow the official guide at go.dev/doc/install. On macOS, brew install go is also an option if you already use Homebrew. Then verify:\ngo version go version go1.26.0 darwin/arm64 Your first module Go code lives in modules. A module is a directory with a go.mod file. Create one:\nmkdir hello \u0026amp;\u0026amp; cd hello go mod init example.com/hello The module path (example.com/hello) is the name other code would use to import you. For a local experiment any name works; for something you publish it is usually the repository path. Now main.go:\npackage main import \u0026#34;fmt\u0026#34; func main() { fmt.Println(\u0026#34;Hello, Go!\u0026#34;) } package main with a main function marks an executable program. Run it:\ngo run . Hello, Go! go run compiles to a temporary location and runs it. To keep the binary, use go build:\ngo build -o hello . ./hello Hello, Go! What is in go.mod module example.com/hello go 1.25.0 It has the module path and a go line with the Go version the module expects. When you add dependencies, require lines appear here too. Interestingly, my toolchain is 1.26.0 but go mod init wrote go 1.25.0; the file records a language version, not necessarily the exact toolchain you have installed.\nA slightly bigger program Let us read an optional name from the command line, with a default:\npackage main import ( \u0026#34;fmt\u0026#34; \u0026#34;os\u0026#34; ) // greeting builds the message for a given name. func greeting(name string) string { return fmt.Sprintf(\u0026#34;Hello, %s!\u0026#34;, name) } func main() { name := \u0026#34;world\u0026#34; if len(os.Args) \u0026gt; 1 { name = os.Args[1] } fmt.Println(greeting(name)) } os.Args[0] is the program itself, so the first real argument is at index 1. We cover variables and if properly in the next post.\ngo run . go run . Roham Hello, world! Hello, Roham! The everyday commands go fmt ./... rewrites files into the standard format and prints the names of files it changed. In Go nobody debates style; the formatter decides. go vet ./... reports suspicious code that compiles fine. It prints nothing when all is well. go test ./... runs tests. A test is a function TestXxx(t *testing.T) in a _test.go file: package main import \u0026#34;testing\u0026#34; func TestGreeting(t *testing.T) { got := greeting(\u0026#34;Roham\u0026#34;) want := \u0026#34;Hello, Roham!\u0026#34; if got != want { t.Fatalf(\u0026#34;got %q, want %q\u0026#34;, got, want) } } $ go test ./... ok example.com/greet\t0.273s go mod tidy adds missing and removes unused dependencies in go.mod. With no dependencies, as here, it changes nothing. I checked go fmt by feeding it a badly spaced file: it printed bad.go and rewrote func x( ){ } into func x() {}.\nWhere Go keeps things go env GOPATH GOMODCACHE /Users/hossein/go /Users/hossein/go/pkg/mod GOMODCACHE is where downloaded dependencies are stored, shared by all your projects. By default it lives under GOPATH. You do not need to put your own code there.\nA few things to watch go run main.go compiles only that file. Prefer go run . so the whole package is built once you have more than one file. Run commands from inside the module (where go.mod is), or you get a \u0026ldquo;no go.mod\u0026rdquo; error. Unused imports and unused local variables are compile errors, not warnings. go build writes the binary in the current directory; do not commit it. go vet passing does not mean the code is correct, only that it avoids a set of common mistakes. Exercise Create a new module and make the greeting program accept two arguments, a first and last name, and print Hello, First Last!. Add a second test case for the default name world by extracting that logic into a function. Run go fmt, go vet and go test before you consider it done. What\u0026rsquo;s next In the next post, go-types-control-flow, we look at types, variables and control flow: the building blocks you need to write real programs.\n","permalink":"https://justroham.ir/posts/go-getting-started/","summary":"\u003cp\u003eThis is the first post of a beginner series, \u003cstrong\u003eGo Fundamentals\u003c/strong\u003e. The plan is to cover the language basics here, and then move on to a second, backend-oriented series: HTTP services, databases, concurrency in real systems. I already used Go in an earlier post on \u003ca href=\"/posts/nats-jetstream-go/\"\u003eNATS JetStream\u003c/a\u003e, but that one assumed you could read Go. This series starts from zero.\u003c/p\u003e\n\u003cp\u003eToday we install Go, create a module, and learn the handful of commands you will type every day. Everything below was run with Go 1.26.0 on macOS (arm64).\u003c/p\u003e","title":"Getting started with Go: install, modules, tooling"},{"content":"On 19–20 October 2026 the Go team released Go 1.27.3 and 1.26.10. They contain one security fix, CVE-2026-111943 (Go issue 82345): crypto/x509 now rejects chains that contain a small set of intermediate certificates from the CA eMudhra (emSign), because their private keys are compromised. The advisory doesn\u0026rsquo;t say which certificates, so I looked.\nIf you ship Go binaries, updating Go on your machine is not enough. Every binary has to be rebuilt with a fixed toolchain.\nSummary ID CVE-2026-111943 Component crypto/x509 (Certificate.Verify) Weakness CWE-295, improper certificate validation Fixed in Go 1.26.10 and 1.27.3 Severity Sources disagree: 6.8 (Medium) from Red Hat, 8.1 (High) in Oracle\u0026rsquo;s preliminary score What happened According to the reports I found, a researcher noticed on 17 October that eight intermediate certificates under eMudhra\u0026rsquo;s emSign were generated with a flawed key-generation process. Mozilla later concluded the flaw is easy to exploit. They are the DV, EV, OV (TLS) and OV code-signing CAs, each in the G3B and G3C generations.\nWhoever can recompute one of these private keys can issue a certificate for any domain, and a client that trusts the chain will accept it.\nWhat the fix does Verify now drops any chain that contains one of the blocked intermediates, so it is never returned to the caller. The filter is a hardcoded list of eight SHA-256 hashes, computed over each certificate\u0026rsquo;s SubjectPublicKeyInfo (SPKI) instead of the whole certificate.\nThat is the right choice. One key can appear in several certificates, for example an intermediate cross-signed by two roots. The certificate hash differs between them but the SPKI hash is the same, so one entry covers every encoding.\nIs the list complete? A hardcoded denylist is only as good as its completeness, so I compared it with the researcher\u0026rsquo;s proof bundle (proof.zip) on 26 October 2026:\nI checked the bundle first. openssl dgst -sha384 -verify \u0026lt;name\u0026gt;.pub.pem -signature \u0026lt;name\u0026gt;.sig message.txt printed Verified OK for all eight, and each public key matched the one in its certificate. I computed the SHA-256 of the DER SubjectPublicKeyInfo of each .crt.pem, the same input containsDistrustedSPKIHash uses. I took distrustedSPKIHashes from src/crypto/x509/verify.go at tag go1.27.3. The result is an exact match: eight of eight, and nothing extra in Go\u0026rsquo;s list.\nCertificate SHA-256 of SPKI EM DV TLS CA - G3B ebed6475c2c2d80fcb199f3fe8dd6e6b3ce60b77eb15d4e42c3dec0c6f5b5105 EM DV TLS CA - G3C 49dd353dc2b919a3770645117d0e60c16115e7d1bc259eefe734b00ea434fe5f EM EV TLS CA - G3B e0254c7fcdc265e2f0f8a428dabb75ab4ae039b4872d62f5ee57f0877d5a8a41 EM EV TLS CA - G3C 5c0660a2b164910d8ff589c18e14552e9e0ec237dcefe2cb736d41a4811f81a0 EM OV TLS CA - G3B 43bffa19d6ef651451f6841e019931e96f6f2eaeff28ab4b6f1ce4576de2717b EM OV TLS CA - G3C 63ecefee431d49523bc1136c4e72d0206a477086caf606cd5cf025686c109cf8 EM OV CS CA - G3B ec4ffa1ad0ac88081314b7aaffef6a91f97cd57291bb5ba686c5415f5eb4f6b6 EM OV CS CA - G3C 92c063d67e8f14db71d288e11266ffdaf69cbf115f7bab14f3bc2f68d25e0e30 In the 1.27.3 source the filter runs on every path: verify.go for the pure-Go verifier, and root_darwin.go and root_windows.go for the platform verifiers. A forged leaf from any of the eight is rejected whichever root it chains to.\nThis holds against the researcher\u0026rsquo;s bundle, which covers DV, EV, OV-TLS and OV-CS in G3B and G3C. If the faulty process also produced a ninth intermediate that nobody reported, this list would not catch it, and only eMudhra or the root programs can rule that out. I did not test a forged chain against a real Go binary.\nThe operational gap Browsers handled this with revocation pushes (CRLSet, OneCRL, CRLite). Go has no such channel, because the list lives in the standard library source. So:\nA binary built before the fix trusts all eight intermediates forever. No revocation data will ever reach it. Go\u0026rsquo;s crypto/x509 doesn\u0026rsquo;t enforce Certificate Transparency, so a forged certificate wouldn\u0026rsquo;t be exposed by CT logs either. Installing a newer Go changes nothing for binaries that already exist. Distributions may also backport the fix under their own version strings. What to do Find the toolchain each binary was built with:\ngo version -m ./your-binary | head -1 Anything built with Go older than 1.26.10 (on the 1.26 line) or 1.27.3 (on 1.27) needs a rebuild, and so do container images made from those binaries.\nRebuild and redeploy with a fixed toolchain, and pin the Go version in CI.\nDon\u0026rsquo;t disable certificate verification (InsecureSkipVerify) to get around anything related to this change.\nCheck the list yourself if you want to be sure. In a fixed toolchain:\ngrep -A12 distrustedSPKIHashes \u0026#34;$(go env GOROOT)/src/crypto/x509/verify.go\u0026#34; And the hash of a certificate you hold:\nopenssl x509 -in cert.pem -noout -pubkey \\ | openssl pkey -pubin -outform DER \\ | openssl dgst -sha256 References Go release announcement on oss-security SOC Prime: CVE-2026-111943 Wiz vulnerability database Penligent: rebuild guidance ","permalink":"https://justroham.ir/posts/go-x509-emudhra-distrusted-intermediates-cve-2026-111943/","summary":"\u003cp\u003eOn 19–20 October 2026 the Go team released \u003cstrong\u003eGo 1.27.3 and 1.26.10\u003c/strong\u003e. They contain one security fix, \u003ca href=\"https://www.openwall.com/lists/oss-security/2026/10/20/29\"\u003eCVE-2026-111943\u003c/a\u003e (Go issue 82345): \u003ccode\u003ecrypto/x509\u003c/code\u003e now rejects chains that contain a small set of intermediate certificates from the CA eMudhra (emSign), because their private keys are compromised. The advisory doesn\u0026rsquo;t say which certificates, so I looked.\u003c/p\u003e\n\u003cblockquote\u003e\n\u003cp\u003eIf you ship Go binaries, updating Go on your machine is not enough. Every binary has to be \u003cstrong\u003erebuilt\u003c/strong\u003e with a fixed toolchain.\u003c/p\u003e","title":"Go Blocks Eight eMudhra Intermediates: CVE-2026-111943 and Why You Must Rebuild"},{"content":"At the end of the previous post I promised two topics: running more than one worker, and watching how far behind the workers are. One worker is fine until messages arrive faster than it can process them. This post answers two questions: how do I add workers without processing anything twice, and how do I know the queue is backing up?\nEverything below ran against an embedded nats-server (JetStream enabled, temp store dir) and nats.go v1.54.0, on Go 1.26. The outputs are from those runs.\nMany workers, one durable consumer The trick is that there is no trick. Every worker binds to the same durable consumer, and the server hands each message to only one of them:\nsub, err := js.PullSubscribe(\u0026#34;jobs.new\u0026#34;, \u0026#34;workers\u0026#34;, nats.Bind(\u0026#34;JOBS\u0026#34;, \u0026#34;workers\u0026#34;)) // ... msgs, err := sub.Fetch(1, nats.MaxWait(500*time.Millisecond)) // process msgs[0], then m.Ack() The consumer was created once with AckExplicitPolicy. I started three goroutines (w1, w2, w3), each with its own pull subscription, each taking 200ms per job, and published 30 messages. A sample of the log:\n0.0s w3 got job-01 (stream seq 1, delivery #1) 0.0s w2 got job-02 (stream seq 2, delivery #1) 0.0s w1 got job-03 (stream seq 3, delivery #1) 0.2s w2 got job-06 (stream seq 6, delivery #1) 0.2s w3 got job-04 (stream seq 4, delivery #1) 0.2s w1 got job-05 (stream seq 5, delivery #1) ... deliveries=30 unique=30 pending=0 ackPending=0 redelivered=0 30 deliveries, 30 unique jobs, nothing redelivered. The whole batch finished in about 2 seconds instead of the 6 a single worker would need. Notice that the order is not strict: job-06 started before job-04.\nA worker dies mid-job Now the interesting part. I set AckWait to 2 seconds, published 10 jobs, and made w2 \u0026ldquo;crash\u0026rdquo; on its second message: it stops without acking.\n0.1s w2 got job-06 (stream seq 6, delivery #1) 0.1s w2 CRASHED while holding job-06 (no ack) ... 2.1s w1 got job-06 (stream seq 6, delivery #2) deliveries=11 unique=10 pending=0 ackPending=0 redelivered=0 The server waited for AckWait, then redelivered job-06 to a worker that was still alive (w1). That is the whole safety net: no ack means the message is not lost. Two consequences:\nDelivery is at-least-once. The crashed worker may have done half the work or all of it, so processing must be safe to repeat. That is the topic of the next post. Ordering across workers is not guaranteed. job-06 was processed long after job-10. If you need strict order per key, one consumer with one worker, or partitioning by subject, is a different design. Reading lag with ConsumerInfo To see backlog, ask the server about the consumer. My tiny monitor is just a ticker:\ni, err := js.ConsumerInfo(\u0026#34;JOBS\u0026#34;, \u0026#34;workers\u0026#34;) fmt.Printf(\u0026#34;pending=%d ackPending=%d redelivered=%d delivered=%d ackFloor=%d\\n\u0026#34;, i.NumPending, i.NumAckPending, i.NumRedelivered, i.Delivered.Consumer, i.AckFloor.Consumer) What each number means:\nNumPending: messages in the stream the consumer has not delivered yet. This is the number to alert on for \u0026ldquo;lag\u0026rdquo;. NumAckPending: delivered but not acked yet, i.e. in flight right now. With two busy workers it sits at 2. NumRedelivered: messages that are being redelivered. Delivered.Consumer: the consumer sequence of the last delivery. It also counts redeliveries. AckFloor.Consumer: the consumer sequence below which everything has been acked. For this run I used two slow workers (500ms per job), published 40 jobs at 1.5s, and made w2 crash on its 5th message. AckWait was 3s.\n1.0s pending=0 ackPending=0 redelivered=0 delivered=0 ackFloor=0 1.5s publishing 40 jobs 2.0s pending=38 ackPending=2 redelivered=0 delivered=2 ackFloor=0 3.0s pending=34 ackPending=2 redelivered=0 delivered=6 ackFloor=4 3.5s w2 CRASHED while holding job-09 (no ack) 4.0s pending=30 ackPending=2 redelivered=0 delivered=10 ackFloor=8 5.0s pending=28 ackPending=2 redelivered=0 delivered=12 ackFloor=8 6.0s pending=26 ackPending=2 redelivered=0 delivered=14 ackFloor=8 7.0s pending=25 ackPending=1 redelivered=1 delivered=16 ackFloor=8 8.0s pending=23 ackPending=1 redelivered=0 delivered=18 ackFloor=17 ... 19.0s pending=1 ackPending=1 redelivered=0 delivered=40 ackFloor=39 20.0s pending=0 ackPending=0 redelivered=0 delivered=41 ackFloor=41 Pending jumps to 38 when the burst arrives and drains at about 4 per second with two workers, then falls by about 2 per second after the crash, since only one worker is left. The crash itself shows in two places: AckFloor froze at 8 while the stuck message waited, and NumRedelivered showed 1 at 7.0s, after AckWait expired, then went back to 0 once the message was acked and the floor jumped to 17. At the end, delivered is 41 for 40 jobs: the extra one is the redelivery.\nThe HTTP monitoring endpoint If the server runs with an HTTP monitoring port, you can read the same numbers without a client. With the embedded server started with HTTPPort: 8222 and 5 unconsumed messages in the stream, I ran curl 'localhost:8222/jsz?consumers=true'. In the JSON, the consumer under stream JOBS showed num_pending 5, num_ack_pending 0 and num_redelivered 0. That is handy for Prometheus-style scraping or a quick check from the shell.\nA few things to watch Alert on NumPending growing over time, not on a single high value. Bursts are normal, a steadily rising line is the problem. A growing NumAckPending with a flat AckFloor means workers are stuck or crashing, even if pending looks fine. AckWait must be longer than your slowest legitimate job, otherwise healthy workers get their messages redelivered to someone else. Use m.InProgress() to extend it for long jobs. More workers only helps when the work is the bottleneck. Check that the database or API behind the workers can take the extra concurrency. NumRedelivered showed up for only a moment in my run, so a scrape every few minutes can miss it. Treat it as a hint, not a counter of total retries. What\u0026rsquo;s next Redelivery means a job can run twice, so the next post covers idempotency and what \u0026ldquo;exactly-once\u0026rdquo; really means in JetStream: Nats-Msg-Id, the duplicate window, and idempotent consumers.\n","permalink":"https://justroham.ir/posts/nats-jetstream-scaling-lag/","summary":"\u003cp\u003eAt the end of the \u003ca href=\"/posts/nats-jetstream-retry-dlq/\"\u003eprevious post\u003c/a\u003e I promised two topics: running more than one worker, and watching how far behind the workers are. One worker is fine until messages arrive faster than it can process them. This post answers two questions: how do I add workers without processing anything twice, and how do I know the queue is backing up?\u003c/p\u003e\n\u003cblockquote\u003e\n\u003cp\u003eEverything below ran against an embedded \u003ccode\u003enats-server\u003c/code\u003e (JetStream enabled, temp store dir) and \u003ccode\u003enats.go\u003c/code\u003e v1.54.0, on Go 1.26. The outputs are from those runs.\u003c/p\u003e","title":"Multiple workers on one consumer and monitoring lag in JetStream"},{"content":"On 21 October 2026 GitLab released a critical patch release that includes CVE-2026-110264, scored CVSS 10.0, the maximum. The flaw is in GitLab CE and EE and, under certain conditions, lets an unauthenticated user run arbitrary code on the GitLab server. The Hacker News has covered it too.\nIf you run a self-managed GitLab, update first and read the rest later.\nSummary ID CVE-2026-110264 Score 10.0 (Critical) Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H Weakness Integer overflow in the regular expression compiler Reporter joaxcar, via GitLab\u0026rsquo;s HackerOne bug bounty The vector means: reachable over the network, low complexity, no login, no user interaction, with full impact on confidentiality, integrity and availability.\nWhat is going on? Per GitLab, the flaw is an integer overflow while compiling a specially crafted regular expression. According to The Hacker News, this happens in Onigmo, Ruby\u0026rsquo;s built-in regex engine, which GitLab ships and patches.\nThe worrying part: GitLab has not disclosed the exact conditions for exploitation, so for now no configuration setting lets you rule yourself out. Per the report there is no sign of active exploitation and, as of 22 October, it is not in CISA\u0026rsquo;s KEV catalog. That can change quickly.\nWhat is affected? Vulnerable: all versions from 7.0 up to these fixed releases:\nBranch Vulnerable before Fixed in 19.5 19.5.1 19.5.1 19.4 19.4.3 19.4.3 19.3 19.3.6 19.3.6 19.2 19.2.9 19.2.9 19.1 19.1.9 19.1.9 19.0 19.0.10 19.0.10 7.0 to 18.11 18.11.13 18.11.13 GitLab.com is already patched, so only self-managed installs need action. GitLab Dedicated tenants on 19.3.5-internal0 and 19.4.2-internal0 or later are fixed too.\nIf you updated after 12 October to fix CVE-2026-97229 (also CVSS 10), The Hacker News reports those versions (19.2.8, 19.3.5 and 19.4.2) do not include this new fix, so you need to update again.\nWhat to do Update to the fixed release for your branch. GitLab offers no interim workaround; upgrading is the only certain protection.\nMind the migrations. 19.4.3 and 19.3.6 include database migrations. On a single-node instance the upgrade causes downtime, because migrations must finish before GitLab can start. Multi-node setups can use the zero-downtime procedure.\nRestrict access until you update. If your instance is internet-facing and you cannot upgrade right away, temporarily limit access with a firewall, VPN or allowlist. This is not official GitLab guidance, just a general precaution.\nLook for signs of compromise. GitLab published two detections for self-managed instances: \u0026ldquo;Onigmo native worker crash\u0026rdquo; and \u0026ldquo;Org mode render error burst\u0026rdquo;. Run them against your application logs (guide: Detecting security incidents). If the instance has been exposed, also check for unknown files, tokens and runners.\nRotate secrets if in doubt. GitLab usually has access to source code, secrets and CI, so if you suspect a breach, rotate tokens, CI variables and deploy keys.\nReferences GitLab Critical Patch Release: 19.5.1 and other versions The Hacker News report GitLab: Detecting security incidents ","permalink":"https://justroham.ir/posts/gitlab-critical-rce-cve-2026-110264/","summary":"\u003cp\u003eOn 21 October 2026 GitLab released a critical patch release that includes \u003ca href=\"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/\"\u003eCVE-2026-110264\u003c/a\u003e, scored \u003cstrong\u003eCVSS 10.0\u003c/strong\u003e, the maximum. The flaw is in GitLab CE and EE and, under certain conditions, lets an \u003cstrong\u003eunauthenticated\u003c/strong\u003e user run arbitrary code on the GitLab server. \u003ca href=\"https://thehackernews.com/2026/10/critical-gitlab-flaw-cvss-100-could.html\"\u003eThe Hacker News\u003c/a\u003e has covered it too.\u003c/p\u003e\n\u003cblockquote\u003e\n\u003cp\u003eIf you run a self-managed GitLab, update first and read the rest later.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003ch2 id=\"summary\"\u003eSummary\u003c/h2\u003e\n\u003ctable\u003e\n  \u003cthead\u003e\n      \u003ctr\u003e\n          \u003cth\u003e\u003c/th\u003e\n          \u003cth\u003e\u003c/th\u003e\n      \u003c/tr\u003e\n  \u003c/thead\u003e\n  \u003ctbody\u003e\n      \u003ctr\u003e\n          \u003ctd\u003eID\u003c/td\u003e\n          \u003ctd\u003eCVE-2026-110264\u003c/td\u003e\n      \u003c/tr\u003e\n      \u003ctr\u003e\n          \u003ctd\u003eScore\u003c/td\u003e\n          \u003ctd\u003e10.0 (Critical)\u003c/td\u003e\n      \u003c/tr\u003e\n      \u003ctr\u003e\n          \u003ctd\u003eVector\u003c/td\u003e\n          \u003ctd\u003e\u003ccode\u003eCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\u003c/code\u003e\u003c/td\u003e\n      \u003c/tr\u003e\n      \u003ctr\u003e\n          \u003ctd\u003eWeakness\u003c/td\u003e\n          \u003ctd\u003eInteger overflow in the regular expression compiler\u003c/td\u003e\n      \u003c/tr\u003e\n      \u003ctr\u003e\n          \u003ctd\u003eReporter\u003c/td\u003e\n          \u003ctd\u003ejoaxcar, via GitLab\u0026rsquo;s HackerOne bug bounty\u003c/td\u003e\n      \u003c/tr\u003e\n  \u003c/tbody\u003e\n\u003c/table\u003e\n\u003cp\u003eThe vector means: reachable over the network, low complexity, no login, no user interaction, with full impact on confidentiality, integrity and availability.\u003c/p\u003e","title":"Critical GitLab Flaw (CVSS 10): Unauthenticated RCE, CVE-2026-110264"},{"content":"On 21 October 2026 the UK National Cyber Security Centre (NCSC) published an alert titled “Critical security issue affecting PHP”. Two vulnerabilities in PHP itself may let an unauthenticated attacker achieve remote code execution (RCE) on a web server running PHP. Both are fixed in new releases.\nIf you run PHP, update first and read the rest later.\nSummary CVE-2026-109618 CVE-2026-109619 Title RCE via OOM corruption RCE via stale global state CVSS v4.0 9.2 (Critical) 9.2 (Critical) Vector AV:N/AC:H/AT:P/PR:N/UI:N AV:N/AC:H/AT:P/PR:N/UI:N Weakness use-after-free, improper error handling use-after-free, stale global state Both are reachable over the network with no login and no user interaction.\nWhat is going on? CVE-2026-109618: PHP uses longjmp() for out-of-memory (OOM) errors. If an allocation fails while request data is only partly initialized, request cleanup may treat the invalid data as valid. That leads to memory corruption and, under certain conditions, RCE. Known triggers involve multipart parsing: a request with no usable content length, an unrestricted number of headers per part, empty file controls that don\u0026rsquo;t count toward max_file_uploads, and nested field names.\nCVE-2026-109619: In long-lived workers, global state (error, session, object and extension state) can keep pointing at request memory after it has been freed. A later request handled by the same worker may use that stale state before normal initialization resets it, causing a use-after-free. Confirmed exploitation paths include PHP 8.5 with fatal_error_backtraces enabled and the session upload progress lifecycle.\nWhat is affected? Vulnerable versions:\nPHP 8.2 before 8.2.35 PHP 8.3 before 8.3.36 PHP 8.4 before 8.4.27 PHP 8.5 before 8.5.12 Fixed versions: 8.2.35, 8.3.36, 8.4.27 and 8.5.12.\nThe NCSC stresses that any organisation using PHP is affected, including products and appliances that bundle it. Unsupported versions older than 8.2 should be moved to a supported release too.\nBy deployment model (per the PHP team\u0026rsquo;s advisories):\nApache mod_php: exploitation validated over HTTP with default settings and normal prefork configurations. PHP-FPM: susceptible according to source analysis, though no complete exploit has been demonstrated. FrankenPHP and LSAPI: likely susceptible, not yet validated. What to do Update. Upgrading to a fixed release is the only complete mitigation.\nFind every PHP install. Start with internet-facing systems, and don\u0026rsquo;t limit the search to old versions. Check containers, Docker images and bundled products (panels, CMSs, appliances). NCSC-NL published an inventory of software with a PHP dependency: NCSC-NL/php2shell.\nIf you can\u0026rsquo;t update right away, apply these partial mitigations:\nSet memory_limit=-1 administratively and restart all workers. Don\u0026rsquo;t use RLIMIT_AS or RLIMIT_DATA: they make mmap() fail and trigger the vulnerable path. Keep post_max_size conservative and enforce request body size at the frontend (Nginx / load balancer). Lower max_input_nesting_level and bound input variables, multipart parts, headers per part and uploads. If your app doesn\u0026rsquo;t use multipart/form-data, block such requests at the frontend. Set session.upload_progress.enabled=0, and on PHP 8.5 set fatal_error_backtraces=0. Then restart workers. If performance doesn\u0026rsquo;t matter, pm.max_requests=1 in PHP-FPM removes state shared between requests. If neither updating nor mitigating is possible, the NCSC suggests taking the system offline.\nCheck for compromise. If the system has been exposed, look for backdoors and unknown files or processes.\nReferences NCSC alert GHSA-w8hw-w9fx-j79w (CVE-2026-109618) GHSA-6wmf-4rv5-p3rp (CVE-2026-109619) NCSC-NL/php2shell ","permalink":"https://justroham.ir/posts/php-critical-rce-cve-2026-109618/","summary":"\u003cp\u003eOn 21 October 2026 the UK National Cyber Security Centre (NCSC) published an alert titled \u003ca href=\"https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php\"\u003e“Critical security issue affecting PHP”\u003c/a\u003e. Two vulnerabilities in PHP itself may let an \u003cstrong\u003eunauthenticated\u003c/strong\u003e attacker achieve \u003cstrong\u003eremote code execution (RCE)\u003c/strong\u003e on a web server running PHP. Both are fixed in new releases.\u003c/p\u003e\n\u003cblockquote\u003e\n\u003cp\u003eIf you run PHP, update first and read the rest later.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003ch2 id=\"summary\"\u003eSummary\u003c/h2\u003e\n\u003ctable\u003e\n  \u003cthead\u003e\n      \u003ctr\u003e\n          \u003cth\u003e\u003c/th\u003e\n          \u003cth\u003eCVE-2026-109618\u003c/th\u003e\n          \u003cth\u003eCVE-2026-109619\u003c/th\u003e\n      \u003c/tr\u003e\n  \u003c/thead\u003e\n  \u003ctbody\u003e\n      \u003ctr\u003e\n          \u003ctd\u003eTitle\u003c/td\u003e\n          \u003ctd\u003eRCE via OOM corruption\u003c/td\u003e\n          \u003ctd\u003eRCE via stale global state\u003c/td\u003e\n      \u003c/tr\u003e\n      \u003ctr\u003e\n          \u003ctd\u003eCVSS v4.0\u003c/td\u003e\n          \u003ctd\u003e9.2 (Critical)\u003c/td\u003e\n          \u003ctd\u003e9.2 (Critical)\u003c/td\u003e\n      \u003c/tr\u003e\n      \u003ctr\u003e\n          \u003ctd\u003eVector\u003c/td\u003e\n          \u003ctd\u003e\u003ccode\u003eAV:N/AC:H/AT:P/PR:N/UI:N\u003c/code\u003e\u003c/td\u003e\n          \u003ctd\u003e\u003ccode\u003eAV:N/AC:H/AT:P/PR:N/UI:N\u003c/code\u003e\u003c/td\u003e\n      \u003c/tr\u003e\n      \u003ctr\u003e\n          \u003ctd\u003eWeakness\u003c/td\u003e\n          \u003ctd\u003euse-after-free, improper error handling\u003c/td\u003e\n          \u003ctd\u003euse-after-free, stale global state\u003c/td\u003e\n      \u003c/tr\u003e\n  \u003c/tbody\u003e\n\u003c/table\u003e\n\u003cp\u003eBoth are reachable over the network with no login and no user interaction.\u003c/p\u003e","title":"Critical PHP RCE Vulnerability: CVE-2026-109618"},{"content":"In the previous post we built a simple publisher and worker on JetStream. But that worker assumed processing always succeeds. In real systems some messages fail every single time, and if you do nothing they either retry forever or get lost.\nThis post adds three things:\nLimiting attempts with MaxDeliver Spacing out attempts with BackOff and NakWithDelay Routing \u0026ldquo;poison\u0026rdquo; messages to a dead-letter stream I tested every behavior below against an embedded NATS server (with JetStream) and the nats.go client, and the outputs come from that run.\nCreating the consumer explicitly Instead of letting PullSubscribe create a default consumer, we create it with the settings we want:\n_, err = js.AddConsumer(\u0026#34;EVENTS\u0026#34;, \u0026amp;nats.ConsumerConfig{ Durable: \u0026#34;worker-consumer\u0026#34;, AckPolicy: nats.AckExplicitPolicy, AckWait: 30 * time.Second, MaxDeliver: 3, BackOff: []time.Duration{500 * time.Millisecond, time.Second}, FilterSubject: \u0026#34;events.created\u0026#34;, }) MaxDeliver: 3 means each message is delivered at most 3 times. AckWait is how long the server waits for an ack before redelivering. BackOff sets the delays between redeliveries. The worker then binds to that same consumer as before:\nsub, _ := js.PullSubscribe(\u0026#34;events.created\u0026#34;, \u0026#34;worker-consumer\u0026#34;) What does Nak do? When processing fails you can either not ack and wait for AckWait, or explicitly ask for redelivery with Nak. I tried both against a \u0026ldquo;poison\u0026rdquo; message that always fails:\nApproach Observed behavior m.Nak() Redelivered immediately. BackOff has no effect. All 3 attempts happened at second zero. m.NakWithDelay(1 * time.Second) Redelivered after the given delay (attempts 2 and 3 at roughly 1s and 2.5s). Not acking Redelivered following BackOff (attempts 2 and 3 at 0.5s and 1.5s in my run; I used a 2s AckWait for the experiment). Practical takeaway: a plain Nak() is dangerous for transient failures because it spins the worker in a tight retry loop. For errors that probably clear up with a little patience (say, the database is briefly unavailable) use NakWithDelay.\nA more complete worker loop:\nfor _, m := range msgs { if err := process(m.Data); err != nil { log.Println(\u0026#34;process failed:\u0026#34;, err) m.NakWithDelay(time.Second) continue } m.Ack() } When attempts run out: the advisory Once MaxDeliver is reached, JetStream stops delivering the message to this consumer. The message stays in the stream, but JetStream publishes an advisory on this subject:\n$JS.EVENT.ADVISORY.CONSUMER.MAX_DELIVERIES.\u0026lt;stream\u0026gt;.\u0026lt;consumer\u0026gt; The JSON payload contains the message\u0026rsquo;s sequence number in the stream (stream_seq) and the number of deliveries (deliveries). With that sequence we can fetch the original message.\nBuilding the dead-letter stream We create a separate stream for failed messages and a small service that listens for the advisory:\njs.AddStream(\u0026amp;nats.StreamConfig{ Name: \u0026#34;DLQ\u0026#34;, Subjects: []string{\u0026#34;dlq.events\u0026#34;}, }) nc.Subscribe(\u0026#34;$JS.EVENT.ADVISORY.CONSUMER.MAX_DELIVERIES.EVENTS.worker-consumer\u0026#34;, func(m *nats.Msg) { var adv struct { Stream string `json:\u0026#34;stream\u0026#34;` StreamSeq uint64 `json:\u0026#34;stream_seq\u0026#34;` Deliveries int `json:\u0026#34;deliveries\u0026#34;` } json.Unmarshal(m.Data, \u0026amp;adv) raw, err := js.GetMsg(adv.Stream, adv.StreamSeq) if err != nil { log.Println(\u0026#34;getmsg:\u0026#34;, err) return } // MsgId prevents storing the same message twice js.Publish(\u0026#34;dlq.events\u0026#34;, raw.Data, nats.MsgId(fmt.Sprintf(\u0026#34;dlq-%d\u0026#34;, adv.StreamSeq))) }) In my test I published three messages: good-1, poison and good-2. The two good ones were delivered once and acked. poison was delivered three times, and then exactly one message landed in the DLQ stream. At the end the consumer had no pending or ack-pending messages.\nA few caveats Advisories are core NATS messages, not JetStream ones. If the DLQ service is down at the moment the advisory is published, it misses it. For critical systems you need a fallback, such as periodically inspecting the consumer with ConsumerInfo or persisting advisories into a stream. The original message is not removed from the stream after hitting MaxDeliver. How long it stays depends on that stream\u0026rsquo;s retention policy. Permanent failures (like a corrupt payload) are pointless to retry. If you can detect them, call m.Term() right away so JetStream never delivers the message again. The MsgId above only deduplicates within the stream\u0026rsquo;s duplicate-detection window. What\u0026rsquo;s next Two topics remain for the next post: running multiple workers on one consumer, and monitoring processing lag. The full code for the base example is in go-nats-demo.\n","permalink":"https://justroham.ir/posts/nats-jetstream-retry-dlq/","summary":"\u003cp\u003eIn the \u003ca href=\"/posts/nats-jetstream-go/\"\u003eprevious post\u003c/a\u003e we built a simple publisher and worker on JetStream. But that worker assumed processing always succeeds. In real systems some messages fail every single time, and if you do nothing they either retry forever or get lost.\u003c/p\u003e\n\u003cp\u003eThis post adds three things:\u003c/p\u003e\n\u003col\u003e\n\u003cli\u003eLimiting attempts with \u003ccode\u003eMaxDeliver\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003eSpacing out attempts with \u003ccode\u003eBackOff\u003c/code\u003e and \u003ccode\u003eNakWithDelay\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003eRouting \u0026ldquo;poison\u0026rdquo; messages to a \u003cstrong\u003edead-letter\u003c/strong\u003e stream\u003c/li\u003e\n\u003c/ol\u003e\n\u003cblockquote\u003e\n\u003cp\u003eI tested every behavior below against an embedded NATS server (with JetStream) and the \u003ccode\u003enats.go\u003c/code\u003e client, and the outputs come from that run.\u003c/p\u003e","title":"Retry and Dead-Letter Queues in NATS JetStream with Go"},{"content":"When I want to really understand a concept, I build the smallest runnable example of it. This time it was NATS JetStream. The result is go-nats-demo: a publisher, a worker and NATS itself, all wired together with Docker Compose.\nWhy JetStream? Core NATS only delivers messages to subscribers that are connected at that moment. If the worker is down, the message is gone. JetStream adds persistence on top of NATS: messages are stored in a stream, and consumers can read them later and acknowledge them.\nLayout go-nats-demo/ ├── docker-compose.yml ├── publisher/ (Dockerfile + main.go) └── worker/ (Dockerfile + main.go) NATS with JetStream and the monitoring dashboard on port 8222 Publisher sends a message to events.created every 2 seconds Worker reads messages, logs them and acks Connecting with retry Docker Compose doesn\u0026rsquo;t guarantee NATS is up before our services. So both services try to connect up to 10 times, 2 seconds apart:\nfunc connectNATS(url string) *nats.Conn { for i := 0; i \u0026lt; 10; i++ { nc, err := nats.Connect(url) if err == nil { return nc } log.Println(\u0026#34;Waiting for NATS to be ready...\u0026#34;, err) time.Sleep(2 * time.Second) } log.Fatal(\u0026#34;Failed to connect to NATS after 10 attempts\u0026#34;) return nil } Publisher: create the stream and publish The publisher creates the stream if it doesn\u0026rsquo;t exist, then publishes in a loop:\njs, _ := nc.JetStream() _, err := js.AddStream(\u0026amp;nats.StreamConfig{ Name: \u0026#34;EVENTS\u0026#34;, Subjects: []string{\u0026#34;events.created\u0026#34;}, }) if err != nil \u0026amp;\u0026amp; err != nats.ErrStreamNameAlreadyInUse { log.Fatal(err) } for { msg := []byte(time.Now().Format(time.RFC3339)) if _, err := js.Publish(\u0026#34;events.created\u0026#34;, msg); err != nil { log.Println(\u0026#34;publish error:\u0026#34;, err) } time.Sleep(2 * time.Second) } Worker: a pull consumer with a durable name The key detail is that the worker has a durable name (worker-consumer). JetStream keeps this consumer\u0026rsquo;s read position, so if the worker restarts it resumes where it left off and receives the messages it missed:\nsub, err := js.PullSubscribe(\u0026#34;events.created\u0026#34;, \u0026#34;worker-consumer\u0026#34;) if err != nil { log.Fatal(err) } for { msgs, err := sub.Fetch(10, nats.MaxWait(5*time.Second)) if err != nil \u0026amp;\u0026amp; err != nats.ErrTimeout { log.Println(\u0026#34;fetch error:\u0026#34;, err) continue } for _, m := range msgs { log.Println(\u0026#34;Received:\u0026#34;, string(m.Data)) m.Ack() } } Fetch(10, ...) pulls up to 10 messages at once and Ack() tells JetStream processing is done. A message that isn\u0026rsquo;t acked gets redelivered.\nRunning it git clone git@github.com:h-agharezaei/go-nats-demo.git cd go-nats-demo docker compose up --build Then open the NATS dashboard at http://localhost:8222/. To see the durable consumer in action, stop only the worker service, start it again and watch the logs.\nNext steps This example is intentionally simple. For real workloads I want to dig into retry policy and MaxDeliver, dead-lettering, multiple workers on one consumer, and monitoring processing lag.\n","permalink":"https://justroham.ir/posts/nats-jetstream-go/","summary":"\u003cp\u003eWhen I want to really understand a concept, I build the smallest runnable example of it. This time it was \u003cstrong\u003eNATS JetStream\u003c/strong\u003e. The result is \u003ca href=\"https://github.com/h-agharezaei/go-nats-demo\"\u003ego-nats-demo\u003c/a\u003e: a publisher, a worker and NATS itself, all wired together with Docker Compose.\u003c/p\u003e\n\u003ch2 id=\"why-jetstream\"\u003eWhy JetStream?\u003c/h2\u003e\n\u003cp\u003eCore NATS only delivers messages to subscribers that are connected at that moment. If the worker is down, the message is gone. \u003cstrong\u003eJetStream\u003c/strong\u003e adds persistence on top of NATS: messages are stored in a stream, and consumers can read them later and acknowledge them.\u003c/p\u003e","title":"A Simple Publisher and Worker with NATS JetStream in Go"},{"content":"Hi! I\u0026rsquo;m Roham, a Senior Software Engineer based in Tehran.\nI mostly work with Go and Node.js, and I care about clean architecture, efficient APIs and the details that make backend systems reliable.\nWhat I work on Designing and building backend services and APIs Event-driven systems with Kafka and NATS JetStream Concurrency in Go: goroutines, contexts, connectivity and resilience Market data and technical-analysis tooling (candles, indicators, signals) Currently exploring Rust, through a market-analysis engine (quant-core) Quantitative analysis and multi-timeframe market structure Skills Languages: Go, TypeScript / Node.js (NestJS), Rust, Python Messaging: Apache Kafka, NATS JetStream Tooling: Docker, Docker Compose, Hugo, GitHub Actions Contact GitHub LinkedIn ","permalink":"https://justroham.ir/about/","summary":"\u003cp\u003eHi! I\u0026rsquo;m \u003cstrong\u003eRoham\u003c/strong\u003e, a Senior Software Engineer based in Tehran.\u003c/p\u003e\n\u003cp\u003eI mostly work with \u003cstrong\u003eGo\u003c/strong\u003e and \u003cstrong\u003eNode.js\u003c/strong\u003e, and I care about clean architecture, efficient APIs and the details that make backend systems reliable.\u003c/p\u003e\n\u003ch2 id=\"what-i-work-on\"\u003eWhat I work on\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDesigning and building backend services and APIs\u003c/li\u003e\n\u003cli\u003eEvent-driven systems with Kafka and NATS JetStream\u003c/li\u003e\n\u003cli\u003eConcurrency in Go: goroutines, contexts, connectivity and resilience\u003c/li\u003e\n\u003cli\u003eMarket data and technical-analysis tooling (candles, indicators, signals)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2 id=\"currently-exploring\"\u003eCurrently exploring\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eRust\u003c/strong\u003e, through a market-analysis engine (\u003ca href=\"https://github.com/h-agharezaei/quant-core\"\u003equant-core\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eQuantitative analysis and multi-timeframe market structure\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2 id=\"skills\"\u003eSkills\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eLanguages:\u003c/strong\u003e Go, TypeScript / Node.js (NestJS), Rust, Python\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eMessaging:\u003c/strong\u003e Apache Kafka, NATS JetStream\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eTooling:\u003c/strong\u003e Docker, Docker Compose, Hugo, GitHub Actions\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2 id=\"contact\"\u003eContact\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/h-agharezaei\"\u003eGitHub\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://www.linkedin.com/in/hossein-agharezaei/\"\u003eLinkedIn\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e","title":"About Me"},{"content":"Welcome to My Blog! This is the first post I\u0026rsquo;m publishing on my personal website.\nWhy Did I Create This Site? To share my experiences and knowledge To learn more To connect with people interested in similar topics To Be Continued\u0026hellip; I will publish more articles soon. Stay tuned!\n","permalink":"https://justroham.ir/posts/first-post/","summary":"\u003ch2 id=\"welcome-to-my-blog\"\u003eWelcome to My Blog!\u003c/h2\u003e\n\u003cp\u003eThis is the first post I\u0026rsquo;m publishing on my personal website.\u003c/p\u003e\n\u003ch2 id=\"why-did-i-create-this-site\"\u003eWhy Did I Create This Site?\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eTo share my experiences and knowledge\u003c/li\u003e\n\u003cli\u003eTo learn more\u003c/li\u003e\n\u003cli\u003eTo connect with people interested in similar topics\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2 id=\"to-be-continued\"\u003eTo Be Continued\u0026hellip;\u003c/h2\u003e\n\u003cp\u003eI will publish more articles soon. Stay tuned!\u003c/p\u003e","title":"My First Post"},{"content":"A class option that fixes the attribute names up front so instances store them without a per-instance dict, saving memory and blocking new attributes.\n","permalink":"https://justroham.ir/glossary/slots/","summary":"A class option that fixes the attribute names up front so instances store them without a per-instance \u003cstrong\u003edict\u003c/strong\u003e, saving memory and blocking new attributes.","title":"__slots__"},{"content":"Ignoring only affects untracked files. A file that is already tracked stays tracked until you run git rm --cached. git check-ignore -v shows which rule matches.\n","permalink":"https://justroham.ir/glossary/gitignore/","summary":"a file of patterns telling Git which untracked files to leave alone.","title":".gitignore"},{"content":"Dijkstra guided by a heuristic estimate of the remaining cost, so fewer nodes are expanded.\nThe heap is ordered by cost so far plus the estimate. If the estimate never overestimates (it is admissible), the path found is still optimal.\n","permalink":"https://justroham.ir/glossary/a-star/","summary":"Dijkstra guided by a heuristic estimate of the remaining cost, so fewer nodes are expanded.","title":"A*"},{"content":"Two compiled pieces can call each other only if they agree on the ABI. Rust has no stable ABI of its own, so FFI goes through the C ABI (extern \u0026quot;C\u0026quot;). CPython also defines a limited, stable ABI (abi3) that lets one compiled extension work across several Python versions.\n","permalink":"https://justroham.ir/glossary/abi/","summary":"Application Binary Interface: the binary-level contract (calling convention, type layout, symbol names) between compiled code.","title":"ABI"},{"content":"You pass controller.signal to an API that supports it (timers, fetch, fs\u0026hellip;). Calling controller.abort() makes the operation reject with an AbortError. AbortSignal.timeout(ms) makes a signal that aborts by itself.\n","permalink":"https://justroham.ir/glossary/abort-controller/","summary":"A standard object that signals cancellation to async operations through its AbortSignal.","title":"AbortController"},{"content":"Atomicity means all-or-nothing, consistency means constraints always hold after a commit, isolation means concurrent transactions do not see each other\u0026rsquo;s half-done work, and durability means a committed change survives a crash.\n","permalink":"https://justroham.ir/glossary/acid/","summary":"The four guarantees of a transaction: Atomicity, Consistency, Isolation, Durability.","title":"ACID"},{"content":"With explicit acks the server keeps a message as pending until the consumer answers. ack means done, nak asks for redelivery (optionally after a delay), and term tells the server to stop redelivering it.\n","permalink":"https://justroham.ir/glossary/acknowledgement/","summary":"The consumer\u0026rsquo;s reply to JetStream: ack (done), nak (retry), term (never retry).","title":"Acknowledgement (ack)"},{"content":"If the consumer does not ack, nak or term within the AckWait, the server sends the message again, up to max_deliver times. A backoff list can replace the single value with growing delays.\n","permalink":"https://justroham.ir/glossary/ack-wait/","summary":"How long JetStream waits for an ack before it redelivers a message.","title":"AckWait"},{"content":"With ACME the server proves it controls a domain (for example by answering a challenge), and the CA issues a short-lived certificate. Let\u0026rsquo;s Encrypt uses it. Automation is what makes short lifetimes practical.\n","permalink":"https://justroham.ir/glossary/acme/","summary":"A protocol that lets software request and renew certificates from a CA automatically.","title":"ACME"},{"content":"Compile with -fsanitize=address and the program stops at the first bad access with a report naming the error type and the line. It slows the program down and is meant for tests and CI, not production. Fuzzing is often run with it.\n","permalink":"https://justroham.ir/glossary/addresssanitizer/","summary":"A compiler-inserted runtime checker (ASan) that reports out-of-bounds access, use-after-free and double free.","title":"AddressSanitizer"},{"content":"A graph representation that stores, for every vertex, the list of its neighbours. It uses memory proportional to V + E and suits sparse graphs.\n","permalink":"https://justroham.ir/glossary/adjacency-list/","summary":"A graph representation that stores, for every vertex, the list of its neighbours. It uses memory proportional to V + E and suits sparse graphs.","title":"Adjacency list"},{"content":"An ADR lives in the repository next to the code. It has a context, a decision and its consequences, and it is not edited after acceptance: a changed mind becomes a new ADR that supersedes the old one.\n","permalink":"https://justroham.ir/glossary/adr/","summary":"Architecture Decision Record: a short, numbered note saying what was decided, why, and with what trade-offs.","title":"ADR"},{"content":"pg_advisory_lock(42) and pg_try_advisory_lock(42) lock a key you choose, not a row or table. Everyone who uses the same key must cooperate. It is handy for \u0026ldquo;only one instance runs this job\u0026rdquo;.\n","permalink":"https://justroham.ir/glossary/advisory-lock/","summary":"An application-defined lock on a number; the database enforces it but attaches no meaning to it.","title":"Advisory lock"},{"content":"AES-GCM and ChaCha20-Poly1305 are AEAD constructions. Opening a modified ciphertext fails with an error instead of returning garbage.\n","permalink":"https://justroham.ir/glossary/aead/","summary":"Authenticated encryption with associated data: one operation that gives confidentiality and tamper detection.","title":"AEAD"},{"content":"Go offers it through cipher.NewGCM. It needs a unique nonce per message and can bind extra data (AAD), such as a record id, to the ciphertext.\n","permalink":"https://justroham.ir/glossary/aes-gcm/","summary":"An authenticated encryption mode: it hides the data and detects any change to it.","title":"AES-GCM"},{"content":"Outside code talks only to the aggregate root. Other aggregates are referenced by ID, and one transaction changes one aggregate.\n","permalink":"https://justroham.ir/glossary/aggregate/","summary":"A cluster of objects changed as one unit, with a root that enforces its rules.","title":"Aggregate"},{"content":"It has an errors array. Promise.any rejects with one when every input promise rejected. See promise.\n","permalink":"https://justroham.ir/glossary/aggregate-error/","summary":"An error that bundles several errors, e.g. what Promise.any rejects with.","title":"AggregateError"},{"content":"Every alert should be actionable. Tuning thresholds trades missed detections against noise, and the right point depends on how costly each is.\n","permalink":"https://justroham.ir/glossary/alert-fatigue/","summary":"When too many false alerts make people ignore or mute the real ones.","title":"Alert fatigue"},{"content":"Safer than a block-list, which tries to name every bad value and always misses one. Typical examples are allowed URL schemes, ports and destination hosts.\n","permalink":"https://justroham.ir/glossary/allow-list/","summary":"A list of the only values accepted, with everything else rejected by default.","title":"Allow-list"},{"content":"In the handshake the client lists protocols (h2, http/1.1) and the server picks one. That is how HTTPS decides between HTTP/2 and HTTP/1.1 without an extra round trip.\n","permalink":"https://justroham.ir/glossary/alpn/","summary":"Application-Layer Protocol Negotiation: TLS picks the protocol, such as h2 or http/1.1.","title":"ALPN"},{"content":"Cost per operation averaged over a whole sequence of operations. An append that sometimes copies everything is still O(1) amortized if the expensive copies are rare enough.\n","permalink":"https://justroham.ir/glossary/amortized-analysis/","summary":"Cost per operation averaged over a whole sequence of operations. An append that sometimes copies everything is still O(1) amortized if the expensive copies are rare enough.","title":"Amortized analysis"},{"content":"A lightweight tag is only a ref pointing at a commit. An annotated tag (git tag -a) is a separate tag object that points at the commit, so git cat-file -t prints tag for it instead of commit.\n","permalink":"https://justroham.ir/glossary/annotated-tag/","summary":"a tag stored as its own object with a message, author and date.","title":"Annotated tag"},{"content":"Legacy field names such as cust_nm stop at the layer; inside, the code uses its own names.\n","permalink":"https://justroham.ir/glossary/anti-corruption-layer/","summary":"A translation layer that keeps another system\u0026rsquo;s model from leaking into yours.","title":"Anti-corruption layer"},{"content":"Usually built on a Merkle tree so that comparing two large replicas costs little when they are almost equal.\n","permalink":"https://justroham.ir/glossary/anti-entropy/","summary":"A background process that compares replicas and copies the differences, whether or not anyone reads the data.","title":"Anti-entropy"},{"content":"If the contract is only in people\u0026rsquo;s heads, a rename can break a client without anyone noticing. Writing it down in a machine-readable form lets tests check it.\n","permalink":"https://justroham.ir/glossary/api-contract/","summary":"The written agreement about what an API accepts and returns, which both client and server must keep.","title":"API contract"},{"content":"An integer type whose size grows as needed, so results never overflow. Python\u0026rsquo;s int works this way.\n","permalink":"https://justroham.ir/glossary/arbitrary-precision/","summary":"An integer type whose size grows as needed, so results never overflow. Python\u0026rsquo;s int works this way.","title":"Arbitrary precision"},{"content":"Because it needs lots of memory per guess, it is harder to attack with GPUs. Hashes are usually stored in the PHC string format with the parameters inside.\n","permalink":"https://justroham.ir/glossary/argon2/","summary":"A modern password hashing function whose cost is set by time, memory and parallelism; argon2id is the usual variant.","title":"argon2"},{"content":"argparse turns sys.argv into typed values. It supports subcommands, choices and mutually exclusive groups, builds the --help text for you, and on a usage error prints a message to stderr and exits with status 2.\n","permalink":"https://justroham.ir/glossary/argparse/","summary":"The standard-library module that parses command-line arguments, generates \u0026ndash;help and exits with code 2 on bad usage.","title":"argparse"},{"content":"An async function always returns a promise. await pauses only that function until the promise settles; the thread stays free for the event loop.\n","permalink":"https://justroham.ir/glossary/async-await/","summary":"Syntax that lets you write code on top of promises as if it were sequential.","title":"async/await"},{"content":"It is what you get when an unacknowledged message is redelivered. Consumers must therefore be idempotent.\n","permalink":"https://justroham.ir/glossary/at-least-once-delivery/","summary":"The broker delivers every message one or more times, never zero, so duplicates are possible.","title":"At-least-once delivery"},{"content":"Atomic commits keep each step small, buildable and easy to review or revert. They also make git bisect precise: the first bad commit it reports is a small diff, not a week of work.\n","permalink":"https://justroham.ir/glossary/atomic-commit/","summary":"A commit that contains one complete, logical change and nothing else.","title":"Atomic commit"},{"content":"The usual recipe is to write to a temporary file in the same directory and then rename it over the target. On POSIX filesystems a rename within one filesystem replaces the name in one step.\n","permalink":"https://justroham.ir/glossary/atomic-write/","summary":"Writing a file so readers see either the old or the new content, never a half-written one.","title":"Atomic write"},{"content":"An audit log answers legal and forensic questions, not debugging ones. Each record names an actor, an action, a resource, an outcome, a request id, a source address and a UTC timestamp. It is append-only and ideally kept off the machine that writes it.\n","permalink":"https://justroham.ir/glossary/audit-log/","summary":"A tamper-evident record of who did what to which object, when, from where, and with what result.","title":"Audit log"},{"content":"An authoritative server is the source of truth for a zone. It does not search elsewhere: it answers from its own data or says the name does not exist, and sets the AA (authoritative answer) flag.\n","permalink":"https://justroham.ir/glossary/authoritative-server/","summary":"A DNS server that holds the real records of a zone and answers with the AA flag.","title":"Authoritative server"},{"content":"Authentication answers who you are; authorization answers what you may do. It must be checked on the server for every function and every object, not only at login.\n","permalink":"https://justroham.ir/glossary/authorization/","summary":"Deciding what an already identified caller is allowed to do.","title":"Authorization"},{"content":"Tokens never travel through the URL. Current guidance recommends it, with PKCE, for all clients.\n","permalink":"https://justroham.ir/glossary/authorization-code-flow/","summary":"The OAuth2 flow where the browser carries only a short-lived code and the client swaps it for tokens on a back channel.","title":"Authorization Code flow"},{"content":"One key per line, optionally prefixed by options such as restrict, from= and command=. It controls who may log in, not whether the server is genuine (see known_hosts).\n","permalink":"https://justroham.ir/glossary/authorized-keys/","summary":"The server-side file listing public keys allowed to log in, with optional restrictions per key.","title":"authorized_keys"},{"content":"Its thresholds are settings such as autovacuum_vacuum_threshold and autovacuum_vacuum_scale_factor; check the docs before changing them.\n","permalink":"https://justroham.ir/glossary/autovacuum/","summary":"The PostgreSQL background worker that runs VACUUM and ANALYZE automatically when a table has enough changes.","title":"Autovacuum"},{"content":"The balance rule bounds the height by about 1.44 log2(n+2), so every operation is O(log n) even for sorted input. It repairs imbalance after each insert or delete with rotations.\n","permalink":"https://justroham.ir/glossary/avl-tree/","summary":"A binary search tree that keeps the heights of every node\u0026rsquo;s two subtrees within 1 of each other using rotations.","title":"AVL tree"},{"content":"A lookup starts at the root page, follows one pointer per level and ends in a leaf page that holds the key. Because the tree is wide and shallow, even millions of rows need only a few page reads, which is a binary-search-like O(log n) descent.\n","permalink":"https://justroham.ir/glossary/b-tree/","summary":"A balanced tree of fixed-size pages with sorted keys, the default index type in PostgreSQL.","title":"B-tree"},{"content":"One giant UPDATE holds row locks and produces dead rows all at once. A loop that updates an id range per batch keeps each transaction small.\n","permalink":"https://justroham.ir/glossary/backfill/","summary":"Filling a new column for existing rows, in small batches so locks and transactions stay short.","title":"Backfill"},{"content":"The memory block a slice points into. Several slices can share one backing array, so a write through one can be seen through another.\n","permalink":"https://justroham.ir/glossary/backing-array/","summary":"The memory block a slice points into. Several slices can share one backing array, so a write through one can be seen through another.","title":"Backing array"},{"content":"When a stream cannot accept data as fast as it arrives, write() returns false. The producer should stop until the 'drain' event fires. Ignoring the signal makes memory grow with the size of the backlog.\n","permalink":"https://justroham.ir/glossary/backpressure/","summary":"A signal from a slow consumer telling a fast producer to pause so buffers do not grow without limit.","title":"Backpressure"},{"content":"Backtracking is depth-first search over choices: choose, explore, unchoose. Abandoning a partial solution as soon as it breaks a rule is called pruning, and it is what makes the search affordable.\n","permalink":"https://justroham.ir/glossary/backtracking/","summary":"Building a solution step by step and undoing a step when it cannot lead to an answer.","title":"Backtracking"},{"content":"The output looks like $2a$10$...: version, cost (a power of two of rounds) and salt plus hash in one string.\n","permalink":"https://justroham.ir/glossary/bcrypt/","summary":"A password hashing function with a cost parameter and a built-in salt; it only uses the first 72 bytes of the password.","title":"bcrypt"},{"content":"Because holding it is enough, send it only over TLS, keep it out of URLs and logs, and keep its lifetime short.\n","permalink":"https://justroham.ir/glossary/bearer-token/","summary":"A token that grants access to whoever holds it, sent as \u003ccode\u003eAuthorization: Bearer \u0026lt;token\u0026gt;\u003c/code\u003e.","title":"Bearer token"},{"content":"Shortest paths that allow negative weights by relaxing every edge up to V times, at O(V·E).\nIf a V-th round still improves a distance, a negative cycle is reachable from the source.\n","permalink":"https://justroham.ir/glossary/bellman-ford/","summary":"Shortest paths that allow negative weights by relaxing every edge up to V times, at O(V·E).","title":"Bellman-Ford"},{"content":"Big-O describes growth, not speed: O(n) means the cost grows at most in proportion to n for large n. Constants and smaller terms are dropped, so two O(n) algorithms can differ a lot in real time. See Binary search (O(log n)) and Amortized analysis.\n","permalink":"https://justroham.ir/glossary/big-o/","summary":"An upper bound on how an algorithm\u0026rsquo;s cost grows with input size n, ignoring constants and lower-order terms.","title":"Big-O"},{"content":"In a min-heap stored in a slice, the children of index i are 2i+1 and 2i+2, and the parent is (i-1)/2. Push appends and sifts up; Pop moves the last item to the root and sifts down. Both are O(log n), Peek is O(1). Siblings are not ordered, so a heap is not a sorted list.\n","permalink":"https://justroham.ir/glossary/binary-heap/","summary":"A complete binary tree stored in a slice where every parent is not larger than its children; the minimum is always at index 0.","title":"Binary heap"},{"content":"Look at the middle element, decide which half can still contain the answer, and repeat. 1000 items need at most about 10 steps. git bisect applies it to commit history.\n","permalink":"https://justroham.ir/glossary/binary-search/","summary":"A search that discards half of the remaining range at every step, in O(log n).","title":"Binary search"},{"content":"Search, insert and delete follow one path from the root, so they cost O(height). Without balancing, the height can grow to n. See AVL tree.\n","permalink":"https://justroham.ir/glossary/binary-search-tree/","summary":"A tree where every node\u0026rsquo;s left subtree holds smaller keys and its right subtree larger ones.","title":"Binary search tree"},{"content":"A graph whose vertices can be split into two groups so that every edge joins different groups. Equivalent to having no odd-length cycle.\n","permalink":"https://justroham.ir/glossary/bipartite-graph/","summary":"A graph whose vertices can be split into two groups so that every edge joins different groups. Equivalent to having no odd-length cycle.","title":"Bipartite graph"},{"content":"With several indexes the bitmaps can be combined with BitmapAnd or BitmapOr.\n","permalink":"https://justroham.ir/glossary/bitmap-scan/","summary":"A plan that collects matching row locations from one or more indexes into a bitmap, then reads the table pages in order.","title":"Bitmap scan"},{"content":"The blast radius is the part of the system or traffic affected when a change goes wrong. Canary releases, cells and feature flags exist mainly to make it small. You can measure it as the number of requests served by the bad version.\n","permalink":"https://justroham.ir/glossary/blast-radius/","summary":"how many users or requests a bad change can hurt.","title":"Blast radius"},{"content":"A blob is addressed by the hash of its content. Two files with identical content share one blob; names and modes live in tree objects and in the index.\n","permalink":"https://justroham.ir/glossary/blob/","summary":"the Git object that stores the content of one file, with no name.","title":"Blob"},{"content":"A Bloom filter sets k bits per inserted key and checks the same k bits on lookup. If any bit is 0 the key was never added; if all are 1 it may be a false positive. It uses far less memory than a set but cannot delete (a counting variant can). See Hash table.\n","permalink":"https://justroham.ir/glossary/bloom-filter/","summary":"A bit-array structure that answers \u0026lsquo;definitely not present\u0026rsquo; or \u0026lsquo;maybe present\u0026rsquo;, never a false negative.","title":"Bloom filter"},{"content":"The switch is one cheap step (a symlink, a load balancer target), so going back is the same step in reverse. The price is running two copies and handling a database both versions can use.\n","permalink":"https://justroham.ir/glossary/blue-green-deployment/","summary":"Two identical releases side by side; traffic switches from the live one to the new one only after it is healthy.","title":"Blue/green deployment"},{"content":"\u0026amp;T is a shared reference and \u0026amp;mut T an exclusive one. At any time you may have many \u0026amp;T or exactly one \u0026amp;mut T, never both. The borrow checker enforces this at compile time, which prevents data races and iterator invalidation.\n","permalink":"https://justroham.ir/glossary/borrowing/","summary":"Using a value through a reference without taking ownership of it.","title":"Borrowing"},{"content":"\u0026ldquo;Customer\u0026rdquo; may mean a credit holder in Sales and a delivery recipient in Shipping. Each context keeps its own type and they talk through translation.\n","permalink":"https://justroham.ir/glossary/bounded-context/","summary":"A boundary inside which one model and one language apply consistently.","title":"Bounded context"},{"content":"A branch is just a file under .git/refs/heads/ that contains the 40-character id of one commit. Making a commit on the current branch moves that file to the new commit. Creating a branch costs 41 bytes.\n","permalink":"https://justroham.ir/glossary/git-branch/","summary":"a movable pointer: a file holding one commit id.","title":"Branch"},{"content":"Branch by abstraction puts an interface in front of the old implementation, adds the new one beside it, and switches between them (often with a feature flag). The rewrite is merged to the main branch in small steps instead of living on a long branch.\n","permalink":"https://justroham.ir/glossary/branch-by-abstraction/","summary":"replace code in small steps by hiding old and new behind one interface.","title":"Branch by abstraction"},{"content":"Typical rules: no direct pushes, required approvals, required passing CI checks, no force-push. The exact options depend on the platform and plan.\n","permalink":"https://justroham.ir/glossary/branch-protection/","summary":"Hosting-platform rules that restrict how a branch such as main can be changed.","title":"Branch protection"},{"content":"Visiting a tree or graph level by level, nearest nodes first, using a queue. It finds shortest paths in unweighted graphs.\n","permalink":"https://justroham.ir/glossary/bfs/","summary":"Visiting a tree or graph level by level, nearest nodes first, using a queue. It finds shortest paths in unweighted graphs.","title":"Breadth-first search"},{"content":"Examples: removing a field, making an optional request field required, changing a type. Adding an optional response field is usually safe.\n","permalink":"https://justroham.ir/glossary/breaking-change/","summary":"A change to an API that makes a correctly written existing client stop working.","title":"Breaking change"},{"content":"From Fred Brooks\u0026rsquo;s book The Mythical Man-Month. Newcomers need ramp-up time and communication channels grow as n(n-1)/2.\n","permalink":"https://justroham.ir/glossary/brooks-law/","summary":"Adding people to a late software project tends to make it later.","title":"Brooks's law"},{"content":"In C, char buf[8] has no length check: memset(buf, 'A', 10) happily writes two bytes past the end. On the stack this is a stack-buffer-overflow. Fixes: pass the real size, use bounds-checked types, and run tests with AddressSanitizer.\n","permalink":"https://justroham.ir/glossary/buffer-overflow/","summary":"Writing (or reading) past the end of a fixed-size buffer, corrupting neighbouring memory.","title":"Buffer overflow"},{"content":"The line //go:build linux makes a Go file compile only on Linux; //go:build !linux marks its counterpart. A file name like x_linux.go has the same effect.\n","permalink":"https://justroham.ir/glossary/build-tag/","summary":"A \u003ccode\u003e//go:build\u003c/code\u003e line at the top of a Go file that selects the OS or conditions the file compiles under.","title":"Build tag"},{"content":"The name comes from the compartments of a ship. In code it is usually a separate worker pool or a semaphore per dependency, so the failure of one part floods only its own compartment.\n","permalink":"https://justroham.ir/glossary/bulkhead/","summary":"Separate resource limits per dependency so one slow dependency cannot use up everything.","title":"Bulkhead"},{"content":"A burn rate of 14.4 empties a 30-day budget in about 50 hours. Alerts that use two windows at once page quickly on real incidents and ignore short blips.\n","permalink":"https://justroham.ir/glossary/burn-rate/","summary":"Observed error rate divided by the error rate the SLO allows; 1 spends the whole budget exactly.","title":"Burn rate"},{"content":"A BOM is a few bytes at the start of a file. UTF-8 does not need one, but Excel adds or expects it to detect the encoding. If you read such a file as plain utf-8, the BOM shows up as the character \\ufeff glued to the first column name; utf-8-sig removes it.\n","permalink":"https://justroham.ir/glossary/byte-order-mark/","summary":"Invisible bytes at the start of a text file; in UTF-8 they are EF BB BF and mark the file as UTF-8.","title":"Byte order mark"},{"content":"Data that is used together and sits close together in memory is cheaper to read, because the CPU fetches memory in small blocks (cache lines) and tends to prefetch sequential access. Arrays have good locality; pointer-chasing structures such as a linked list can have poor locality.\n","permalink":"https://justroham.ir/glossary/cache-locality/","summary":"Data that is used together and sits close together in memory is cheaper to read, because the CPU loads memory in cache lines and prefetches sequential access.","title":"Cache locality"},{"content":"In a canary release a new version or code path serves a small percentage of users while you watch errors and metrics. If it looks healthy the share grows; if not, you stop and roll back. Percentage rollout with a feature flag is one way to do it.\n","permalink":"https://justroham.ir/glossary/canary-release/","summary":"exposing a change to a small share of traffic first.","title":"Canary release"},{"content":"Formalised by Gilbert and Lynch. It says nothing about latency or about the time when there is no partition; see PACELC and linearizability.\n","permalink":"https://justroham.ir/glossary/cap-theorem/","summary":"During a network partition a system must give up either linearizability or availability for the operations it cannot complete.","title":"CAP theorem"},{"content":"It combines a back-of-envelope model (traffic, storage, memory, servers), measurements of the real system, load tests and headroom such as N+1.\n","permalink":"https://justroham.ir/glossary/capacity-planning/","summary":"Estimating and checking how much hardware a service needs for expected load, and repeating it as load grows.","title":"Capacity planning"},{"content":"Typical chain: a dependency gets slow, requests pile up waiting on it, threads or memory run out, and the service becomes slow for everyone. Timeouts, circuit breakers, bulkheads and load shedding are the standard brakes.\n","permalink":"https://justroham.ir/glossary/cascading-failure/","summary":"A failure that spreads: one slow or failed component exhausts its callers, which then fail their own callers.","title":"Cascading failure"},{"content":"A reply is seen after the question it answers, on every node. Concurrent, unrelated writes may appear in different orders on different nodes.\n","permalink":"https://justroham.ir/glossary/causal-consistency/","summary":"If one operation could have influenced another, everyone sees them in that order; unrelated ones may differ.","title":"Causal consistency"},{"content":"A CA signs certificates. A client trusts a certificate if a chain of signatures leads to a CA in its trust store (or one given with -CAfile). A private CA made for a demo or an internal network works the same way, only your machines trust it.\n","permalink":"https://justroham.ir/glossary/certificate-authority/","summary":"The party whose signature on a certificate a client chooses to trust.","title":"Certificate authority (CA)"},{"content":"A server certificate is usually signed by an intermediate CA, which is signed by a root the client trusts. The server must send the leaf and the intermediates; the root comes from the client\u0026rsquo;s trust store. A missing intermediate causes a verification failure.\nSee certificate authority.\n","permalink":"https://justroham.ir/glossary/certificate-chain/","summary":"The list leaf, intermediate(s), root that links a server certificate to a trusted root CA.","title":"Certificate chain"},{"content":"The client stores the SHA-256 hash of the server\u0026rsquo;s public key (SPKI) and rejects any other key, even if a trusted CA signed it. It limits the damage of a wrongly issued certificate but makes rotation harder, so pin carefully and keep a backup pin.\n","permalink":"https://justroham.ir/glossary/certificate-pinning/","summary":"Accepting only a server whose certificate or public key matches a hash the client already knows.","title":"Certificate pinning"},{"content":"A control group (cgroup) is a directory in a tree, usually under /sys/fs/cgroup in version 2. You put processes in it by writing their PID to cgroup.procs, and files such as memory.max and pids.max set limits, according to the kernel docs.\n","permalink":"https://justroham.ir/glossary/cgroup/","summary":"A kernel feature that groups processes and limits or accounts for their CPU, memory and process count.","title":"cgroup"},{"content":"A channel is created with make(chan T). An unbuffered channel blocks the sender until a receiver is ready; a buffered channel (make(chan T, n)) blocks only when full. Closing a channel signals that no more values will be sent, and for v := range ch stops when it is closed.\nch := make(chan int, 1) ch \u0026lt;- 42 fmt.Println(\u0026lt;-ch) ","permalink":"https://justroham.ir/glossary/channel/","summary":"A typed conduit that goroutines use to send and receive values safely.","title":"Channel"},{"content":"A discipline of running small, controlled experiments: define a measurable steady state, hypothesise it survives a failure, inject the failure, compare. The Principles of Chaos Engineering describe this loop.\n","permalink":"https://justroham.ir/glossary/chaos-engineering/","summary":"Experimenting on a system by injecting failures to build confidence that it withstands them.","title":"Chaos engineering"},{"content":"A characterization test (also called a golden-master or snapshot test) runs the code on many inputs, saves the outputs to a file, and later fails if any output differs. It does not claim the behavior is right, only that it is unchanged.\n","permalink":"https://justroham.ir/glossary/characterization-test/","summary":"A test that records what code does today, bugs included, so you can change it safely.","title":"Characterization test"},{"content":"A statement that would violate it fails with an error, and inside a transaction that failure aborts the whole transaction.\n","permalink":"https://justroham.ir/glossary/check-constraint/","summary":"A rule on a table, such as balance_cents \u0026gt;= 0, that every written row must satisfy.","title":"CHECK constraint"},{"content":"The IPv4 header checksum is the one\u0026rsquo;s complement of the one\u0026rsquo;s complement sum of the header\u0026rsquo;s 16-bit words. Recomputing the sum over the whole header, checksum included, gives 0xFFFF when it is intact. It detects accidents, not attackers.\n","permalink":"https://justroham.ir/glossary/checksum/","summary":"A small number computed from data to detect accidental corruption.","title":"Checksum"},{"content":"The first time you add a module, Go compares its hash with the database and records it in go.sum. Later downloads must match go.sum.\n","permalink":"https://justroham.ir/glossary/checksum-database/","summary":"A public append-only log of module hashes (Go uses sum.golang.org) that detects a module changing between users.","title":"checksum database"},{"content":"git cherry-pick -x \u0026lt;hash\u0026gt; records the original hash in the message. The copy has the same patch-id as the original but a different hash. See also git revert.\n","permalink":"https://justroham.ir/glossary/cherry-pick/","summary":"Copies the patch of one commit onto the current branch as a new commit with a new hash.","title":"cherry-pick"},{"content":"The flow exists only as the sum of subscriptions, which makes it loosely coupled but hard to read. The opposite is orchestration.\n","permalink":"https://justroham.ir/glossary/choreography/","summary":"Services react to each other\u0026rsquo;s events with no central coordinator deciding the flow.","title":"Choreography"},{"content":"With Transfer-Encoding: chunked each piece is a hex size, CRLF, the data and CRLF. A chunk of size 0 ends the body.\n","permalink":"https://justroham.ir/glossary/chunked-encoding/","summary":"An HTTP/1.1 way to send a body in pieces without knowing its total length.","title":"Chunked encoding"},{"content":"Unlike local hooks, CI runs in a place the author cannot skip, so it is where rules you really depend on should be enforced.\n","permalink":"https://justroham.ir/glossary/ci/","summary":"Continuous integration: a server runs checks (build, tests, lint) on every push or pull request.","title":"CI"},{"content":"CIDR writes a network as an address plus the number of leading bits that identify the network, such as 192.0.2.0/24. It replaced fixed address classes and lets prefixes of any length be split or merged.\n","permalink":"https://justroham.ir/glossary/cidr/","summary":"Classless Inter-Domain Routing: writing a network as address/prefix-length, e.g. 192.0.2.0/24.","title":"CIDR"},{"content":"It is a small state machine: closed (calls pass), open (calls are rejected at once) and half-open (a few probe calls decide whether to close again). It protects the caller\u0026rsquo;s resources and gives the dependency room to recover.\n","permalink":"https://justroham.ir/glossary/circuit-breaker/","summary":"A wrapper that stops calling a failing dependency for a while and fails fast instead.","title":"Circuit breaker"},{"content":"Even with time synchronisation, machine clocks differ a little and sometimes a lot. Any rule that orders events by comparing timestamps from different machines inherits that error.\n","permalink":"https://justroham.ir/glossary/clock-skew/","summary":"The difference between the clocks of two machines at the same real moment.","title":"Clock skew"},{"content":"A function that remembers variables from the scope where it was defined, even after that scope has returned.\n","permalink":"https://justroham.ir/glossary/closure/","summary":"A function that remembers variables from the scope where it was defined, even after that scope has returned.","title":"Closure"},{"content":"Churn is a count of changes, for example how many commits touched each file. A file that is both changed often and complex is a hotspot. Churn alone says where people work, not that the code is bad.\n","permalink":"https://justroham.ir/glossary/code-churn/","summary":"How often a file or function changes over time; a cheap signal for where the work and the bugs gather.","title":"Code churn"},{"content":"It shows which parts of the code ran during the tests. High coverage means the code was executed, not that it was asserted well.\n","permalink":"https://justroham.ir/glossary/code-coverage/","summary":"The share of lines, branches and functions that ran while the tests ran.","title":"Code coverage"},{"content":"A reviewer reads the diff, asks questions and suggests changes; the author answers and updates the change. It finds design and clarity problems that tools cannot, and works best after the mechanical checks (static analysis, tests, formatting) have already passed.\n","permalink":"https://justroham.ir/glossary/code-review/","summary":"Another person reading a change before it is merged, to catch problems and share knowledge.","title":"Code review"},{"content":"On platforms that support it (GitHub, GitLab), a change touching a listed path automatically requests review from its owners. Combined with branch protection the review can be required.\n","permalink":"https://justroham.ir/glossary/codeowners/","summary":"A repository file that maps paths to the people or teams who must review changes to them.","title":"CODEOWNERS"},{"content":"It appears when a program builds a string and hands it to sh -c. The fix is to run the program directly with an argument list and no shell, so the input stays one argument.\n","permalink":"https://justroham.ir/glossary/command-injection/","summary":"A bug where user input becomes part of a shell command line and changes what runs.","title":"Command injection"},{"content":"Because a commit contains its parents\u0026rsquo; hashes, changing an old commit changes the hash of every later one.\n","permalink":"https://justroham.ir/glossary/commit/","summary":"The Git object that ties a tree to its parents, author, committer and message.","title":"commit"},{"content":"The original Node.js module system: require() loads a file synchronously and module.exports is what it hands back. Each CommonJS module is evaluated once and cached in require.cache.\n","permalink":"https://justroham.ir/glossary/commonjs/","summary":"the original Node.js module system: \u003ccode\u003erequire()\u003c/code\u003e loads a file synchronously and \u003ccode\u003emodule.exports\u003c/code\u003e is what it hands back.","title":"CommonJS"},{"content":"It does not roll back: the original step really happened and stays in history. A compensation must be idempotent and retryable, because it can be delivered twice or fail and be repeated.\n","permalink":"https://justroham.ir/glossary/compensating-transaction/","summary":"A new action that semantically undoes an earlier committed step, such as a refund for a charge.","title":"Compensating transaction"},{"content":"Order matters: (a, b) serves filters on a or on a and b, not efficiently on b alone. Put equality columns first and the range column last.\n","permalink":"https://justroham.ir/glossary/composite-index/","summary":"An index on several columns, sorted by the first, then the second, and so on.","title":"Composite index"},{"content":"The single place (usually main) where concrete parts are created and wired together. Everything else receives its dependencies as arguments, so tests can pass fakes. No DI framework is required.\n","permalink":"https://justroham.ir/glossary/composition-root/","summary":"The single place (usually \u003ccode\u003emain\u003c/code\u003e) where concrete parts are created and wired together.","title":"Composition root"},{"content":"The exports field of package.json, which maps import paths to files and can pick a different file for import and require. Paths not listed in exports cannot be imported from outside the package.\n","permalink":"https://justroham.ir/glossary/conditional-exports/","summary":"the \u003ccode\u003eexports\u003c/code\u003e field of \u003ccode\u003epackage.json\u003c/code\u003e, which maps import paths to files and can pick a different file for \u003ccode\u003eimport\u003c/code\u003e and \u003ccode\u003erequire\u003c/code\u003e.","title":"Conditional exports"},{"content":"A maximal group of vertices in an undirected graph where every vertex can reach every other. A BFS or DFS from one vertex finds exactly its component.\n","permalink":"https://justroham.ir/glossary/connected-component/","summary":"A maximal group of vertices in an undirected graph where every vertex can reach every other. A BFS or DFS from one vertex finds exactly its component.","title":"Connected component"},{"content":"Opening a database connection is slow and the server limits how many exist. A pool opens a few, lends one for each query or transaction, and takes it back on release. When all are busy, callers wait.\n","permalink":"https://justroham.ir/glossary/connection-pool/","summary":"A set of open database connections that are lent out and reused.","title":"Connection pool"},{"content":"It gives rules states such as new, established and related, and NAT depends on it.\n","permalink":"https://justroham.ir/glossary/connection-tracking/","summary":"The kernel table of flows that lets firewall rules match by connection state.","title":"Connection tracking"},{"content":"Raft and Paxos are consensus algorithms. They need a majority of nodes alive, which is why a cluster of 2f+1 nodes tolerates f failures.\n","permalink":"https://justroham.ir/glossary/consensus/","summary":"Getting a group of nodes to agree on one value (or one ordered log) even when some nodes crash or messages are lost.","title":"Consensus"},{"content":"Nodes are placed on a hash ring (usually many points each) and a key goes to the next point clockwise. Compared with hash % N, removing a node remaps only the keys that lived on it.\n","permalink":"https://justroham.ir/glossary/consistent-hashing/","summary":"A key-to-node mapping where removing a node moves only that node\u0026rsquo;s keys.","title":"Consistent hashing"},{"content":"A normal == may stop at the first different byte, which can leak information through timing. In Go use subtle.ConstantTimeCompare.\n","permalink":"https://justroham.ir/glossary/constant-time-comparison/","summary":"Comparing secrets in a way whose running time does not depend on where they first differ.","title":"Constant-time comparison"},{"content":"It lets the server team see which change would hurt which client. Pact is a well-known tool for this style; I only mention it here.\n","permalink":"https://justroham.ir/glossary/consumer-driven-contract/","summary":"A contract written by the clients, saying which parts of an API they really use, which the server then verifies.","title":"Consumer-driven contract"},{"content":"There is no container object in the kernel. A runtime combines namespaces, cgroups and a root filesystem, often following the OCI runtime specification.\n","permalink":"https://justroham.ir/glossary/container/","summary":"A normal Linux process (or group) started with its own namespaces and cgroup limits, usually from an image.","title":"Container"},{"content":"For example script-src 'self' blocks inline scripts. It limits the damage of an XSS bug but does not replace escaping.\n","permalink":"https://justroham.ir/glossary/content-security-policy/","summary":"A response header that tells the browser which sources of scripts and other content a page may use.","title":"Content Security Policy"},{"content":"context.Context is passed as the first argument of functions that may block or take long. Calling the cancel function, or hitting a timeout, closes ctx.Done() so every goroutine listening on it can stop and release resources.\nctx, cancel := context.WithTimeout(ctx, 2*time.Second) defer cancel() ","permalink":"https://justroham.ir/glossary/context/","summary":"A value carrying cancellation, deadlines and request-scoped data across API boundaries.","title":"Context"},{"content":"An object used with the with statement whose enter and exit methods run setup and guaranteed cleanup around a block.\n","permalink":"https://justroham.ir/glossary/context-manager/","summary":"An object used with the with statement whose \u003cstrong\u003eenter\u003c/strong\u003e and \u003cstrong\u003eexit\u003c/strong\u003e methods run setup and guaranteed cleanup around a block.","title":"Context manager"},{"content":"The test calls the handler and validates the response with the schema from the spec. When code and spec drift apart, the test fails.\n","permalink":"https://justroham.ir/glossary/contract-test/","summary":"A test that checks real requests or responses against the API contract, not against hand-written expectations.","title":"Contract test"},{"content":"Incidents rarely have one cause. Contributing factors are the missing validation, the missing alert and the slow dependency that had to line up. Listing them points at fixes in the system.\n","permalink":"https://justroham.ir/glossary/contributing-factor/","summary":"One of several conditions that together allowed an incident to happen.","title":"Contributing factor"},{"content":"Types such as feat, fix, docs and chore make history easy to scan and let tools build changelogs. Example: fix(api): handle empty body. It is a convention, enforced only if you add a commit-msg hook or a CI check.\n","permalink":"https://justroham.ir/glossary/conventional-commits/","summary":"A convention for commit subjects shaped like type(scope): summary.","title":"Conventional Commits"},{"content":"Melvin Conway observed in 1968 that organizations design systems that copy their own communication structure. Three teams tend to produce three modules. Used on purpose, it means shaping teams and service boundaries together.\n","permalink":"https://justroham.ir/glossary/conways-law/","summary":"A system\u0026rsquo;s design tends to mirror the communication structure of the organization that builds it.","title":"Conway's law"},{"content":"It suits programs that cannot reopen their log file, but according to the logrotate man page a few lines written between the copy and the truncate can be lost.\n","permalink":"https://justroham.ir/glossary/copytruncate/","summary":"A logrotate option that copies the log and truncates the original in place instead of renaming it.","title":"copytruncate"},{"content":"A function defined with async def; calling it returns a coroutine object that does nothing until it is awaited or wrapped in a task. A coroutine can pause at each await and let the event loop run something else, then resume where it stopped. Calling f() only creates the object; nothing runs yet.\n","permalink":"https://justroham.ir/glossary/coroutine/","summary":"A function defined with async def; calling it returns a coroutine object that does nothing until it is awaited or wrapped in a task.","title":"Coroutine"},{"content":"SELECT c.id, (SELECT count(*) FROM orders o WHERE o.customer_id = c.id) FROM customers c runs the inner query for every customer. It is fine with an index and few rows, and very costly otherwise. A JOIN with GROUP BY often lets the planner do the work in one pass.\n","permalink":"https://justroham.ir/glossary/correlated-subquery/","summary":"A subquery that refers to the outer row, so it runs once per outer row.","title":"Correlated subquery"},{"content":"It is enforced by the browser, not the server: the request still reaches the server. It controls reading, so it is not a CSRF defense.\n","permalink":"https://justroham.ir/glossary/cors/","summary":"Cross-Origin Resource Sharing: headers that tell a browser whether a page from another origin may read a response.","title":"CORS"},{"content":"The fuzzer instruments the program, and an input that executes a branch no earlier input reached is kept as \u0026ldquo;interesting\u0026rdquo; and mutated further. This steers the search deep into the parser instead of guessing blindly.\n","permalink":"https://justroham.ir/glossary/coverage-guided-fuzzing/","summary":"Fuzzing that keeps and mutates inputs which reach new code paths.","title":"Coverage-guided fuzzing"},{"content":"In PostgreSQL you add payload columns with INCLUDE; they are stored in the index but not used for sorting. It enables an Index Only Scan.\n","permalink":"https://justroham.ir/glossary/covering-index/","summary":"An index that contains every column a query needs, so the table is not read.","title":"Covering index"},{"content":"Reading main memory is slow, so the CPU keeps recent data in small caches and loads memory in cache lines. Scanning an array in order is cache-friendly; jumping around is not. Big-O ignores this, real timings do not.\n","permalink":"https://justroham.ir/glossary/cpu-cache/","summary":"Small, fast memory next to the CPU that holds recently used data; sequential access uses it far better than random access.","title":"CPU cache"},{"content":"Node.js writes one with node --cpu-prof as a .cpuprofile JSON file. Each sample points to a call stack; counting the samples whose top frame is a function gives its self time.\n","permalink":"https://justroham.ir/glossary/cpu-profile/","summary":"A sampled record of which functions the CPU was running, used to find where time goes.","title":"CPU profile"},{"content":"A CPU-bound task keeps a core busy the whole time. On a single-threaded event loop it blocks every other request; more cores or threads are the usual remedy.\n","permalink":"https://justroham.ir/glossary/cpu-bound/","summary":"Work whose speed is limited by the processor, such as computing primes, not by waiting for I/O.","title":"CPU-bound"},{"content":"The read side is usually a projection of the write side, so it can lag behind and is eventually consistent.\n","permalink":"https://justroham.ir/glossary/cqrs/","summary":"Command Query Responsibility Segregation: the model that handles writes is separate from the model that serves reads.","title":"CQRS"},{"content":"Examples: a grow-only set merged by union, a G-counter (one slot per node, merge by per-slot maximum, value is the sum).\n","permalink":"https://justroham.ir/glossary/crdt/","summary":"A conflict-free replicated data type: replicas update independently and a merge function that is commutative, associative and idempotent makes them converge.","title":"CRDT"},{"content":"It cannot run inside a transaction block. If it fails, the half-built index stays with indisvalid = false and must be dropped.\n","permalink":"https://justroham.ir/glossary/create-index-concurrently/","summary":"A way to build an index without blocking writes, at the cost of more passes and a possible INVALID index on failure.","title":"CREATE INDEX CONCURRENTLY"},{"content":"It shows in logs as many failed logins for many different users from one address in a short time. Rate limits and breached-password checks reduce it; detection rules tell you it is happening.\n","permalink":"https://justroham.ir/glossary/credential-stuffing/","summary":"Trying username and password pairs leaked elsewhere against your login, many users from one source.","title":"Credential stuffing"},{"content":"Tasks off the critical path can run in parallel with it, but nothing can finish sooner than the chain of tasks that must run one after another.\n","permalink":"https://justroham.ir/glossary/critical-path/","summary":"The longest chain of dependent tasks; it sets the minimum time even with unlimited workers.","title":"Critical path"},{"content":"A crontab line gives minute, hour, day of month, month and weekday, then a command. It is simple and everywhere, but it has no built-in dependency handling and no catch-up for runs missed while the machine was off.\n","permalink":"https://justroham.ir/glossary/cron/","summary":"The classic Unix scheduler that runs commands at times written in a five-field table.","title":"cron"},{"content":"The events stay, but the personal fields become unreadable. I only describe it in the post; I did not implement it.\n","permalink":"https://justroham.ir/glossary/crypto-shredding/","summary":"Deleting data from an immutable log by encrypting personal fields with a per-subject key and destroying the key.","title":"Crypto-shredding"},{"content":"It works because browsers attach cookies automatically. Defences: SameSite cookies and a per-session token that must be sent in a header or form field.\n","permalink":"https://justroham.ir/glossary/csrf/","summary":"Cross-site request forgery: another site makes the browser send an authenticated request you did not intend.","title":"CSRF"},{"content":"A common table expression (WITH name AS (\u0026hellip;)) lets you write a query in readable steps. It is mostly about clarity; it does not change the result.\n","permalink":"https://justroham.ir/glossary/cte/","summary":"A named subquery defined with WITH, usable in the main query.","title":"CTE"},{"content":"Each entry looks like CVE-YEAR-NUMBER and links to a description, affected versions and references. Severity is usually scored with CVSS from 0 to 10; 9.0 and above is critical. A CVE says a flaw exists, not whether you are exploitable, so always check your version and configuration.\n","permalink":"https://justroham.ir/glossary/cve/","summary":"Common Vulnerabilities and Exposures: a public identifier for a known security flaw.","title":"CVE"},{"content":"Tools such as gocyclo count one plus each if, for, non-default case and the operators \u0026amp;\u0026amp; and ||. A high number means many paths to test and understand. It is a hint about where to look, not a quality score.\n","permalink":"https://justroham.ir/glossary/cyclomatic-complexity/","summary":"A count of the independent decision paths through a function.","title":"Cyclomatic complexity"},{"content":"In Python, Thread(daemon=True) is stopped abruptly at interpreter exit, so its finally blocks and cleanup may never run. Use an Event to stop worker threads politely instead.\n","permalink":"https://justroham.ir/glossary/daemon-thread/","summary":"A thread that does not keep the program alive: when only daemon threads remain, the process exits.","title":"Daemon thread"},{"content":"Branches fork the graph and merge commits join it again, but following parents never loops back.\n","permalink":"https://justroham.ir/glossary/dag/","summary":"Directed acyclic graph: the shape of Git history, commits pointing to their parents.","title":"DAG"},{"content":"An index stores the values of one or more columns together with pointers to the table rows. Reads that match it get faster, but every insert, update and delete must also maintain it. The most common kind is the B-tree.\n","permalink":"https://justroham.ir/glossary/database-index/","summary":"A separate sorted structure that lets the database find rows without reading the whole table.","title":"Database index"},{"content":"A class decorated with @dataclass: Python generates init, repr and eq from the annotated fields, with options like frozen, order and slots.\n","permalink":"https://justroham.ir/glossary/dataclass/","summary":"A class decorated with @dataclass: Python generates \u003cstrong\u003einit\u003c/strong\u003e, \u003cstrong\u003erepr\u003c/strong\u003e and \u003cstrong\u003eeq\u003c/strong\u003e from the annotated fields, with options like frozen, order and slots.","title":"Dataclass"},{"content":"A self-contained packet of data sent without a connection; it arrives whole or not at all. UDP sends one datagram per send call, and the receiver gets it with the same boundaries. Compare a TCP stream, which has no boundaries.\n","permalink":"https://justroham.ir/glossary/datagram/","summary":"A self-contained packet of data sent without a connection; it arrives whole or not at all.","title":"Datagram"},{"content":"A scheduled job pings a monitor after each successful run; the monitor alerts if no ping arrives within the expected window. It catches jobs that silently never started, which log-based alerts cannot see.\n","permalink":"https://justroham.ir/glossary/dead-mans-switch/","summary":"An alert that fires when an expected signal does NOT arrive.","title":"Dead man's switch"},{"content":"Updates and deletes create dead tuples. While an old transaction could still see a version, it is dead but not yet removable.\n","permalink":"https://justroham.ir/glossary/dead-tuple/","summary":"A row version that no current or future transaction can see any more, but that still occupies space until VACUUM removes it.","title":"Dead tuple"},{"content":"After a bounded number of retries (usually with backoff), a poison message is republished to a DLQ stream together with its error context. Engineers can inspect and replay it later without losing data or stalling healthy messages.\n","permalink":"https://justroham.ir/glossary/dlq/","summary":"A place where messages that keep failing are moved so they do not block the main flow.","title":"Dead-letter queue"},{"content":"In Go, SetReadDeadline sets a time (not a duration) on a connection; a Read that is still blocked then returns an i/o timeout error. You must set it again before each read if you want an idle timeout. See context for cancellation in general.\n","permalink":"https://justroham.ir/glossary/deadline/","summary":"An absolute point in time after which a network read or write fails with a timeout.","title":"Deadline"},{"content":"Session A holds row 1 and wants row 2, session B holds row 2 and wants row 1. PostgreSQL notices the cycle after deadlock_timeout and cancels one transaction with SQLSTATE 40P01. The usual cure is to take locks in the same order everywhere.\n","permalink":"https://justroham.ir/glossary/deadlock/","summary":"Two or more sessions each wait for a lock the other holds, so none can continue; the database aborts one of them.","title":"Deadlock"},{"content":"A function that takes a function and returns a wrapped version of it, applied with @name.\n","permalink":"https://justroham.ir/glossary/decorator/","summary":"A function that takes a function and returns a wrapped version of it, applied with @name.","title":"Decorator"},{"content":"A partition that receives rows that match no other partition of the table. It avoids insert errors, but creating a new partition then has to scan the default one to prove no row belongs to the new range. See partitioning.\n","permalink":"https://justroham.ir/glossary/default-partition/","summary":"A partition that receives rows that match no other partition of the table.","title":"Default partition"},{"content":"Instead of storing a full copy, Git can store an object as instructions (a delta) on top of a similar base object. Deltas can chain: git verify-pack -v shows the chain depth. It is the main reason a packfile is much smaller than loose objects.\n","permalink":"https://justroham.ir/glossary/delta-compression/","summary":"Storing an object as a small difference against a similar base object.","title":"Delta compression"},{"content":"Typical defences are limits (body size, rate, concurrency) and timeouts, so no single client can hold a resource for free.\n","permalink":"https://justroham.ir/glossary/denial-of-service/","summary":"An attack or accident that makes a service unavailable by exhausting a resource such as memory, connections or CPU.","title":"Denial of service"},{"content":"Denormalization means deliberately keeping a copy of data in more than one place, for example a stored order total, to avoid expensive joins or aggregates. The price is that you must keep the copies in sync. It is a decision you make after normalizing, not instead of it.\n","permalink":"https://justroham.ir/glossary/denormalization/","summary":"Deliberately storing a fact more than once to make reads cheaper.","title":"Denormalization"},{"content":"Instead of remembering to protect each new route, every route requires authentication and a permission unless it is explicitly listed as public. Forgetting then fails closed, not open.\n","permalink":"https://justroham.ir/glossary/deny-by-default/","summary":"A route or action is forbidden until a rule explicitly allows it.","title":"Deny by default"},{"content":"Instead of calling Date.now() or opening a database connection itself, the function takes it as a parameter. A test passes a fake one and gets a deterministic result.\n","permalink":"https://justroham.ir/glossary/dependency-injection/","summary":"Passing dependencies (like time or a database) in from outside instead of creating them inside the function.","title":"Dependency injection"},{"content":"Visiting a graph by going as deep as possible along one path before backing up, using recursion or a stack.\n","permalink":"https://justroham.ir/glossary/dfs/","summary":"Visiting a graph by going as deep as possible along one path before backing up, using recursion or a stack.","title":"Depth-first search"},{"content":"A double-ended queue: push and pop at both the front and the back, all in O(1) amortized. A ring buffer with growth implements it well.\n","permalink":"https://justroham.ir/glossary/deque/","summary":"A double-ended queue: push and pop at both the front and the back, all in O(1) amortized. A ring buffer with growth implements it well.","title":"Deque"},{"content":"New commits made here are not on any branch, so they are easy to lose when you switch away. A submodule checkout is always detached at first.\n","permalink":"https://justroham.ir/glossary/detached-head/","summary":"The state where HEAD points straight at a commit instead of a branch name.","title":"Detached HEAD"},{"content":"Time, network and faults all come from one seeded random source, so the same seed gives the same run. A flaky failure becomes a seed you can re-run.\n","permalink":"https://justroham.ir/glossary/deterministic-simulation/","summary":"Running a system in a simulated world driven by a seed so any failure can be replayed exactly.","title":"Deterministic simulation"},{"content":"Used with a fuzzer, it needs no expected output: if your parser and a trusted one disagree on an input, one of them has a bug.\n","permalink":"https://justroham.ir/glossary/differential-testing/","summary":"Running two implementations on the same input and flagging any difference.","title":"Differential testing"},{"content":"Ed25519 signatures are 64 bytes. Changing one byte of the message makes verification fail.\n","permalink":"https://justroham.ir/glossary/digital-signature/","summary":"A value computed with a private key that anyone with the public key can verify, proving origin and integrity.","title":"Digital signature"},{"content":"Shortest paths from one source in a graph with non-negative weights, always expanding the closest unfinished vertex.\nIt keeps a tentative distance per vertex and a priority queue. Once a vertex is popped its distance is final, which is why negative weights break it.\n","permalink":"https://justroham.ir/glossary/dijkstra/","summary":"Shortest paths from one source in a graph with non-negative weights, always expanding the closest unfinished vertex.","title":"Dijkstra's algorithm"},{"content":"A distributed monolith has the costs of microservices without the benefits. Typical symptoms: deploys in lockstep, a shared database, and chatty calls where one request fans out into many. It usually means the boundaries were drawn before they were understood.\n","permalink":"https://justroham.ir/glossary/distributed-monolith/","summary":"Services split over the network that still have to change, deploy and fail together.","title":"Distributed monolith"},{"content":"DNS is a distributed, hierarchical database: the root delegates to top-level domains, which delegate to each domain\u0026rsquo;s own name servers. Clients ask it for records (A, AAAA, MX, TXT\u0026hellip;) by name.\n","permalink":"https://justroham.ir/glossary/dns/","summary":"The system that maps names to records such as IP addresses.","title":"DNS"},{"content":"If code validates the answer of one DNS lookup and then connects by name, a second lookup can return another address. The defense is to resolve once and connect to the validated IP. See TOCTOU.\n","permalink":"https://justroham.ir/glossary/dns-rebinding/","summary":"A name that resolves to a harmless address for the check and to an internal one for the connection.","title":"DNS rebinding"},{"content":"The aggregate collects events while it changes; the application service publishes them only after the save succeeds (see the outbox pattern for doing that reliably).\n","permalink":"https://justroham.ir/glossary/domain-event/","summary":"A fact that happened in the domain, named in the past tense, such as OrderPlaced.","title":"Domain event"},{"content":"DDD has a strategic part (bounded contexts, shared language) and a tactical part (value objects, aggregates, events). Eric Evans\u0026rsquo; book \u0026ldquo;Domain-Driven Design\u0026rdquo; introduced the name.\n","permalink":"https://justroham.ir/glossary/domain-driven-design/","summary":"An approach that shapes the code around the business domain, using its language, boundaries and rules.","title":"Domain-driven design"},{"content":"During a migration the new code writes both the old column and the new one, so old and new versions can read the same rows. Dual writing to two different systems is a different, riskier thing because there is no shared transaction.\n","permalink":"https://justroham.ir/glossary/dual-write/","summary":"writing the old and new form of data at once.","title":"Dual write"},{"content":"Using an object because it has the methods you call, not because of its declared class: if it has speak(), you can call speak().\n","permalink":"https://justroham.ir/glossary/duck-typing/","summary":"Using an object because it has the methods you call, not because of its declared class: if it has speak(), you can call speak().","title":"Duck typing"},{"content":"A special method with double underscores around its name, like repr or eq, that Python calls for you when you use syntax such as print(), == or len().\n","permalink":"https://justroham.ir/glossary/dunder-method/","summary":"A special method with double underscores around its name, like \u003cstrong\u003erepr\u003c/strong\u003e or \u003cstrong\u003eeq\u003c/strong\u003e, that Python calls for you when you use syntax such as print(), == or len().","title":"Dunder method"},{"content":"Because the server remembers which messages were acknowledged, a durable consumer resumes exactly where it stopped. Several instances can share the same durable name to split the work, which is how consumers scale horizontally.\n","permalink":"https://justroham.ir/glossary/durable-consumer/","summary":"A named JetStream consumer whose position survives restarts and reconnects.","title":"Durable consumer"},{"content":"A growable array: elements sit in one contiguous block, and when it is full the structure allocates a bigger block and copies everything over. Go slices and Rust Vec work this way.\n","permalink":"https://justroham.ir/glossary/dynamic-array/","summary":"A growable array: elements sit in one contiguous block, and when it is full the structure allocates a bigger block and copies everything over. Go slices and Rust Vec work this way.","title":"Dynamic array"},{"content":"Solving a problem by combining answers to smaller subproblems, each solved once and stored.\nA problem fits when it has optimal substructure and overlapping subproblems. You define a state, a transition, base cases and an order, then fill a table or memoize a recursion.\n","permalink":"https://justroham.ir/glossary/dynamic-programming/","summary":"Solving a problem by combining answers to smaller subproblems, each solved once and stored.","title":"Dynamic programming"},{"content":"ECB (electronic codebook) leaks the structure of the data: 64 bytes of A gave four identical blocks. Do not use it; use an AEAD mode.\n","permalink":"https://justroham.ir/glossary/ecb-mode/","summary":"A block cipher mode that encrypts every block independently, so equal plaintext blocks give equal ciphertext blocks.","title":"ECB mode"},{"content":"kitten to sitting needs 3 edits. It is computed with dynamic programming over prefixes.\n","permalink":"https://justroham.ir/glossary/edit-distance/","summary":"The minimum number of insertions, deletions and substitutions needed to turn one sequence into another (Levenshtein).","title":"Edit distance"},{"content":"Done with uv pip install -e . (or pip install -e .). Imported modules then resolve to the files under your src/ directory.\n","permalink":"https://justroham.ir/glossary/editable-install/","summary":"Installing a project so the environment points at your working copy instead of a copied snapshot, so edits apply immediately.","title":"editable install"},{"content":"An HTTP request becomes the payload of a TCP segment, which becomes the payload of an IP packet, which becomes the payload of a link-layer frame. The receiver removes the headers in reverse order.\n","permalink":"https://justroham.ir/glossary/encapsulation/","summary":"Wrapping the data of one layer inside the header of the layer below.","title":"Encapsulation"},{"content":"[project.scripts] with greeter = \u0026quot;greeter:main\u0026quot; makes the installer create a greeter command that calls greeter.main().\n","permalink":"https://justroham.ir/glossary/entry-point/","summary":"A named hook in a package\u0026rsquo;s metadata; console_scripts entry points become commands on PATH when the package is installed.","title":"entry point"},{"content":"Each record gets its own data key (DEK), stored wrapped by a key-encryption key (KEK) together with the KEK id. Rotating the KEK only rewraps the small DEKs, not the data.\n","permalink":"https://justroham.ir/glossary/envelope-encryption/","summary":"Encrypting data with a random per-record key that is itself encrypted by a master key.","title":"Envelope encryption"},{"content":"A named string a process inherits from its parent, used to pass configuration such as ports and keys. In Node.js they appear in process.env. Every value is a string, so numbers and booleans must be parsed and validated.\n","permalink":"https://justroham.ir/glossary/environment-variable/","summary":"A named string a process inherits from its parent, used to pass configuration such as ports and keys.","title":"Environment variable"},{"content":"According to epoll(7), you create an epoll instance, register file descriptors with epoll_ctl, and wait with epoll_wait, which returns only the descriptors that are ready. It is Linux-only; macOS and the BSDs have kqueue.\n","permalink":"https://justroham.ir/glossary/epoll/","summary":"The Linux system call family that lets one thread wait efficiently for readiness on thousands of file descriptors.","title":"epoll"},{"content":"errgroup.WithContext returns a group and a derived context. g.Go(fn) starts a goroutine; g.Wait() blocks until all finish and returns the first non-nil error. g.SetLimit(n) bounds concurrency without writing a worker pool by hand.\n","permalink":"https://justroham.ir/glossary/errgroup/","summary":"A \u003ccode\u003egolang.org/x/sync\u003c/code\u003e helper that runs goroutines together and cancels the rest on the first error.","title":"errgroup"},{"content":"errno is the error number a failed system call leaves behind; strace prints its symbol, for example -1 ENOENT (No such file or directory). Reading the symbol usually tells you what to check next.\n","permalink":"https://justroham.ir/glossary/errno/","summary":"The error code a failed system call reports, such as ENOENT or EACCES.","title":"errno"},{"content":"With a 99.5% SLO, 0.5% of requests may fail in the window. An incident burns part of the budget; burning it all is a signal to slow risky changes.\n","permalink":"https://justroham.ir/glossary/error-budget/","summary":"The amount of failure an SLO allows in a window; spending it is how reliability is traded against change.","title":"Error budget"},{"content":"The standard JavaScript module system (import/export), loaded asynchronously and analysed statically before any code runs. In Node.js a file is treated as ESM if it ends in .mjs, or ends in .js and the nearest package.json has \u0026quot;type\u0026quot;: \u0026quot;module\u0026quot;.\n","permalink":"https://justroham.ir/glossary/esm/","summary":"the standard JavaScript module system (\u003ccode\u003eimport\u003c/code\u003e/\u003ccode\u003eexport\u003c/code\u003e), loaded asynchronously and analysed statically before any code runs.","title":"ESM"},{"content":"CloudEvents is a published specification for such an envelope. A consumer can route, deduplicate and trace an event by reading only the envelope.\n","permalink":"https://justroham.ir/glossary/event-envelope/","summary":"A fixed wrapper around every event with metadata (id, type, time, source, schema version, correlation id) separate from the payload.","title":"Event envelope"},{"content":"The event loop repeatedly goes through phases (timers, poll, check, close) and runs the callbacks that are ready. Your JavaScript runs on one thread, so a long synchronous task delays everything else.\n","permalink":"https://justroham.ir/glossary/event-loop/","summary":"The loop that lets single-threaded JavaScript handle many waiting operations by running callbacks when they are ready.","title":"Event loop"},{"content":"An account is not a row with a balance but the events Opened, Deposited, Withdrawn. Commands check rules against the folded state and emit new events; nothing is edited in place.\n","permalink":"https://justroham.ir/glossary/event-sourcing/","summary":"State is not stored; the append-only list of events that led to it is, and current state is a fold of them.","title":"Event sourcing"},{"content":"Most Node.js I/O objects (servers, streams) are EventEmitters. The special event name error is different: emitting it with no listener throws the error and can crash the process.\n","permalink":"https://justroham.ir/glossary/event-emitter/","summary":"Node\u0026rsquo;s built-in publish/subscribe object: emit named events, listeners react.","title":"EventEmitter"},{"content":"The weakest useful promise. It says nothing about how long convergence takes or what a read returns in the meantime.\n","permalink":"https://justroham.ir/glossary/eventual-consistency/","summary":"If writes stop, all replicas end up with the same value; before that, reads may be stale or out of order.","title":"Eventual consistency"},{"content":"Linking a new exception to the one being handled: raise \u0026hellip; from e sets cause, raising inside except sets context.\n","permalink":"https://justroham.ir/glossary/exception-chaining/","summary":"Linking a new exception to the one being handled: raise \u0026hellip; from e sets \u003cstrong\u003ecause\u003c/strong\u003e, raising inside except sets \u003cstrong\u003econtext\u003c/strong\u003e.","title":"Exception chaining"},{"content":"An exception that bundles several exceptions; except* handles each matching type on its own slice of the group.\n","permalink":"https://justroham.ir/glossary/exception-group/","summary":"An exception that bundles several exceptions; except* handles each matching type on its own slice of the group.","title":"ExceptionGroup"},{"content":"The number a command returns when it ends; 0 means success and anything else means failure. The shell exposes it as $? and uses it in \u0026amp;\u0026amp;, || and if.\n","permalink":"https://justroham.ir/glossary/exit-status/","summary":"The number a command returns when it ends; 0 means success and anything else means failure. The shell exposes it as \u003ccode\u003e$?\u003c/code\u003e and uses it in \u003ccode\u003e\u0026amp;\u0026amp;\u003c/code\u003e, \u003ccode\u003e||\u003c/code\u003e and \u003ccode\u003eif\u003c/code\u003e.","title":"Exit status"},{"content":"Every step is compatible with the code that is running at that moment, so no step needs downtime and each one can be rolled back until the last (the drop).\n","permalink":"https://justroham.ir/glossary/expand-contract/","summary":"A migration recipe in small safe steps: add the new shape, copy data, switch the app, drop the old shape.","title":"Expand/contract"},{"content":"After attempt n the client waits roughly min(cap, base * 2^n). It gives an overloaded server room to recover, but clients that fail together still retry together unless jitter is added.\n","permalink":"https://justroham.ir/glossary/exponential-backoff/","summary":"Waiting longer after each failed attempt, doubling the delay up to a cap.","title":"Exponential backoff"},{"content":"The query must use the same expression to benefit. It fixes non-sargable conditions without rewriting data.\n","permalink":"https://justroham.ir/glossary/expression-index/","summary":"An index built on the result of an expression such as lower(email) instead of a plain column.","title":"Expression index"},{"content":"By default the planner treats columns as independent. Extended statistics such as dependencies teach it that, for example, a country determines a region.\n","permalink":"https://justroham.ir/glossary/extended-statistics/","summary":"Multi-column statistics created with \u003ccode\u003eCREATE STATISTICS\u003c/code\u003e.","title":"Extended statistics"},{"content":"The opposite is fail closed, which rejects. Choose per endpoint: availability usually wins for cheap reads, safety for login or costly work.\n","permalink":"https://justroham.ir/glossary/fail-open/","summary":"Letting requests through when a protective component, such as the limiter store, is unavailable.","title":"Fail open"},{"content":"Core PostgreSQL only gives you the promote command; detecting the failure, choosing a standby and fencing the old primary is done by external tools such as Patroni or repmgr.\n","permalink":"https://justroham.ir/glossary/failover/","summary":"Switching to a standby as the new primary when the old one fails.","title":"Failover"},{"content":"In an asynchronous network it cannot be exact. A short timeout detects real crashes quickly but suspects healthy nodes; a long timeout does the opposite.\n","permalink":"https://justroham.ir/glossary/failure-detector/","summary":"A component that guesses whether a remote node is down, usually from missing heartbeats within a timeout.","title":"Failure detector"},{"content":"The height of a tree with n keys is about log base fan-out of n. A B-tree page holds hundreds of keys, so millions of rows need only a few levels.\n","permalink":"https://justroham.ir/glossary/fan-out/","summary":"The number of children a tree node can have; a larger fan-out makes the tree shallower.","title":"Fan-out"},{"content":"If the branch you merge into has no commits of its own since the split, Git just moves its pointer forward. Nothing new is created. --ff-only makes Git refuse anything else, and --no-ff forces a merge commit even when a fast-forward is possible.\n","permalink":"https://justroham.ir/glossary/fast-forward/","summary":"moving a branch pointer ahead along a straight line of commits, with no new commit.","title":"fast-forward"},{"content":"Faults can be injected by a proxy between client and server, by a wrapper around the HTTP client in a unit test, or by killing processes. The goal is to find missing timeouts, unsafe retries and wrong assumptions before production does.\n","permalink":"https://justroham.ir/glossary/fault-injection/","summary":"Deliberately causing latency, errors or crashes in a dependency to see how the system reacts.","title":"Fault injection"},{"content":"A feature flag (or toggle) is a condition in the code whose value comes from configuration, not from the build. It lets you merge unfinished work, release gradually, and switch a feature off quickly. The cost is more code paths to test and flags to remove later.\n","permalink":"https://justroham.ir/glossary/feature-flag/","summary":"a runtime switch that turns code paths on or off without a deploy.","title":"Feature flag"},{"content":"Go reaches Rust through cgo and a C-compatible boundary; Rust exposes extern \u0026quot;C\u0026quot; functions with #[no_mangle]. Crossing the boundary costs time and requires care with memory: whoever allocates a buffer must be the one to free it.\n","permalink":"https://justroham.ir/glossary/ffi/","summary":"Foreign Function Interface: calling code written in another language, usually through the C ABI.","title":"FFI"},{"content":"A small integer a process uses to refer to an open file, pipe or socket. 0, 1 and 2 are stdin, stdout and stderr; shell redirects rewire them.\n","permalink":"https://justroham.ir/glossary/file-descriptor/","summary":"A small integer a process uses to refer to an open file, pipe or socket. 0, 1 and 2 are stdin, stdout and stderr; shell redirects rewire them.","title":"File descriptor"},{"content":"Nine bits (read, write, execute for user, group and other) stored in the inode. Octal modes such as 755 or 640 write them compactly.\n","permalink":"https://justroham.ir/glossary/file-permissions/","summary":"Nine bits (read, write, execute for user, group and other) stored in the inode. Octal modes such as 755 or 640 write them compactly.","title":"File permissions"},{"content":"Fisher\u0026rsquo;s exact test computes the exact probability of seeing a split of errors at least this lopsided between two groups, from the hypergeometric distribution. Unlike a z-test it stays valid when counts are tiny.\n","permalink":"https://justroham.ir/glossary/fisher-exact-test/","summary":"an exact significance test for a 2x2 table of counts.","title":"Fisher exact test"},{"content":"Each answer to why becomes the next question. It is simple, but it follows one chain, depends on who answers, and tends to stop at a person or a vague cause.\n","permalink":"https://justroham.ir/glossary/five-whys/","summary":"A technique of asking why repeatedly to find a cause; it follows a single chain.","title":"Five whys"},{"content":"A fixture in pytest is a function marked with @pytest.fixture. A test asks for it by naming it as a parameter, and pytest runs it first and passes in the result. With yield, the code after the yield runs as teardown. Its scope (function, module, session) controls how often it is rebuilt.\n","permalink":"https://justroham.ir/glossary/fixture/","summary":"a function that prepares (and cleans up) what a test needs","title":"Fixture"},{"content":"git commit --fixup \u0026lt;commit\u0026gt; creates a commit titled fixup! \u0026lt;subject\u0026gt;. Later git rebase -i --autosquash moves it next to its target and squashes it, so a small correction never becomes its own entry in history.\n","permalink":"https://justroham.ir/glossary/fixup-commit/","summary":"A commit marked to be folded into an earlier commit during an autosquash rebase.","title":"Fixup commit"},{"content":"The usual causes are real time, randomness, shared state, and timing between goroutines. Flaky tests teach people to ignore red builds, so they are worth fixing early, for example by injecting a clock.\n","permalink":"https://justroham.ir/glossary/flaky-test/","summary":"A test that sometimes passes and sometimes fails with no change in the code.","title":"Flaky test"},{"content":"A flame graph stacks sampled call stacks: the x axis is not time, and a wide box means that function (with its callees) was in many samples. Brendan Gregg\u0026rsquo;s FlameGraph scripts draw them from perf output.\n","permalink":"https://justroham.ir/glossary/flame-graph/","summary":"A picture of sampled stacks where box width shows how often a function was on the stack.","title":"Flame graph"},{"content":"git push --force makes the remote branch point where yours does. After a rebase it is needed, but it can throw away teammates\u0026rsquo; commits. --force-with-lease refuses if the remote moved since you last fetched.\n","permalink":"https://justroham.ir/glossary/force-push/","summary":"overwrites a remote branch with your local one, even if that discards commits; prefer \u0026ndash;force-with-lease.","title":"force push"},{"content":"A foreign key makes the database refuse rows that point at something that does not exist, and refuse deleting a row that is still referenced (SQLSTATE 23503).\n","permalink":"https://justroham.ir/glossary/foreign-key/","summary":"A column that must match a primary key value in another table.","title":"Foreign key"},{"content":"In a free-threaded build (python3.14t) Python threads can run on several cores at once. Code that relied on the GIL to hide races, such as counter += 1, can then lose updates. See GIL.\n","permalink":"https://justroham.ir/glossary/free-threading/","summary":"A CPython build, available since 3.13 as an option, that runs without the GIL.","title":"Free-threaded Python"},{"content":"A fuzzer starts from seed inputs, mutates them and keeps those that reach new code. Go has it built in: go test -fuzz FuzzName -fuzztime 5s. It is related to property-based testing but runs until stopped.\n","permalink":"https://justroham.ir/glossary/fuzzing/","summary":"Feeding a program automatically mutated inputs, guided by coverage, to find crashes and bugs.","title":"Fuzzing"},{"content":"It needs a runbook, named roles, abort conditions and a communication plan agreed beforehand.\n","permalink":"https://justroham.ir/glossary/game-day/","summary":"A planned session where a team injects failures and practises detecting and handling them.","title":"Game day"},{"content":"V8 runs short scavenges for young objects and slower mark-compact passes for the old generation; --trace-gc prints each one.\n","permalink":"https://justroham.ir/glossary/garbage-collector/","summary":"The runtime part that frees objects nothing can reach any more.","title":"Garbage collector"},{"content":"In PostgreSQL, GENERATED ALWAYS AS (expr) STORED recomputes the value on every insert and update, and you cannot write to it directly. A common use is a precomputed tsvector that you can index.\n","permalink":"https://justroham.ir/glossary/generated-column/","summary":"A column whose value is computed from other columns of the same row by an expression, and stored automatically.","title":"Generated column"},{"content":"A function that uses yield to produce values one at a time, pausing between them.\n","permalink":"https://justroham.ir/glossary/generator/","summary":"A function that uses yield to produce values one at a time, pausing between them.","title":"Generator"},{"content":"Code written once for any type, with the type as a parameter, for example def first[T](xs: list[T]) -\u0026gt; T. The checker keeps track of which T is used at each call.\n","permalink":"https://justroham.ir/glossary/generics/","summary":"Code written once for any type, with the type as a parameter, for example def first[T](xs: list[T]) -\u0026gt; T. The checker keeps track of which T is used at each call.","title":"Generics"},{"content":"The Global Interpreter Lock protects the interpreter\u0026rsquo;s internal state. Threads still help with I/O waits because the lock is released while they block, but CPU-bound Python code in threads does not run in parallel. See free-threading.\n","permalink":"https://justroham.ir/glossary/gil/","summary":"A lock in standard CPython that lets only one thread run Python bytecode at a time.","title":"GIL"},{"content":"GIN (Generalized Inverted Index) suits values that contain many parts, such as JSONB documents, arrays and text search vectors. A lookup finds the rows for each part and combines them; writes are more expensive than with a B-tree.\n","permalink":"https://justroham.ir/glossary/gin-index/","summary":"An inverted index in PostgreSQL that maps each element inside a value (a JSON key, a word) to the rows that contain it.","title":"GIN index"},{"content":"git bisect takes one known-good and one known-bad commit and checks out the commit in the middle, asking you (or a script) whether it is good or bad. Each answer halves the range, so about log2(N) tests find the culprit. See binary search and regression.\n","permalink":"https://justroham.ir/glossary/git-bisect/","summary":"A Git command that binary-searches your history to find the first commit that introduced a bug.","title":"git bisect"},{"content":"Hooks are executable files named after the event (pre-commit, commit-msg, pre-push). If one exits non-zero, Git aborts the operation. They live in .git/hooks by default, which is not versioned, or in the directory set by core.hooksPath. --no-verify skips them, so they are a guard rail, not security.\n","permalink":"https://justroham.ir/glossary/git-hook/","summary":"A script Git runs automatically at a point in its workflow, such as before a commit.","title":"Git hook"},{"content":"Everything Git stores is an object, named by the hash of its content and kept zlib-compressed as a loose file. Objects are never modified, only added.\n","permalink":"https://justroham.ir/glossary/git-object/","summary":"A blob, tree, commit or tag stored under its hash in .git/objects.","title":"Git object"},{"content":"--soft keeps the index and files, --mixed (default) resets the index but keeps files, --hard resets both, so uncommitted edits are lost. Use reflog to find the old position.\n","permalink":"https://justroham.ir/glossary/git-reset/","summary":"Moves the current branch to another commit; the mode decides what happens to the index and working tree.","title":"git reset"},{"content":"Safe on shared branches because it never rewrites history. Reverting a merge commit needs -m 1 to choose the mainline parent. Compare with reflog and reset.\n","permalink":"https://justroham.ir/glossary/git-revert/","summary":"Undoes a commit by adding a new commit with the opposite patch, leaving history intact.","title":"git revert"},{"content":"git ls-tree HEAD shows it as 160000 commit \u0026lt;sha\u0026gt; \u0026lt;path\u0026gt;. This is how a submodule is stored inside the parent repo.\n","permalink":"https://justroham.ir/glossary/gitlink/","summary":"A tree entry (mode 160000) that records a commit id from another repository.","title":"Gitlink"},{"content":"A go.work file lists directories with use. While it is active, the go command builds the listed modules together and prefers the local copies over versions from a registry. It is meant for local development across modules, such as in a monorepo.\n","permalink":"https://justroham.ir/glossary/go-workspace/","summary":"A go.work file that makes several local Go modules resolve to each other without published versions.","title":"Go workspace (go.work)"},{"content":"A GOAWAY frame carries the id of the last stream the sender will process. Streams up to that id may finish; later ones must be retried on another connection. It is how an HTTP/2 or gRPC server drains a connection before closing it.\n","permalink":"https://justroham.ir/glossary/goaway/","summary":"An HTTP/2 frame that tells the peer to stop opening new streams on this connection.","title":"GOAWAY"},{"content":"A goroutine is started with the go keyword. It begins with a small stack (a few KB) that grows on demand, so programs can run hundreds of thousands of them. The Go scheduler multiplexes goroutines onto a smaller number of OS threads.\ngo func() { fmt.Println(\u0026#34;runs concurrently\u0026#34;) }() Goroutines do not return values directly; use a channel or shared state guarded by a mutex to communicate.\n","permalink":"https://justroham.ir/glossary/goroutine/","summary":"A lightweight function execution managed by the Go runtime, not the OS.","title":"Goroutine"},{"content":"On a stop signal such as SIGTERM the process stops accepting new connections, closes idle ones, waits for requests already running, and only then exits with code 0. A timer usually forces exit if something never finishes.\n","permalink":"https://justroham.ir/glossary/graceful-shutdown/","summary":"Stopping a server by refusing new work but letting in-flight requests finish before exiting.","title":"Graceful shutdown"},{"content":"A set of vertices (nodes) connected by edges. Edges can be directed or undirected. Networks, maps, dependencies and friendships are all graphs.\n","permalink":"https://justroham.ir/glossary/graph/","summary":"A set of vertices (nodes) connected by edges. Edges can be directed or undirected. Networks, maps, dependencies and friendships are all graphs.","title":"Graph"},{"content":"Health checks and heartbeats may pass while real requests time out. In my experience this is harder to handle than a clean crash.\n","permalink":"https://justroham.ir/glossary/gray-failure/","summary":"A node that is not dead but so slow or flaky that it harms the system while still looking alive.","title":"Gray failure"},{"content":"A greedy algorithm builds an answer by always taking the choice that looks best right now. It is fast, but it is only correct when the problem has the right structure; an exchange argument is the usual way to prove it.\n","permalink":"https://justroham.ir/glossary/greedy-algorithm/","summary":"Making the locally best choice at each step and never revisiting it.","title":"Greedy algorithm"},{"content":"Services and messages are described in .proto files, from which client and server code is generated in many languages, which makes it a good fit for Go↔Rust communication. It supports unary calls and client, server and bidirectional streaming.\n","permalink":"https://justroham.ir/glossary/grpc/","summary":"A binary RPC framework built on HTTP/2 and Protocol Buffers.","title":"gRPC"},{"content":"A TCP connection has two independent directions. A half-close (shutdown(SHUT_WR), CloseWrite in Go) tells the peer \u0026ldquo;I am done sending\u0026rdquo; (it sees EOF) while you can still read its answer.\n","permalink":"https://justroham.ir/glossary/half-close/","summary":"Closing only the sending direction of a TCP connection while still reading.","title":"Half-close"},{"content":"If a happens before b, a could have influenced b. If neither precedes the other, the events are concurrent and no clock can order them truthfully.\n","permalink":"https://justroham.ir/glossary/happens-before/","summary":"The partial order of causality: program order, send before receive, and transitivity; events with no such path are concurrent.","title":"Happens-before"},{"content":"A second name for the same inode. Both names are equal, the link count goes up, and the data is freed only when the last name is removed.\n","permalink":"https://justroham.ir/glossary/hard-link/","summary":"A second name for the same inode. Both names are equal, the link count goes up, and the data is freed only when the last name is removed.","title":"Hard link"},{"content":"A hash chain makes a log tamper-evident, not tamper-proof: someone who can rewrite the whole file can recompute the chain. Signed checkpoints stored elsewhere close that gap.\n","permalink":"https://justroham.ir/glossary/hash-chain/","summary":"Each record stores the hash of the previous one, so any edit, deletion or reorder breaks every later link.","title":"Hash chain"},{"content":"Collisions are unavoidable, so every hash table needs a strategy: chaining keeps a list per slot, open addressing looks for another slot.\n","permalink":"https://justroham.ir/glossary/hash-collision/","summary":"Two different keys that map to the same slot of a hash table.","title":"Hash collision"},{"content":"A key maps to slot = hash(key) mod S with S fixed, and a table maps slots to nodes. Adding a node moves some slots, so the key-to-slot mapping never changes. According to its docs Redis Cluster uses 16384 slots.\n","permalink":"https://justroham.ir/glossary/hash-slot/","summary":"One of a fixed number of logical buckets that keys hash into; whole slots, not single keys, are assigned to and moved between nodes.","title":"Hash slot"},{"content":"The key is hashed to pick a bucket, so a lookup does not scan all items. The cost is a fixed hashing step on every access, which is why a tiny slice can be faster than a map. See Big-O.\n","permalink":"https://justroham.ir/glossary/hash-table/","summary":"A structure that finds a key by computing its hash, giving O(1) lookups on average. Go\u0026rsquo;s map is one.","title":"Hash table"},{"content":"HEAD is the third of Git\u0026rsquo;s three areas: the last commit. git diff HEAD compares the working tree against it.\n","permalink":"https://justroham.ir/glossary/head/","summary":"the pointer to the commit (usually via a branch) that your checkout is based on.","title":"HEAD"},{"content":"In HTTP/1.1 one connection handles one response at a time, so a slow response blocks the next ones. HTTP/2 removes this at the HTTP level, but TCP still delivers bytes in order, so a lost packet can stall every stream on the connection.\n","permalink":"https://justroham.ir/glossary/head-of-line-blocking/","summary":"One slow item at the front of a queue holds up everything behind it.","title":"Head-of-line blocking"},{"content":"An active check sends probes (for example GET /healthz) on a timer; a passive check watches real traffic for errors. After a few failures the backend leaves the rotation.\n","permalink":"https://justroham.ir/glossary/health-check/","summary":"A probe that tells a load balancer whether a backend can take traffic.","title":"Health check"},{"content":"In Node.js you write one with v8.writeHeapSnapshot(). The file is JSON and can be as large as the heap itself, so delete it after use.\n","permalink":"https://justroham.ir/glossary/heap-snapshot/","summary":"A dump of every live object in the JavaScript heap with sizes and references, used to find what holds memory.","title":"Heap snapshot"},{"content":"Heap sort turns the slice into a max-heap with heapify, then swaps the largest item (the root) to the end of the shrinking heap and restores the heap. It has a guaranteed O(n log n) bound and needs no buffer, but it jumps around memory and usually does more comparisons than quicksort or merge sort.\n","permalink":"https://justroham.ir/glossary/heap-sort/","summary":"Build a max-heap in place, then repeatedly swap the root to the end and sift down; O(n log n), no extra memory, not stable.","title":"Heap sort"},{"content":"Heapify starts at index n/2-1 and sifts each node down. Most nodes are near the leaves and move very little, so the total work is O(n), cheaper in the worst case than pushing n items one by one (O(n log n)). See Binary heap.\n","permalink":"https://justroham.ir/glossary/heapify/","summary":"Turning an unordered slice into a heap in place in O(n), by sifting down from the last parent to the root.","title":"Heapify"},{"content":"A half-dead TCP connection can look open for a long time. If a ping gets no pong before a deadline, the peer is treated as gone and the connection is closed.\n","permalink":"https://justroham.ir/glossary/heartbeat/","summary":"A periodic small message (such as a ping) used to find out whether the other side is still alive.","title":"Heartbeat"},{"content":"The client waits a short time (near the typical latency), then sends the same request elsewhere. It cuts slow outliers at the price of some extra load, and the operation must be safe to run twice (idempotency).\n","permalink":"https://justroham.ir/glossary/hedged-request/","summary":"Sending a second copy of a slow request to another replica and using the first reply.","title":"Hedged request"},{"content":"Shell syntax (\u0026lt;\u0026lt;EOT) that feeds the following lines to a command\u0026rsquo;s stdin. A quoted marker (\u0026lt;\u0026lt;'EOT') disables variable expansion inside.\n","permalink":"https://justroham.ir/glossary/here-document/","summary":"Shell syntax (\u003ccode\u003e\u0026lt;\u0026lt;EOT\u003c/code\u003e) that feeds the following lines to a command’s stdin. A quoted marker (\u003ccode\u003e\u0026lt;\u0026lt;’EOT’\u003c/code\u003e) disables variable expansion inside.","title":"Here-document"},{"content":"Every stream has a highWaterMark. When the buffered amount reaches it, write() returns false, which is the start of backpressure. It is a threshold, not a hard limit.\n","permalink":"https://justroham.ir/glossary/high-water-mark/","summary":"The buffer size at which a stream starts asking producers to slow down (16 KiB by default for a Writable).","title":"highWaterMark"},{"content":"It keeps writes succeeding during short outages. The hinted node is not one of the key\u0026rsquo;s real replicas, so this is called a sloppy quorum and it weakens the overlap guarantee of quorum.\n","permalink":"https://justroham.ir/glossary/hinted-handoff/","summary":"When a replica is down, another node holds its writes with a hint and hands them over when it returns.","title":"Hinted handoff"},{"content":"In Go: hmac.New(sha256.New, key), write the message, Sum(nil). Compare tags with hmac.Equal.\n","permalink":"https://justroham.ir/glossary/hmac/","summary":"A message authentication code built from a hash and a secret key; unlike sha256(secret||msg) it resists length extension.","title":"HMAC"},{"content":"Changing the hash function does not help, because the same key always lands on the same shard. A common mitigation is splitting the key with a suffix (salt), which spreads writes but makes reads touch every suffix.\n","permalink":"https://justroham.ir/glossary/hot-key/","summary":"A single key that receives so much traffic that the shard owning it is overloaded no matter how evenly the other keys are spread.","title":"Hot key"},{"content":"It needs free space in the same page. n_tup_hot_upd in pg_stat_user_tables counts them.\n","permalink":"https://justroham.ir/glossary/hot-update/","summary":"Heap-Only Tuple update: a new row version stored in the same page with no new index entries, possible when no indexed column changes.","title":"HOT update"},{"content":"Client and server keep a table of headers already sent on the connection. A repeated header such as a long cookie is then sent as a small table index instead of the full text.\n","permalink":"https://justroham.ir/glossary/hpack/","summary":"The header compression scheme of HTTP/2.","title":"HPACK"},{"content":"Per its spec it is ignored when received over plain HTTP, so it only matters on HTTPS responses.\n","permalink":"https://justroham.ir/glossary/hsts/","summary":"HTTP Strict Transport Security: a header telling the browser to use only HTTPS for this site for a period.","title":"HSTS"},{"content":"HTTP/1.1 is a text protocol: a request line, header lines, a blank line and an optional body, all separated by CRLF. The server answers with a status line, headers, a blank line and a body.\n","permalink":"https://justroham.ir/glossary/http/","summary":"A text protocol for requests and responses, usually carried over TCP.","title":"HTTP"},{"content":"A redirect is a response such as 301 or 302 with a Location header. The client must send a new request to that URL; curl only does so with -L. See HTTP.\n","permalink":"https://justroham.ir/glossary/http-redirect/","summary":"A 3xx response with a Location header telling the client to request another URL.","title":"HTTP redirect"},{"content":"Trailers are a second block of headers that follows the message body. HTTP/2 allows them on any response. gRPC uses them to deliver grpc-status and grpc-message, because the outcome of a call is only known after the last message has been sent.\n","permalink":"https://justroham.ir/glossary/http-trailers/","summary":"Header fields sent after the body, once the final result is known.","title":"HTTP trailers"},{"content":"The client sends Upgrade: websocket and Connection: Upgrade. If the server agrees it replies 101 Switching Protocols and from then on the bytes on that connection are no longer HTTP.\n","permalink":"https://justroham.ir/glossary/http-upgrade/","summary":"A request header that asks the server to switch the connection to another protocol (101 Switching Protocols).","title":"HTTP Upgrade"},{"content":"The browser still sends the cookie with requests, but document.cookie cannot read it, so an XSS bug cannot simply steal a session cookie.\n","permalink":"https://justroham.ir/glossary/httponly/","summary":"A cookie attribute that hides the cookie from JavaScript running in the page.","title":"HttpOnly"},{"content":"Huffman coding repeatedly merges the two rarest symbols using a priority queue, building a binary tree whose paths are the codes. No code is a prefix of another, so the bit stream decodes unambiguously.\n","permalink":"https://justroham.ir/glossary/huffman-coding/","summary":"A greedy prefix code that gives frequent symbols shorter bit strings.","title":"Huffman coding"},{"content":"A diff of one file may contain several hunks, each starting with an @@ line. git add -p lets you stage them one by one.\n","permalink":"https://justroham.ir/glossary/hunk/","summary":"one contiguous block of changes inside a diff.","title":"Hunk"},{"content":"It is a practical compromise used by some databases; this blog only names it and did not run one.\n","permalink":"https://justroham.ir/glossary/hybrid-logical-clock/","summary":"A timestamp combining physical time with a logical counter, close to real time yet respecting causality.","title":"Hybrid logical clock"},{"content":"The price is a slower reaction: ejecting a really dead instance takes as many probes as the threshold.\n","permalink":"https://justroham.ir/glossary/hysteresis/","summary":"Requiring several consecutive probes before changing state, so a flapping instance does not flip in and out of rotation.","title":"Hysteresis"},{"content":"An I/O-bound task is mostly waiting, for example for an upstream HTTP call. An event loop or many goroutines can overlap thousands of such waits cheaply.\n","permalink":"https://justroham.ir/glossary/io-bound/","summary":"Work that spends most of its time waiting for the network or disk rather than computing.","title":"I/O-bound"},{"content":"The control-message protocol of IP, used for errors such as port unreachable. When a datagram reaches a host with nothing listening on that UDP port, the host may answer with an ICMP port-unreachable message.\n","permalink":"https://justroham.ir/glossary/icmp/","summary":"The control-message protocol of IP, used for errors such as port unreachable.","title":"ICMP"},{"content":"Message systems with at-least-once delivery can redeliver, so handlers must tolerate duplicates. Typical techniques are an idempotency key stored in the database, a unique constraint, or JetStream\u0026rsquo;s Nats-Msg-Id deduplication on the publishing side.\n","permalink":"https://justroham.ir/glossary/idempotency/","summary":"Processing the same operation more than once has the same effect as processing it once.","title":"Idempotency"},{"content":"The server stores the key with the result of the first execution. A request that arrives again with the same key (a retry after a timeout, a double click) gets the stored answer and changes nothing. See idempotency.\n","permalink":"https://justroham.ir/glossary/idempotency-key/","summary":"A unique id the client sends with a request so the server can recognise a retry and return the first result instead of acting twice.","title":"Idempotency key"},{"content":"In pg_stat_activity this is state = 'idle in transaction': BEGIN was sent, the application stopped sending statements. The connection cannot be reused, and locks and the snapshot stay held. idle_in_transaction_session_timeout ends such sessions. See transaction.\n","permalink":"https://justroham.ir/glossary/idle-in-transaction/","summary":"A session that opened a transaction and is doing nothing, still holding its connection and locks.","title":"Idle in transaction"},{"content":"Example: GET /orders/2 returns bob\u0026rsquo;s order to alice. The fix is an ownership check on the server for every read.\n","permalink":"https://justroham.ir/glossary/idor/","summary":"Insecure direct object reference: an endpoint returns an object by its ID without checking that the caller may see it.","title":"IDOR"},{"content":"Kahn\u0026rsquo;s algorithm keeps an in-degree counter per vertex. A vertex with in-degree 0 has no unfinished prerequisites and is ready.\n","permalink":"https://justroham.ir/glossary/in-degree/","summary":"The number of edges pointing into a vertex; in dependency graphs, how many prerequisites it still waits for.","title":"In-degree"},{"content":"NIST SP 800-61 describes the lifecycle as preparation, detection and analysis, containment, eradication and recovery, and post-incident activity. Preparation is the part you can only do before the incident.\n","permalink":"https://justroham.ir/glossary/incident-response/","summary":"The organised process of detecting, containing, removing and learning from a security incident.","title":"Incident response"},{"content":"It still checks the visibility map; for pages not marked all-visible it fetches the table row (shown as Heap Fetches).\n","permalink":"https://justroham.ir/glossary/index-only-scan/","summary":"A plan node that answers a query from the index alone, without visiting the table.","title":"Index Only Scan"},{"content":"A # /// script comment block holds TOML such as dependencies = [...]. Tools like uv run script.py read it, build a cached environment and run the script, so one file can carry its own requirements.\n","permalink":"https://justroham.ir/glossary/inline-script-metadata/","summary":"PEP 723: a comment block at the top of a single-file script that lists its dependencies and Python version.","title":"inline script metadata"},{"content":"The filesystem record that holds a file\u0026rsquo;s metadata (owner, mode, size, link count) and where its data lives. A name in a directory just points to an inode number.\n","permalink":"https://justroham.ir/glossary/inode/","summary":"The filesystem record that holds a file\u0026rsquo;s metadata (owner, mode, size, link count) and where its data lives. A name in a directory just points to an inode number.","title":"Inode"},{"content":"When an arithmetic result does not fit in the integer type. In Go, signed integers wrap around silently, so a sum of two large positive numbers can become negative.\n","permalink":"https://justroham.ir/glossary/integer-overflow/","summary":"A result too large for its integer type; in Go it wraps around silently.","title":"Integer overflow"},{"content":"It checks that the parts fit together. It is slower and less precise than a unit test when it fails, but catches wiring mistakes that unit tests cannot. It may use a fake instead of a real database.\n","permalink":"https://justroham.ir/glossary/integration-test/","summary":"A test that runs several parts together, such as a service with a repository.","title":"Integration test"},{"content":"A condition that is true before and after every iteration of a loop. You state it, show it holds at the start, show each step keeps it, and then the result follows when the loop ends.\n","permalink":"https://justroham.ir/glossary/invariant/","summary":"A condition that holds before and after every loop iteration, used to prove an algorithm correct.","title":"Invariant"},{"content":"Includes ip (addresses, links, routes, neighbours, namespaces) and ss (sockets).\n","permalink":"https://justroham.ir/glossary/iproute2/","summary":"The Linux network tool family driven by the ip command.","title":"iproute2"},{"content":"IPv6 addresses are 128 bits written as hex groups; one run of zero groups may be compressed to ::. A LAN subnet is normally a /64, and multicast replaces broadcast.\n","permalink":"https://justroham.ir/glossary/ipv6/","summary":"The 128-bit successor of IPv4, with hex notation, /64 subnets and no broadcast.","title":"IPv6"},{"content":"The SQL standard names READ UNCOMMITTED, READ COMMITTED, REPEATABLE READ and SERIALIZABLE. Stronger levels forbid more anomalies but can abort more transactions. PostgreSQL\u0026rsquo;s default is READ COMMITTED.\n","permalink":"https://justroham.ir/glossary/isolation-level/","summary":"The setting that decides how much one transaction sees of others running at the same time.","title":"Isolation level"},{"content":"An object with next that returns the next value and raises StopIteration when it is done.\n","permalink":"https://justroham.ir/glossary/iterator/","summary":"An object with \u003cstrong\u003enext\u003c/strong\u003e that returns the next value and raises StopIteration when it is done.","title":"Iterator"},{"content":"Core NATS is fire-and-forget. JetStream adds durable storage, acknowledgements, replay and delivery guarantees. A stream captures subjects; a durable consumer tracks progress through it.\n","permalink":"https://justroham.ir/glossary/jetstream/","summary":"The persistence layer of NATS: streams that store messages, and consumers that read them.","title":"JetStream"},{"content":"Full jitter picks the delay uniformly in [0, backoff]; equal jitter keeps half the backoff and randomises the rest. Both spread the retries of many clients over time. See exponential backoff.\n","permalink":"https://justroham.ir/glossary/jitter/","summary":"Randomness added to a retry delay so clients stop retrying in lockstep.","title":"Jitter"},{"content":"An inner JOIN keeps only rows that match on both sides. A LEFT JOIN keeps every left row and fills the right side with NULL when nothing matches.\n","permalink":"https://justroham.ir/glossary/sql-join/","summary":"Combining rows of two tables by a matching condition.","title":"JOIN"},{"content":"You read the journal with journalctl, for example journalctl -u myservice for one unit. A service only has to write to stdout or stderr; the journal captures it.\n","permalink":"https://justroham.ir/glossary/journald/","summary":"The systemd service that collects logs from services and the kernel into a structured journal.","title":"journald"},{"content":"A schema says things like \u0026ldquo;this is an object, qty is an integer of at least 1, item is required\u0026rdquo;. Fastify compiles the schema once and uses it to reject bad input and to serialize output.\n","permalink":"https://justroham.ir/glossary/json-schema/","summary":"A vocabulary for describing the shape of a JSON document so a library can validate it automatically.","title":"JSON Schema"},{"content":"Unlike plain json, jsonb drops key order and duplicate keys, but supports operators such as @\u0026gt; (contains) and ? (key exists) and GIN indexes. A JSONB value has no schema or type checks unless you add constraints. See GIN index.\n","permalink":"https://justroham.ir/glossary/jsonb/","summary":"A PostgreSQL column type that stores JSON in a parsed binary form that can be indexed and queried.","title":"JSONB"},{"content":"Each key has a kid that the token header names, which makes key rotation possible without changing the clients.\n","permalink":"https://justroham.ir/glossary/jwks/","summary":"A JSON document, usually at /jwks.json, that publishes the public keys used to verify an issuer\u0026rsquo;s signed tokens.","title":"JWKS"},{"content":"Anyone can read the payload; only the signature stops changes. It is valid until its exp unless the server keeps extra state.\n","permalink":"https://justroham.ir/glossary/jwt/","summary":"A signed token (header.payload.signature, base64url) carrying claims; signed, not encrypted.","title":"JWT"},{"content":"With HTTP keep-alive the connection stays open after a response so the next request can reuse it. The server closes it after an idle timeout (keepAliveTimeout in Node.js).\n","permalink":"https://justroham.ir/glossary/keep-alive/","summary":"Reusing one TCP connection for several HTTP requests instead of opening a new one each time.","title":"Keep-alive"},{"content":"Slow ones (scrypt, Argon2id) are for passwords; fast ones (HKDF) are for already-strong secrets. A password is never a key by itself.\n","permalink":"https://justroham.ir/glossary/key-derivation-function/","summary":"A function that turns a password or a master secret into uniformly random keys of the needed length.","title":"Key derivation function"},{"content":"Store a key id with every ciphertext so several keys can coexist. After a leak, rotate first (the old key is compromised), then clean up.\n","permalink":"https://justroham.ir/glossary/key-rotation/","summary":"Replacing a key with a new one on a schedule or after exposure, while old data stays readable.","title":"Key rotation"},{"content":"The client sends the sort key of the last row it saw (often wrapped in an opaque cursor) and the server returns the rows after it. Inserts and deletes before that point do not shift the next page, and with an index on the sort key it avoids scanning the skipped rows. See pagination.\n","permalink":"https://justroham.ir/glossary/keyset-pagination/","summary":"Paging by \u0026lsquo;rows after this key\u0026rsquo; instead of \u0026lsquo;skip N rows\u0026rsquo;.","title":"Keyset pagination"},{"content":"A kill switch is a flag that overrides every other rule and turns a feature off for everyone. Because it needs no deploy, it is a fast first response when a new path misbehaves in production.\n","permalink":"https://justroham.ir/glossary/kill-switch/","summary":"a flag whose only job is to turn a feature off at once.","title":"Kill switch"},{"content":"KMP (Knuth–Morris–Pratt) searches a text in O(n + m) comparisons. After a mismatch it uses the pattern\u0026rsquo;s own prefix structure to decide how much of the match to keep.\n","permalink":"https://justroham.ir/glossary/kmp-algorithm/","summary":"String search that precomputes a failure function so the text pointer never moves backwards.","title":"KMP algorithm"},{"content":"In the 0/1 version each item is used at most once; in the unbounded version any number of times.\n","permalink":"https://justroham.ir/glossary/knapsack/","summary":"Choose items with weights and values to maximise value within a weight capacity.","title":"Knapsack problem"},{"content":"The first connection is trust on first use: you accept the fingerprint and it is stored. If it later differs, ssh warns that the host identification has changed. Host names can be hashed with ssh-keygen -H.\n","permalink":"https://justroham.ir/glossary/known-hosts/","summary":"The client-side file of server host keys already trusted, used to detect a changed or fake server.","title":"known_hosts"},{"content":"kqueue() creates a queue and kevent() both registers interest and fetches ready events. Go\u0026rsquo;s runtime uses it for network polling on macOS and the BSDs.\n","permalink":"https://justroham.ir/glossary/kqueue/","summary":"The BSD and macOS event notification interface, the cousin of Linux epoll.","title":"kqueue"},{"content":"The converse does not hold: a smaller timestamp does not mean happens-before, so a Lamport clock cannot detect concurrency. Ties are often broken by process id to get a total order.\n","permalink":"https://justroham.ir/glossary/lamport-clock/","summary":"A single counter per process, advanced on events and merged with max on receive, so that a happens-before b implies a smaller timestamp.","title":"Lamport clock"},{"content":"It is simple, but with skewed clocks the write that is really newer can carry a smaller timestamp and be lost silently.\n","permalink":"https://justroham.ir/glossary/last-write-wins/","summary":"A conflict rule that keeps the value with the highest timestamp and discards the others.","title":"Last write wins"},{"content":"A closure looks up a variable by name when it runs, so it sees the variable\u0026rsquo;s latest value.\n","permalink":"https://justroham.ir/glossary/late-binding/","summary":"A closure looks up a variable by name when it runs, so it sees the variable\u0026rsquo;s latest value.","title":"Late binding"},{"content":"Not removing or editing an old entry; push a new one and skip the stale one when it is popped.\nCommon with heaps in Dijkstra: simpler than decrease-key, at the price of extra entries.\n","permalink":"https://justroham.ir/glossary/lazy-deletion/","summary":"Not removing or editing an old entry; push a new one and skip the stale one when it is popped.","title":"Lazy deletion"},{"content":"Computing a value only when it is actually needed, not up front.\n","permalink":"https://justroham.ir/glossary/lazy-evaluation/","summary":"Computing a value only when it is actually needed, not up front.","title":"Lazy evaluation"},{"content":"Example: ABCBDAB and BDCABA share BCBA. It is solved with a two-dimensional table in O(n*m).\n","permalink":"https://justroham.ir/glossary/longest-common-subsequence/","summary":"The longest sequence that appears in both inputs in the same order, not necessarily contiguous.","title":"LCS"},{"content":"Followers that stop hearing heartbeats time out at random moments, so usually one candidate starts first and wins.\n","permalink":"https://justroham.ir/glossary/leader-election/","summary":"Choosing one node to coordinate for a period; in Raft a candidate needs votes from a majority in a new term.","title":"Leader election"},{"content":"In rate limiting a replica leases B tokens from the shared store and spends them locally, trading store calls for a bounded over-admission.\n","permalink":"https://justroham.ir/glossary/lease/","summary":"A grant of a resource or a quota to a holder for a limited share or time.","title":"Lease"},{"content":"Give a process or person only the permissions needed for the job and nothing more, so a mistake or compromise has a small blast radius.\n","permalink":"https://justroham.ir/glossary/least-privilege/","summary":"Give a process or person only the permissions needed for the job and nothing more, so a mistake or compromise has a small blast radius.","title":"Least privilege"},{"content":"In this sense (the one popularized by Michael Feathers\u0026rsquo; book on the subject) age does not matter: code written last week without tests is already legacy. The first job is to get it under test, not to make it pretty.\n","permalink":"https://justroham.ir/glossary/legacy-code/","summary":"A common working definition: code without tests, so you cannot change it with confidence.","title":"Legacy code"},{"content":"It follows from how Merkle-Damgard hashes keep their internal state. HMAC is the standard fix.\n","permalink":"https://justroham.ir/glossary/length-extension-attack/","summary":"An attack on hashes like SHA-256 where knowing H(secret||msg) lets you compute H(secret||msg||extra) without the secret.","title":"Length extension attack"},{"content":"Level-triggered reports a descriptor as ready on every wait while unread data remains. Edge-triggered reports it once per change, so you must read until EAGAIN or you can stall. In kqueue the edge-like behaviour comes from EV_CLEAR.\n","permalink":"https://justroham.ir/glossary/edge-level-triggered/","summary":"Two ways a readiness API reports events: while data is still waiting (level) or only when new data arrives (edge).","title":"Level-triggered and edge-triggered"},{"content":"Node.js uses libuv to talk to the operating system without blocking the JavaScript thread. It also runs some work (files, crypto, DNS lookup) in its thread pool.\n","permalink":"https://justroham.ir/glossary/libuv/","summary":"The C library under Node.js that provides the event loop, async I/O and a thread pool.","title":"libuv"},{"content":"In Fastify the stages run in a fixed order: onRequest, preValidation, preHandler, the handler, then onSend. Hooks are the place for cross-cutting work such as request IDs or headers.\n","permalink":"https://justroham.ir/glossary/lifecycle-hook/","summary":"A function the framework calls at a fixed stage of a request, such as before the handler runs.","title":"Lifecycle hook"},{"content":"Lifetimes such as 'a never change how long data lives; they only let the compiler check that a reference does not outlive what it points to. Most are inferred (elision), and you write them explicitly when a function returns a reference tied to one of several inputs.\nfn longest\u0026lt;\u0026#39;a\u0026gt;(x: \u0026amp;\u0026#39;a str, y: \u0026amp;\u0026#39;a str) -\u0026gt; \u0026amp;\u0026#39;a str { if x.len() \u0026gt; y.len() { x } else { y } } ","permalink":"https://justroham.ir/glossary/lifetime/","summary":"A compile-time annotation describing how long a reference stays valid.","title":"Lifetime"},{"content":"It is cache-friendly because neighbouring slots sit next to each other in memory, but keys that collide form clusters that make later lookups longer.\n","permalink":"https://justroham.ir/glossary/linear-probing/","summary":"Open addressing strategy: if the slot is taken, try the next one, and the next, until a free slot or the key is found.","title":"Linear probing"},{"content":"This is what the C in CAP means. A read that starts after a write has completed must see that write. See CAP theorem.\n","permalink":"https://justroham.ir/glossary/linearizability/","summary":"Every operation appears to take effect at one instant between its start and end, as if there were a single copy of the data.","title":"Linearizability"},{"content":"A sequence of separately allocated nodes, each holding a value and a pointer to the next one (a doubly linked list also has a pointer to the previous one). Inserting or removing next to a node you already hold is O(1), but reaching the i-th element means walking i pointers. Compare a dynamic array.\n","permalink":"https://justroham.ir/glossary/linked-list/","summary":"A sequence of separately allocated nodes, each holding a value and a pointer to the next one (and sometimes the previous one). Cheap to splice, slow to index.","title":"Linked list"},{"content":"The kernel splits the powers of root into separate units such as CAP_NET_BIND_SERVICE or CAP_CHOWN, so a process can hold only the ones it needs.\n","permalink":"https://justroham.ir/glossary/linux-capabilities/","summary":"The kernel splits the powers of root into separate units such as CAP_NET_BIND_SERVICE or CAP_CHOWN, so a process can hold only the ones it needs.","title":"Linux capabilities"},{"content":"A Python expression that builds a list from an iterable in one line, e.g. [x * x for x in data if x % 2 == 0].\n","permalink":"https://justroham.ir/glossary/list-comprehension/","summary":"A Python expression that builds a list from an iterable in one line, e.g. [x * x for x in data if x % 2 == 0].","title":"List comprehension"},{"content":"listen(fd, n) gives the kernel a queue for connections that completed the handshake but were not yet taken by accept(). What happens when it is full (drop the SYN, reset, refuse) depends on the operating system.\n","permalink":"https://justroham.ir/glossary/listen-backlog/","summary":"The size of the kernel queue of connections waiting for accept().","title":"Listen backlog"},{"content":"If a team finishes 0.6 items a day and each takes 5 days, about 3 items are in progress. To cut cycle time without losing throughput, cut work in progress.\n","permalink":"https://justroham.ir/glossary/littles-law/","summary":"In a stable system, average WIP equals throughput times average cycle time.","title":"Little's law"},{"content":"An ES module import that points at the exporting module\u0026rsquo;s variable itself, not at a copy of its value. If the exporter changes export let count, every importer sees the new value. Importers cannot assign to it.\n","permalink":"https://justroham.ir/glossary/live-binding/","summary":"an ES module import that points at the exporting module\u0026rsquo;s variable itself, not at a copy of its value.","title":"Live binding"},{"content":"The three numbers uptime prints: the average count of jobs ready to run over 1, 5 and 15 minutes. Compare it with the number of cores; the exact definition is not identical on Linux and macOS.\n","permalink":"https://justroham.ir/glossary/load-average/","summary":"Average number of runnable jobs (on Linux also those waiting for disk) over the last 1, 5 and 15 minutes.","title":"Load average"},{"content":"A load balancer sits in front of several identical backends and picks one for each connection (layer 4) or each request (layer 7). It also hides backends that are down.\n","permalink":"https://justroham.ir/glossary/load-balancer/","summary":"A component that spreads incoming traffic across several backend servers.","title":"Load balancer"},{"content":"A table with 75 entries in 100 slots has a load factor of 0.75. With open addressing the average probe length grows sharply as it approaches 1, so implementations grow the table well before that.\n","permalink":"https://justroham.ir/glossary/load-factor/","summary":"How full a hash table is: stored entries divided by slots. Past a threshold the table is rehashed into a bigger one.","title":"Load factor"},{"content":"A bounded queue or pool answers HTTP 503 or 429 when full instead of letting the queue grow without limit. A fast, honest refusal is usually better for the client than a slow answer that arrives after its timeout.\n","permalink":"https://justroham.ir/glossary/load-shedding/","summary":"Rejecting some requests early so the rest can still be served in time.","title":"Load shedding"},{"content":"Some operations must not run at the same time. A lock lets the second session wait (or fail fast) until the first one commits or rolls back. In PostgreSQL locks are held until the end of the transaction, and a cycle of waits becomes a deadlock.\n","permalink":"https://justroham.ir/glossary/lock/","summary":"A mechanism that makes a session wait before touching data another session is using; PostgreSQL has table-level and row-level locks.","title":"Lock"},{"content":"Put it on every DDL statement in production and retry, so a waiting ALTER TABLE does not queue up all other queries behind it.\n","permalink":"https://justroham.ir/glossary/lock-timeout/","summary":"A setting that makes a statement give up with an error if it waits too long for a lock.","title":"lock_timeout"},{"content":"In npm it is package-lock.json. Committing it makes every machine and CI run install the same tree, and npm ci refuses to run if it disagrees with package.json.\n","permalink":"https://justroham.ir/glossary/lockfile/","summary":"A file that records the exact versions, download URLs and hashes of every installed dependency.","title":"lockfile"},{"content":"Structured logging with quoting and escaping keeps one event on one line.\n","permalink":"https://justroham.ir/glossary/log-injection/","summary":"User input containing a newline or control character that forges extra log lines.","title":"Log injection"},{"content":"On Linux, logrotate does this from a config file: how often or at what size to rotate and how many old files to keep (rotate N). A program still holding the old file open needs a signal or copytruncate.\n","permalink":"https://justroham.ir/glossary/log-rotation/","summary":"Renaming, compressing and deleting old log files so a log never grows without bound.","title":"Log rotation"},{"content":"It is portable across versions and can restore a single table, but it captures one moment and rebuilds indexes on restore. A physical backup copies the data files and can be combined with WAL for point-in-time recovery.\n","permalink":"https://justroham.ir/glossary/logical-backup/","summary":"A backup made of SQL or row data (pg_dump, COPY) instead of copies of the data files.","title":"Logical backup"},{"content":"Loopback addresses (127.0.0.1, ::1) never leave the host. They are the safe place to run network experiments and local servers.\n","permalink":"https://justroham.ir/glossary/loopback/","summary":"The virtual interface that sends traffic back to the same machine: 127.0.0.0/8 and ::1.","title":"Loopback"},{"content":"Typical cause: read-modify-write in application code. Fixes: do the arithmetic in SQL (SET balance = balance - 10), lock the row with SELECT ... FOR UPDATE, or use a higher isolation level and retry.\n","permalink":"https://justroham.ir/glossary/lost-update/","summary":"Two transactions read the same value, both write a result computed from it, and one write silently overwrites the other.","title":"Lost update"},{"content":"In a sorted array, the first index whose element is not less than the target, or the length if there is none. The upper bound is the first index whose element is greater than the target; their difference is the count of the target.\n","permalink":"https://justroham.ir/glossary/lower-bound/","summary":"The first index in a sorted array whose element is not less than the target.","title":"Lower bound (search)"},{"content":"A cache with a fixed size that evicts the least recently used entry when it is full. The usual build is a hash map from key to list node plus a doubly linked list ordered by recency, so lookup, move-to-front and eviction are all O(1).\n","permalink":"https://justroham.ir/glossary/lru-cache/","summary":"A cache with a fixed size that, when full, evicts the least recently used entry. Usually a map plus a doubly linked list.","title":"LRU cache"},{"content":"Subtracting two LSNs with pg_wal_lsn_diff gives a distance in bytes, which is how replication lag is measured.\n","permalink":"https://justroham.ir/glossary/lsn/","summary":"Log sequence number: a position in the WAL, shown like 0/1830840.","title":"LSN"},{"content":"The fix is an allow-list input type with only the fields the client may send, and the server computing or defaulting the rest.\n","permalink":"https://justroham.ir/glossary/mass-assignment/","summary":"A bug where the server copies every field of a client request into an internal object, so the client can set fields it should never control (price, status, role).","title":"Mass assignment"},{"content":"Caching a function\u0026rsquo;s result per argument so repeated calls skip the work.\n","permalink":"https://justroham.ir/glossary/memoization/","summary":"Caching a function\u0026rsquo;s result per argument so repeated calls skip the work.","title":"Memoization"},{"content":"The classic case is a module-level Map or array that grows with every request and is never trimmed.\n","permalink":"https://justroham.ir/glossary/memory-leak/","summary":"Memory that is no longer needed but is still reachable, so the garbage collector cannot free it.","title":"Memory leak"},{"content":"Memory-safe code cannot index past an array, use freed memory or free it twice. Rust enforces this at compile time in safe code, Go and most managed languages with runtime checks and a garbage collector. C leaves it to the programmer. See buffer overflow and use-after-free.\n","permalink":"https://justroham.ir/glossary/memory-safety/","summary":"A language or tool guarantee that a program cannot read or write memory it does not own.","title":"Memory safety"},{"content":"A merge combines the work of another branch into the current one. If both sides have new commits, Git records a merge commit and keeps both histories as they happened.\n","permalink":"https://justroham.ir/glossary/merge/","summary":"joins two lines of history; if they diverged, Git creates a merge commit with two parents.","title":"merge"},{"content":"A merge commit is created by a non-fast-forward merge. It has two parents, so git log --graph shows the branch and join as a diamond.\n","permalink":"https://justroham.ir/glossary/merge-commit/","summary":"a commit with two parents that records the joining of two histories.","title":"merge commit"},{"content":"A conflict leaves \u0026lt;\u0026lt;\u0026lt;\u0026lt;\u0026lt;\u0026lt;\u0026lt;, ======= and \u0026gt;\u0026gt;\u0026gt;\u0026gt;\u0026gt;\u0026gt;\u0026gt; markers in the file. You edit it, git add it and finish with git commit (or --continue in a rebase).\n","permalink":"https://justroham.ir/glossary/merge-conflict/","summary":"Git could not combine two changes to the same lines automatically and asks you to choose.","title":"Merge conflict"},{"content":"Merge sort splits the slice, sorts each half recursively and merges them by repeatedly taking the smaller front item. When two items are equal it takes the left one first, which makes it stable. The price is a temporary buffer as large as the input.\n","permalink":"https://justroham.ir/glossary/merge-sort/","summary":"Split in half, sort each half, merge the two sorted halves; always O(n log n), stable, but needs O(n) extra memory.","title":"Merge sort"},{"content":"To find differences, compare roots and descend only into subtrees whose hashes differ. With few differences you compare a handful of nodes instead of every key.\n","permalink":"https://justroham.ir/glossary/merkle-tree/","summary":"A tree of hashes where each parent hashes its children, so equal root hashes mean equal data.","title":"Merkle tree"},{"content":"TCP gives you bytes without boundaries, so the protocol must say where a message ends. Two common ways: a delimiter such as a newline, or a length prefix (a fixed-size number before the payload). See stream.\n","permalink":"https://justroham.ir/glossary/message-framing/","summary":"Rules that mark where one message ends in a byte stream such as TCP.","title":"Message framing"},{"content":"In a microservice architecture the system is many small services, each deployed on its own and owning its own data. The gain is independent deploy, scaling and failure isolation. The price is that every call is now a network call that can be slow, lost or duplicated.\n","permalink":"https://justroham.ir/glossary/microservices/","summary":"Independently deployed services that each own their data and talk over the network.","title":"Microservices"},{"content":"The microtask queue is drained completely after each callback. A chain of microtasks that keeps adding new ones can starve timers and I/O.\n","permalink":"https://justroham.ir/glossary/microtask/","summary":"A small job (promise callback, queueMicrotask) that runs right after the current code, before the event loop continues.","title":"Microtask"},{"content":"Typical examples are adding a column or an index. The risk is not the SQL itself but the locks it takes on a live table. Tools such as goose or Flyway only run the files in order; they do not make a dangerous statement safe.\n","permalink":"https://justroham.ir/glossary/migration/","summary":"A versioned change to the database schema, applied in order by a script or a tool.","title":"Migration"},{"content":"A minimum spanning tree (MST) of a connected weighted graph with n nodes has n-1 edges, connects all nodes, has no cycle, and has the smallest total weight. Kruskal\u0026rsquo;s algorithm builds it by sorting edges and adding each edge that does not close a cycle, which union-find checks.\n","permalink":"https://justroham.ir/glossary/minimum-spanning-tree/","summary":"The cheapest set of edges that connects every node of a weighted graph without forming a cycle.","title":"Minimum spanning tree"},{"content":"A modular monolith is deployed as one program, but split into modules with clear boundaries. Each module exposes a small interface and hides the rest; other modules may only use that interface. You keep one process and one transaction, and you keep the option to extract a module later.\n","permalink":"https://justroham.ir/glossary/modular-monolith/","summary":"One deployable whose modules talk only through narrow interfaces.","title":"Modular monolith"},{"content":"monkeypatch is a pytest fixture that changes things like environment variables, attributes or dictionary items for the duration of one test and undoes every change afterwards. It keeps tests from leaking state into each other.\n","permalink":"https://justroham.ir/glossary/monkeypatch/","summary":"temporarily replacing an attribute, env var or dict item during a test","title":"monkeypatch"},{"content":"A monorepo keeps many projects in one version-control repository. A change that touches several of them can land as one commit. The price is a bigger repository and coarser access control. See also polyrepo.\n","permalink":"https://justroham.ir/glossary/monorepo/","summary":"One repository that holds the code of several services or libraries, built and versioned together.","title":"Monorepo"},{"content":"Wall-clock time can jump when it is corrected, so subtracting two wall times can give a negative duration. In Go, time.Now() carries a monotonic reading too, and Sub uses it when both values have one.\n","permalink":"https://justroham.ir/glossary/monotonic-clock/","summary":"A clock that only moves forward and is meant for measuring durations, not for telling the date.","title":"Monotonic clock"},{"content":"It can break when consecutive reads hit different replicas with different lag. Pinning the client to one replica, or a session token, prevents it.\n","permalink":"https://justroham.ir/glossary/monotonic-reads/","summary":"A client\u0026rsquo;s successive reads never go back to an older value.","title":"Monotonic reads"},{"content":"Instead of one answer, you get a distribution: run the model with random inputs 100,000 times and report, for example, the 50th and 80th percentile.\n","permalink":"https://justroham.ir/glossary/monte-carlo-simulation/","summary":"Estimating a result by running a random model many times and reading percentiles.","title":"Monte Carlo simulation"},{"content":"The order in which Python searches a class and its parents for an attribute; super() follows this order, and you can print it with Class.mro.\n","permalink":"https://justroham.ir/glossary/mro/","summary":"The order in which Python searches a class and its parents for an attribute; super() follows this order, and you can print it with Class.\u003cstrong\u003emro\u003c/strong\u003e.","title":"MRO (method resolution order)"},{"content":"It is roughly the MTU minus the IP and TCP headers (20 + 20 bytes without options), so 1460 on a 1500 MTU. Each side announces its MSS when the connection opens.\n","permalink":"https://justroham.ir/glossary/mss/","summary":"Maximum Segment Size: the most TCP payload bytes per segment.","title":"MSS"},{"content":"According to the docs, classic Ethernet has an MTU of 1500 bytes. A bigger IP packet must be fragmented or rejected.\n","permalink":"https://justroham.ir/glossary/mtu/","summary":"Maximum Transmission Unit: the largest packet a link carries in one frame.","title":"MTU"},{"content":"In HTTP/2 each request is a numbered stream, and frames of different streams are interleaved on one TCP connection. The client does not need one connection per in-flight request.\n","permalink":"https://justroham.ir/glossary/multiplexing/","summary":"Sending many independent requests and responses at once over a single connection.","title":"Multiplexing"},{"content":"A tool makes many small changes (mutants) such as turning \u0026gt;= into \u0026gt;, and runs the tests on each. A mutant that no test catches shows a gap that line coverage cannot show.\n","permalink":"https://justroham.ir/glossary/mutation-testing/","summary":"Judging a test suite by whether it fails when the code is deliberately broken.","title":"Mutation testing"},{"content":"sync.Mutex protects a critical section with Lock() and Unlock(). Always pair them, usually with defer. sync.RWMutex allows many concurrent readers or a single writer. Forgetting the lock leads to a race condition.\nmu.Lock() defer mu.Unlock() count++ ","permalink":"https://justroham.ir/glossary/mutex/","summary":"A lock that lets only one goroutine at a time touch a piece of shared state.","title":"Mutex"},{"content":"In normal TLS only the server proves who it is. In mutual TLS the server asks for a client certificate too and rejects the connection if it is missing or not signed by a trusted CA. It is common between internal services.\n","permalink":"https://justroham.ir/glossary/mutual-tls/","summary":"TLS where the client also presents a certificate and the server verifies it.","title":"Mutual TLS (mTLS)"},{"content":"In PostgreSQL an UPDATE does not overwrite a row: it writes a new version and marks the old one as ended. Each query uses a snapshot to decide which versions it may see. The price is dead versions that VACUUM must clean up later.\n","permalink":"https://justroham.ir/glossary/mvcc/","summary":"Multi-version concurrency control: the database keeps several versions of a row so readers and writers do not block each other.","title":"MVCC"},{"content":"The application loads 100 orders with one query, then runs 100 more queries to load each customer. Every single query is fast, so no plan looks wrong; the cost is the round trips. The fix is one query with a join or WHERE id = ANY(...).\n","permalink":"https://justroham.ir/glossary/n-plus-one/","summary":"One query to fetch a list, then one more query per item in the list.","title":"N+1 queries"},{"content":"Per namespaces(7) there are several types (mount, PID, network, UTS, IPC, user, cgroup, time). A process joins them through clone(2), unshare(2) or setns(2), and the links in /proc/\u0026lt;pid\u0026gt;/ns/ identify them.\n","permalink":"https://justroham.ir/glossary/namespace/","summary":"A kernel feature that gives a process its own view of a resource such as PIDs, mounts, network or hostname.","title":"Namespace"},{"content":"A cycle whose edge weights sum to less than zero, so going around it forever keeps lowering the cost.\nWhen one is reachable, no shortest path exists. Bellman-Ford detects it.\n","permalink":"https://justroham.ir/glossary/negative-cycle/","summary":"A cycle whose edge weights sum to less than zero, so going around it forever keeps lowering the cost.","title":"Negative cycle"},{"content":"The hooks are prerouting, input, forward, output and postrouting. nftables and iptables both build on them.\n","permalink":"https://justroham.ir/glossary/netfilter/","summary":"The kernel hooks in the network stack where packets can be filtered or changed.","title":"netfilter"},{"content":"A netmask is the prefix length written as an address: /24 is 255.255.255.0. ANDing an address with the mask gives the network address.\n","permalink":"https://justroham.ir/glossary/netmask/","summary":"A 32-bit mask whose leading ones mark the network part of an IPv4 address.","title":"Netmask"},{"content":"Each side may believe the other is dead, which is how split brain starts. It differs from a crash: both sides keep running.\n","permalink":"https://justroham.ir/glossary/network-partition/","summary":"A failure where nodes are alive but groups of them cannot reach each other.","title":"Network partition"},{"content":"Rules live in chains inside tables; base chains attach to netfilter hooks. It is the successor of iptables.\n","permalink":"https://justroham.ir/glossary/nftables/","summary":"The Linux packet-filtering framework configured with nft.","title":"nftables"},{"content":"A per-thread flag, set with prctl, that stops execve from granting more privilege through setuid bits or file capabilities. Once set it cannot be unset.\n","permalink":"https://justroham.ir/glossary/no-new-privs/","summary":"A per-thread flag, set with prctl, that stops execve from granting more privilege through setuid bits or file capabilities. Once set it cannot be unset.","title":"no_new_privs"},{"content":"The cluster module lets a primary process fork worker processes that all accept connections on the same port. They share no memory. The primary decides how to distribute connections and what to do when a worker dies.\n","permalink":"https://justroham.ir/glossary/node-cluster/","summary":"The \u003ccode\u003ecluster\u003c/code\u003e module: several Node processes sharing one listening port.","title":"Node cluster"},{"content":"A descriptor is switched to this mode with the O_NONBLOCK flag (fcntl(2)). It is normally combined with a readiness API such as epoll or kqueue, which tells you when trying again will succeed.\n","permalink":"https://justroham.ir/glossary/non-blocking-io/","summary":"A mode where read, write and accept return immediately with an error such as EAGAIN instead of making the thread wait.","title":"Non-blocking I/O"},{"content":"It happens when another transaction commits a change between your two reads. PostgreSQL allows it at READ COMMITTED and prevents it at REPEATABLE READ.\n","permalink":"https://justroham.ir/glossary/non-repeatable-read/","summary":"Reading the same row twice in one transaction and getting different values.","title":"Non-repeatable read"},{"content":"In AES-GCM a 12-byte nonce is stored next to the ciphertext. Reusing one with the same key breaks both confidentiality and authenticity. Generate it with crypto/rand.\n","permalink":"https://justroham.ir/glossary/nonce/","summary":"A value that must be used only once per key, such as the per-message input of AES-GCM.","title":"Nonce"},{"content":"Normalization is the process of splitting a table into smaller ones so that every fact (a customer\u0026rsquo;s email, a product\u0026rsquo;s price) lives in exactly one place. It removes update, insert and delete anomalies. The usual steps are called 1NF, 2NF and 3NF. See denormalization for the opposite trade.\n","permalink":"https://justroham.ir/glossary/normalization/","summary":"Split tables so each fact is stored exactly once.","title":"Normalization"},{"content":"npm installs packages listed in package.json into node_modules, runs scripts, and publishes packages to the registry.\n","permalink":"https://justroham.ir/glossary/npm/","summary":"The package manager that ships with Node.js and the default public registry of JavaScript packages.","title":"npm"},{"content":"NULL is not a value but an unknown, so NULL = NULL is not true (it is NULL). Use IS NULL, and remember that comparisons with NULL make WHERE drop the row.\n","permalink":"https://justroham.ir/glossary/sql-null/","summary":"The SQL marker for an unknown or missing value.","title":"NULL"},{"content":"NXDOMAIN is RCODE 3. It differs from NOERROR with an empty answer, which means the name exists but has no record of the asked type. Resolvers cache negative answers too.\n","permalink":"https://justroham.ir/glossary/nxdomain/","summary":"The DNS response code meaning that the name does not exist.","title":"NXDOMAIN"},{"content":"It is about authorization: what a token may do. The main roles are the user, the client app, the authorization server and the resource server (the API).\n","permalink":"https://justroham.ir/glossary/oauth2/","summary":"A framework that lets an app get limited access to an API on a user\u0026rsquo;s behalf through tokens, without seeing the user\u0026rsquo;s password.","title":"OAuth 2.0"},{"content":"In object mode a stream passes whole values (objects, numbers) as chunks. Readable.from(iterable) creates an object-mode Readable by default, and the highWaterMark then counts objects, not bytes.\n","permalink":"https://justroham.ir/glossary/object-mode/","summary":"A stream option where each chunk is any JavaScript value instead of bytes or a string.","title":"Object mode"},{"content":"Instead of downloading a whole revocation list, a client (or the server, via stapling) asks the CA about one serial number. I did not run this; as far as I know Go\u0026rsquo;s standard TLS client does not check revocation by itself.\n","permalink":"https://justroham.ir/glossary/ocsp/","summary":"A way to ask a CA whether a specific certificate has been revoked.","title":"OCSP"},{"content":"According to the cgroup v2 docs, when usage reaches memory.max and cannot be reduced, the OOM killer is invoked in that cgroup, and memory.events counts it in oom_kill.\n","permalink":"https://justroham.ir/glossary/oom-killer/","summary":"The kernel mechanism that kills a process when memory runs out, system-wide or inside a cgroup that hit memory.max.","title":"OOM killer"},{"content":"An OpenAPI document lists every path and operation with the shapes it accepts and returns. Tools read it to lint, generate docs, build stubs and clients, or test a server.\n","permalink":"https://justroham.ir/glossary/openapi/","summary":"A standard YAML/JSON format for describing an HTTP API: paths, parameters, request and response schemas.","title":"OpenAPI"},{"content":"OAuth2 alone says what a token may do; OIDC adds authentication. The client must validate the ID token: signature, iss, aud, exp and nonce.\n","permalink":"https://justroham.ir/glossary/oidc/","summary":"A thin identity layer on top of OAuth 2.0 that adds an ID token and a userinfo endpoint to tell the client who logged in.","title":"OpenID Connect (OIDC)"},{"content":"Operational errors are handled and mapped to a response. Programmer errors (a TypeError from a bug) mean the process state is suspect, so the safe reaction is to log and restart.\n","permalink":"https://justroham.ir/glossary/operational-error/","summary":"An expected runtime failure (bad input, missing record, timeout), as opposed to a bug.","title":"Operational error"},{"content":"An optimal answer to the whole problem is built from optimal answers to its subproblems.\nThe cheapest path to a grid cell extends the cheaper of the paths to its two neighbours. Without this property, storing subproblem answers does not give a correct result.\n","permalink":"https://justroham.ir/glossary/optimal-substructure/","summary":"An optimal answer to the whole problem is built from optimal answers to its subproblems.","title":"Optimal substructure"},{"content":"In an event store a primary key on (stream_id, version) does this: the second writer of version 3 gets a unique violation.\n","permalink":"https://justroham.ir/glossary/optimistic-concurrency/","summary":"Do not lock; write with the version you read and fail if someone else wrote first, then reload and retry.","title":"Optimistic concurrency"},{"content":"The flow is readable in one place, at the price of a central component that knows every participant. The opposite is choreography.\n","permalink":"https://justroham.ir/glossary/orchestration/","summary":"One coordinator sends commands to services in order and decides what happens on each reply or failure.","title":"Orchestration"},{"content":"An ORM lets you work with Python (or other language) objects while it generates the SQL. It saves boilerplate, but it can hide how many queries run, so you still need to read the SQL it emits.\n","permalink":"https://justroham.ir/glossary/orm/","summary":"Object-relational mapper: a library that maps tables to classes and rows to objects.","title":"ORM"},{"content":"It removes the dual-write problem: you can never commit the row but lose the event, or the reverse. A relay process reads the outbox table and publishes to the broker, so delivery is at-least-once and consumers must be idempotent.\n","permalink":"https://justroham.ir/glossary/outbox-pattern/","summary":"Writing an event to a database table in the same transaction as the data change, then publishing it afterwards.","title":"Outbox pattern"},{"content":"Each context has different dangerous characters, so one escape function is not enough. Go\u0026rsquo;s html/template picks the right one automatically from the template position.\n","permalink":"https://justroham.ir/glossary/output-encoding/","summary":"Escaping data for the exact context (HTML body, attribute, JavaScript, URL) it is written into.","title":"Output encoding"},{"content":"According to the kernel docs, vm.overcommit_memory is 0 (heuristic, default), 1 (always allow) or 2 (never overcommit). With overcommit, a failure shows up later as an OOM kill rather than as a failed malloc.\n","permalink":"https://justroham.ir/glossary/overcommit/","summary":"Letting processes reserve more virtual memory than physical RAM plus swap, because most of it is never touched.","title":"Overcommit"},{"content":"The same smaller problem is needed again and again by different branches of the recursion.\nIn naive Fibonacci, fib(30) is computed by both fib(32) and fib(31). Caching its result removes the repeated work.\n","permalink":"https://justroham.ir/glossary/overlapping-subproblems/","summary":"The same smaller problem is needed again and again by different branches of the recursion.","title":"Overlapping subproblems"},{"content":"Reads fall through to the lower layers and writes go to the upper one. Runtimes commonly use it so many containers can share one image.\n","permalink":"https://justroham.ir/glossary/overlayfs/","summary":"A Linux filesystem that stacks a writable layer over read-only layers; container images use it for their layers.","title":"overlayfs"},{"content":"It is an awareness document, not a checklist that proves a system is secure. The categories change between editions, so check the edition you are citing.\n","permalink":"https://justroham.ir/glossary/owasp-top-10/","summary":"A periodically updated list of the ten most critical web application security risk categories, published by OWASP.","title":"OWASP Top 10"},{"content":"Assigning or passing a non-Copy value moves it; the old binding can no longer be used. This lets Rust free memory deterministically with no garbage collector and rule out double frees at compile time. To use a value without taking it, use borrowing.\nlet a = String::from(\u0026#34;hi\u0026#34;); let b = a; // a is moved // println!(\u0026#34;{a}\u0026#34;); // compile error ","permalink":"https://justroham.ir/glossary/ownership/","summary":"Rust\u0026rsquo;s rule that every value has exactly one owner, and is dropped when the owner goes out of scope.","title":"Ownership"},{"content":"An extension of CAP that also covers normal operation: waiting for replicas costs latency, not waiting costs freshness. See CAP theorem.\n","permalink":"https://justroham.ir/glossary/pacelc/","summary":"If there is a Partition choose Availability or Consistency, Else choose Latency or Consistency.","title":"PACELC"},{"content":"A packfile (.git/objects/pack/*.pack) stores many Git objects in one file, with an .idx index for lookup. git gc and git repack create them, and fetch and push transfer them. See delta compression.\n","permalink":"https://justroham.ir/glossary/packfile/","summary":"A single Git file that stores many objects compactly, usually with delta compression.","title":"Packfile"},{"content":"According to proc_meminfo(5), Cached is the in-memory cache for files read from disk (the page cache). Because it can be reclaimed, it counts toward MemAvailable, so a large buff/cache is normal, not a leak.\n","permalink":"https://justroham.ir/glossary/page-cache/","summary":"The kernel\u0026rsquo;s in-memory cache of file contents, which makes repeated reads of a file avoid the disk and is reclaimed when memory is needed.","title":"Page cache"},{"content":"An API that lists many rows returns them a page at a time. The two common styles are offset (page/per_page) and keyset or cursor based, see keyset pagination.\n","permalink":"https://justroham.ir/glossary/pagination/","summary":"Returning a large list in pages instead of all at once.","title":"Pagination"},{"content":"The database parses the statement first and fills in values later, so a value can never change the structure of the query. Table and column names cannot be parameters.\n","permalink":"https://justroham.ir/glossary/parameterized-query/","summary":"A SQL statement with placeholders (\u003ccode\u003e$1\u003c/code\u003e) whose values are sent separately from the SQL text.","title":"Parameterized query"},{"content":"A parametrized test runs the same test function once per row of inputs and expected values, and reports each row as its own test. In pytest this is @pytest.mark.parametrize. It is the Python counterpart of Go\u0026rsquo;s table-driven tests.\n","permalink":"https://justroham.ir/glossary/parametrized-test/","summary":"one test body run over many input rows","title":"Parametrized test"},{"content":"With --filter=blob:none Git keeps the full commit history but downloads file contents only when needed, from a promisor remote that allows filters. Offline, a missing blob is an error. Often combined with sparse checkout.\n","permalink":"https://justroham.ir/glossary/partial-clone/","summary":"A clone that skips some objects (e.g. file contents) and fetches them on demand.","title":"Partial clone"},{"content":"In a distributed system a call can fail in the request, in the server or in the reply. A timeout looks the same in all three cases, so the caller does not know whether the operation was applied.\n","permalink":"https://justroham.ir/glossary/partial-failure/","summary":"One part of a system fails while the rest keeps running, so the caller cannot tell what happened.","title":"Partial failure"},{"content":"A partial index is built with a WHERE clause and contains only matching rows. Combined with UNIQUE it enforces rules such as \u0026ldquo;at most one open order per customer\u0026rdquo; while allowing many rows with other statuses.\n","permalink":"https://justroham.ir/glossary/partial-index/","summary":"An index that covers only the rows matching a WHERE condition.","title":"Partial index"},{"content":"The planner skipping partitions that cannot contain matching rows because the query filters on the partition key. Without a condition on the partition key every partition must be scanned. Pruning is controlled by the setting enable_partition_pruning. See partitioning.\n","permalink":"https://justroham.ir/glossary/partition-pruning/","summary":"The planner skipping partitions that cannot contain matching rows because the query filters on the partition key.","title":"Partition pruning"},{"content":"Unlike a fast hash such as SHA-256, a password hash is tuned to cost real time (and memory) per guess. Use bcrypt or argon2id, never a plain fast hash.\n","permalink":"https://justroham.ir/glossary/password-hashing/","summary":"A deliberately slow, salted one-way function used to store passwords so a database leak does not reveal them.","title":"Password hashing"},{"content":"After Find(x) discovers the root, path compression rewrites the parent of every node it passed to be that root. The work is paid once and makes the next Finds on the same nodes one hop long.\n","permalink":"https://justroham.ir/glossary/path-compression/","summary":"During Find, point every node on the path straight at the root so later Finds are shorter.","title":"Path compression"},{"content":"Joining user input to a base directory is not enough, because the joined path is cleaned and can climb out. Check the result against the base, or better use os.OpenRoot, which also stops symlinks that point outside.\n","permalink":"https://justroham.ir/glossary/path-traversal/","summary":"A bug where \u003ccode\u003e../\u003c/code\u003e in user input makes a file handler read outside its intended directory.","title":"Path traversal"},{"content":"Unlike a salt, a pepper is secret and shared by all users. It adds key management work, so it is an extra layer, not a replacement for a slow hash.\n","permalink":"https://justroham.ir/glossary/pepper/","summary":"A secret value kept outside the database and mixed into password hashing, so a stolen database alone is not enough.","title":"Pepper"},{"content":"Percentiles show the tail that the mean hides. From histogram buckets they are estimates, and the error depends on how wide the buckets are.\n","permalink":"https://justroham.ir/glossary/percentile/","summary":"The value below which a given share of observations fall; p99 is the latency 99% of requests beat.","title":"Percentile"},{"content":"perf has perf stat to count events (cycles, instructions, context switches) and perf record plus perf report to sample stacks over time. Sampling costs less than tracing every call, and the samples can be drawn as a flame-graph.\n","permalink":"https://justroham.ir/glossary/perf/","summary":"Linux performance tool that counts hardware events and samples where CPU time goes.","title":"perf"},{"content":"Many client connections share a few server connections. In session mode a client keeps one server connection for its whole session; in transaction mode it borrows one only for the length of a transaction, so session state does not carry over between transactions.\n","permalink":"https://justroham.ir/glossary/pgbouncer/","summary":"A separate connection pooler placed between applications and PostgreSQL.","title":"PgBouncer"},{"content":"A row that matches your WHERE clause was inserted (or removed) and committed by someone else in between. The rows you already read did not change, new ones appeared.\n","permalink":"https://justroham.ir/glossary/phantom-read/","summary":"Running the same query twice in one transaction and getting a different set of rows.","title":"Phantom read"},{"content":"pickle turns a Python object into bytes and back. multiprocessing pickles every argument and result it sends to another process, so they must be picklable (a lambda is not) and big objects cost time and bytes.\n","permalink":"https://justroham.ir/glossary/pickle/","summary":"Python\u0026rsquo;s built-in serialization of objects to bytes, used to send data between processes.","title":"pickle"},{"content":"pip install requests installs a package and its dependencies into the active environment; pip freeze lists exact versions.\n","permalink":"https://justroham.ir/glossary/pip/","summary":"Python\u0026rsquo;s standard package installer, which downloads packages from PyPI.","title":"pip"},{"content":"Connects one command\u0026rsquo;s stdout to the next command\u0026rsquo;s stdin (a | b), so small tools chain into a pipeline.\n","permalink":"https://justroham.ir/glossary/pipe/","summary":"Connects one command’s stdout to the next command’s stdin (\u003ccode\u003ea | b\u003c/code\u003e), so small tools chain into a pipeline.","title":"Pipe"},{"content":"You need a base backup and every WAL segment since it. The target can be a timestamp, a named restore point created with pg_create_restore_point, an LSN or a transaction id. It is the tool for undoing a bad DELETE, which a replica cannot do.\n","permalink":"https://justroham.ir/glossary/pitr/","summary":"Point-in-time recovery: restore a base backup and replay archived WAL up to a chosen moment.","title":"PITR"},{"content":"The client makes a random verifier, sends its SHA-256 (the challenge) in the authorization request and the verifier itself in the token request. A stolen code is useless without the verifier.\n","permalink":"https://justroham.ir/glossary/pkce/","summary":"Proof Key for Code Exchange: the client proves at the token request that it is the one that started the authorization request.","title":"PKCE"},{"content":"They include distinct counts, most common values, histograms and correlation, visible in pg_stats. Stale or missing statistics lead to bad row estimates and bad plans.\n","permalink":"https://justroham.ir/glossary/planner-statistics/","summary":"Per-column summaries that \u003ccode\u003eANALYZE\u003c/code\u003e stores for the planner.","title":"Planner statistics"},{"content":"Everyday commands like add and commit are called porcelain. Plumbing commands do one small job and are handy for learning how Git works.\n","permalink":"https://justroham.ir/glossary/plumbing/","summary":"Git\u0026rsquo;s low-level commands (hash-object, write-tree, commit-tree\u0026hellip;) that porcelain commands are built on.","title":"plumbing"},{"content":"Without a delivery limit it blocks or loops forever; the usual fix is a max-deliver count and a dead-letter destination.\n","permalink":"https://justroham.ir/glossary/poison-message/","summary":"A message that makes its consumer fail every time, so redelivery never succeeds.","title":"Poison message"},{"content":"In a polyrepo layout every project has its own repository, history, CI and access rules. Shared code is consumed as a versioned dependency, so a cross-cutting change needs one pull request per repository. See also monorepo.\n","permalink":"https://justroham.ir/glossary/polyrepo/","summary":"Each service or library lives in its own repository and is released and versioned on its own.","title":"Polyrepo"},{"content":"A postmortem is written after an incident from evidence (logs, metrics, chat). Its goal is learning and concrete action items, not blame.\n","permalink":"https://justroham.ir/glossary/postmortem/","summary":"A written review of an incident: what happened, its impact, why, and what to change.","title":"Postmortem"},{"content":"It needs only two load readings per request, yet in a simulation (see the post) it stays close to always picking the least loaded instance and far better than random.\n","permalink":"https://justroham.ir/glossary/power-of-two-choices/","summary":"Load balancing rule: pick two random instances and send the request to the one with the shorter queue.","title":"Power of two choices"},{"content":"Those endpoints reveal internals, so they belong on a loopback or admin listener, not on the public mux.\n","permalink":"https://justroham.ir/glossary/pprof/","summary":"Go\u0026rsquo;s profiling tool and the \u003ccode\u003enet/http/pprof\u003c/code\u003e handlers that expose profiles over HTTP.","title":"pprof"},{"content":"The server answers with Access-Control-Allow-* headers; Access-Control-Max-Age lets the browser cache the answer.\n","permalink":"https://justroham.ir/glossary/preflight/","summary":"An OPTIONS request a browser sends first to ask whether a cross-origin request with a custom method or header is allowed.","title":"Preflight request"},{"content":"It survives a restart and keeps its locks until someone finishes it. It is the building block for two-phase commit managed by an external transaction manager.\n","permalink":"https://justroham.ir/glossary/prepared-transaction/","summary":"In PostgreSQL, a transaction detached from its session by PREPARE TRANSACTION, stored on disk and finished later by COMMIT PREPARED or ROLLBACK PREPARED.","title":"Prepared transaction"},{"content":"A primary key is unique and never NULL, so one value always points at exactly one row. It can span several columns, like (order_id, product_id) in order_items.\n","permalink":"https://justroham.ir/glossary/primary-key/","summary":"The column(s) that identify each row uniquely.","title":"Primary key"},{"content":"Messages go to subjects such as notify.high.sms and notify.low.sms, and the worker asks the high consumer first. The risk is starvation of the low lane, so keep a share of capacity for it.\n","permalink":"https://justroham.ir/glossary/priority-lane/","summary":"A separate queue or consumer per priority, served in strict order so urgent messages never wait behind a backlog.","title":"Priority lane"},{"content":"A priority queue supports Push and Pop, where Pop returns the most urgent item (smallest or largest key). It is an interface, not a layout; the usual implementation is a binary heap. Equal priorities have no defined order unless you add a tie-break such as a sequence number.\n","permalink":"https://justroham.ir/glossary/priority-queue/","summary":"An abstract container where you always remove the item with the highest priority first, not the oldest.","title":"Priority queue"},{"content":"A running instance of a program, with its own pid, memory and a parent process. A process is created by its parent (fork or spawn) and ends with an exit status that the parent can read with wait.\n","permalink":"https://justroham.ir/glossary/process/","summary":"A running instance of a program, with its own pid, memory and a parent process.","title":"Process"},{"content":"A set of related processes (for example a pipeline) that can receive a signal together. Send a signal to the whole group with kill -- -PGID. A new session (setsid) starts a new group.\n","permalink":"https://justroham.ir/glossary/process-group/","summary":"A set of related processes (for example a pipeline) that can receive a signal together.","title":"Process group"},{"content":"A bash/zsh feature, \u0026lt;(cmd), that presents a command\u0026rsquo;s output as a file name, so tools that want files can read it (diff \u0026lt;(a) \u0026lt;(b)). Not POSIX.\n","permalink":"https://justroham.ir/glossary/process-substitution/","summary":"A bash/zsh feature, \u003ccode\u003e\u0026lt;(cmd)\u003c/code\u003e, that presents a command’s output as a file name, so tools that want files can read it (\u003ccode\u003ediff \u0026lt;(a) \u0026lt;(b)\u003c/code\u003e). Not POSIX.","title":"Process substitution"},{"content":"Linux\u0026rsquo;s virtual /proc filesystem. Its files are not stored on disk; the kernel generates them when read. For example /proc/self/status describes your own process.\n","permalink":"https://justroham.ir/glossary/procfs/","summary":"Linux\u0026rsquo;s virtual /proc filesystem, where the kernel exposes process and system state as files.","title":"procfs"},{"content":"A checkpoint records the last event position processed, so a restart continues where it stopped.\n","permalink":"https://justroham.ir/glossary/projection/","summary":"A read model built by consuming events and maintaining a table shaped for queries; it can be dropped and rebuilt by replay.","title":"Projection"},{"content":"A selection of public projects. Many of them are hands-on practice for concepts I wanted to understand deeply.\nquant-core Rust — A high-performance market analysis engine for price action detection, fractal pattern recognition and multi-timeframe market structure. Currently focused on XAUUSD and EURUSD, designed to support any instrument.\ngo-gold-analyzer Go — Automated technical analysis for gold futures. Pulls Yahoo Finance data every minute, computes RSI, MACD and ATR, and emits BUY / SELL / HOLD signals with file logging.\ngo-nats-demo Go — Publisher and worker services on NATS JetStream with durable subscriptions, connection retry and the management dashboard, all via Docker.\ngo-kafka-first Go — Hands-on Kafka practice: topics, partitions, offsets and consumer groups, running on KRaft with Kafka UI via Docker Compose.\nnestjs-structure TypeScript — A NestJS project structure with environment-based configuration (default, development, production, test).\nGo concurrency notes Small experiments on goroutines and context: go-goroutine-01, go-context-01, go-connectivity-test.\n","permalink":"https://justroham.ir/projects/","summary":"\u003cp\u003eA selection of public projects. Many of them are hands-on practice for concepts I wanted to understand deeply.\u003c/p\u003e\n\u003ch2 id=\"quant-core\"\u003e\u003ca href=\"https://github.com/h-agharezaei/quant-core\"\u003equant-core\u003c/a\u003e\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eRust\u003c/strong\u003e — A high-performance market analysis engine for price action detection, fractal pattern recognition and multi-timeframe market structure. Currently focused on XAUUSD and EURUSD, designed to support any instrument.\u003c/p\u003e\n\u003ch2 id=\"go-gold-analyzer\"\u003e\u003ca href=\"https://github.com/h-agharezaei/go-gold-analyzer\"\u003ego-gold-analyzer\u003c/a\u003e\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eGo\u003c/strong\u003e — Automated technical analysis for gold futures. Pulls Yahoo Finance data every minute, computes RSI, MACD and ATR, and emits BUY / SELL / HOLD signals with file logging.\u003c/p\u003e","title":"Projects"},{"content":"A promise settles once, to a value or to an error. You attach work with .then and .catch, or wait for it with async/await; the callbacks run as microtasks.\n","permalink":"https://justroham.ir/glossary/promise/","summary":"A value that stands for a result that is not ready yet: pending, then fulfilled or rejected.","title":"Promise"},{"content":"Instead of fixed examples you state a property (for example, reversing twice gives the original) and the tool generates many random inputs to look for a counterexample. Go has testing/quick and the library rapid.\n","permalink":"https://justroham.ir/glossary/property-based-testing/","summary":"Testing a rule that must hold for all inputs, with inputs generated automatically.","title":"Property-based testing"},{"content":"Protocol Buffers (protobuf) encode a message as a list of field number and value pairs, not field names, so messages are small and tolerant of added fields. gRPC uses it as its default message format.\n","permalink":"https://justroham.ir/glossary/protobuf/","summary":"A compact binary format for structured messages, described in .proto files.","title":"Protocol Buffers"},{"content":"It usually comes from recursive merge or copy code that trusts keys from JSON. Validating input into a fresh object with a known shape removes the keys you did not declare.\n","permalink":"https://justroham.ir/glossary/prototype-pollution/","summary":"A JavaScript bug where attacker-controlled keys like \u003cstrong\u003eproto\u003c/strong\u003e change the prototype of objects, so unrelated objects suddenly get extra properties.","title":"Prototype pollution"},{"content":"ptrace is the Linux system call a tracer uses to stop a tracee, read its registers and memory, and resume it. According to the man page, attaching needs permission, for example CAP_SYS_PTRACE for other users\u0026rsquo; processes.\n","permalink":"https://justroham.ir/glossary/ptrace/","summary":"The system call that lets one process observe and control another; strace and debuggers use it.","title":"ptrace"},{"content":"The client requests a batch (or one message) and processes it at its own pace, so it is naturally protected from being overwhelmed. It is the recommended style for workers.\n","permalink":"https://justroham.ir/glossary/pull-consumer/","summary":"A JetStream consumer where the client asks for messages instead of the server pushing them.","title":"Pull consumer"},{"content":"Pydantic builds models from classes with type annotations. Model.model_validate(data) checks and converts the data (lax mode turns \u0026quot;5\u0026quot; into 5) and raises ValidationError with a list of errors. FastAPI uses it for request and response bodies.\n","permalink":"https://justroham.ir/glossary/pydantic/","summary":"A Python library that validates and converts data using type hints.","title":"Pydantic"},{"content":"With PyO3 you mark Rust functions and structs with #[pyfunction], #[pyclass] and #[pymodule], and a build tool such as maturin turns the crate into an importable Python module. Argument conversion and error-to-exception mapping are generated for you.\n","permalink":"https://justroham.ir/glossary/pyo3/","summary":"A Rust library for writing Python extension modules (and calling Python from Rust).","title":"PyO3"},{"content":"It plays the role that npm\u0026rsquo;s registry plays for Node.js.\n","permalink":"https://justroham.ir/glossary/pypi/","summary":"The Python Package Index, the default public registry that pip and uv download from.","title":"PyPI"},{"content":"Roughly the counterpart of package.json in Node.js or go.mod in Go. uv keeps it in sync when you run uv add.\n","permalink":"https://justroham.ir/glossary/pyproject-toml/","summary":"The standard Python project file with metadata, the required Python version and direct dependencies.","title":"pyproject.toml"},{"content":"The planner estimates a cost for each possible way to run the query (scan the table, use an index, which join order) and picks the cheapest. EXPLAIN shows the plan; EXPLAIN ANALYZE also runs the query and adds the real row counts.\n","permalink":"https://justroham.ir/glossary/query-plan/","summary":"The tree of steps the database chooses to run a query, shown by EXPLAIN.","title":"Query plan"},{"content":"It estimates the cost of candidate plans from statistics and picks the cheapest. EXPLAIN shows the chosen plan.\n","permalink":"https://justroham.ir/glossary/query-planner/","summary":"The part of the database that chooses how to run a query.","title":"Query planner"},{"content":"A first-in, first-out collection: add at the back, remove from the front. Usually built on a ring buffer.\n","permalink":"https://justroham.ir/glossary/queue/","summary":"A first-in, first-out collection: add at the back, remove from the front. Usually built on a ring buffer.","title":"Queue"},{"content":"In core NATS the server picks a member per message; subscribers outside the group still get their own copy.\n","permalink":"https://justroham.ir/glossary/queue-group/","summary":"Subscribers that share a name so each message goes to only one member of the group.","title":"Queue group"},{"content":"Quicksort picks a pivot, moves smaller items to its left and larger to its right, then sorts each side. It needs no extra array, but a bad pivot (for example always the first item on sorted input) degrades it to O(n^2). Median-of-three pivots and an insertion-sort cutoff for small ranges are the usual guards. It is not stable.\n","permalink":"https://justroham.ir/glossary/quicksort/","summary":"Pick a pivot, partition the slice around it, then sort both sides recursively; O(n log n) on average, in place.","title":"Quicksort"},{"content":"With 3 replicas a quorum is 2. The overlap is why a minority side of a partition cannot make progress alone. See network partition.\n","permalink":"https://justroham.ir/glossary/quorum/","summary":"A group of replicas whose agreement is required, usually a strict majority, so that any two quorums overlap.","title":"Quorum"},{"content":"Rabin–Karp slides a window over the text, updating a rolling hash in O(1). A hash match can be a collision, so it must be verified. It extends naturally to many patterns of the same length.\n","permalink":"https://justroham.ir/glossary/rabin-karp/","summary":"String search that compares hashes of windows first and verifies real text only when hashes are equal.","title":"Rabin–Karp"},{"content":"A data race happens when two goroutines access the same variable at the same time and at least one writes. The outcome is undefined and often appears only under load. Go ships a detector: run tests or the program with go test -race or go run -race.\n","permalink":"https://justroham.ir/glossary/race-condition/","summary":"A bug where the result depends on the unsynchronized timing of concurrent accesses.","title":"Race condition"},{"content":"Raft was described by Ongaro and Ousterhout. Time is split into terms; each term has at most one leader, and only the leader appends to the log.\n","permalink":"https://justroham.ir/glossary/raft/","summary":"A consensus algorithm built from leader election, log replication and safety rules, designed to be easier to understand than Paxos.","title":"Raft"},{"content":"Rate limiting protects a service from overload and from one noisy client. It answers allow or reject (often HTTP 429) per key, such as a client or tenant.\n","permalink":"https://justroham.ir/glossary/rate-limiting/","summary":"Capping how many requests a client may make in a time span.","title":"Rate limiting"},{"content":"In RBAC a user has a role (viewer, editor, admin) and each role maps to a set of permissions such as doc:delete. Code checks permissions, not role names, so roles can change without touching handlers.\n","permalink":"https://justroham.ir/glossary/rbac/","summary":"Role-based access control: users get roles, roles map to permissions.","title":"RBAC"},{"content":"RCE is among the most severe vulnerability classes because it often leads to full compromise. Common causes are unsafe deserialization, command or template injection and unchecked file uploads. Mitigation: patch quickly, run with least privilege and restrict network exposure.\n","permalink":"https://justroham.ir/glossary/rce/","summary":"Remote Code Execution: an attacker runs their own code on your server.","title":"RCE"},{"content":"In CQRS and event sourcing the read model is a projection of the event log. If it is deleted it can be rebuilt by folding the log again, so a correct read model always equals the fold of the log once the events have all arrived.\n","permalink":"https://justroham.ir/glossary/read-model/","summary":"A copy of the data shaped for queries, built by applying the events of the write side; it may lag behind but must converge.","title":"Read model"},{"content":"A cheap way to heal replicas using traffic you already have. Keys that are never read stay stale, so it needs anti-entropy next to it.\n","permalink":"https://justroham.ir/glossary/read-repair/","summary":"When a read finds a replica holding an older version, the reader writes the newest version back to it.","title":"Read repair"},{"content":"A session guarantee. A common fix is a session token holding the version the client last wrote; a replica that is behind it is skipped and the read goes to the leader.\n","permalink":"https://justroham.ir/glossary/read-your-writes/","summary":"After a client writes a value, its own later reads see that value or a newer one.","title":"Read-your-writes"},{"content":"Rebase takes the commits of your branch and re-applies them one by one on top of another commit. The result is a straight line of history, but every replayed commit is a new object, so its hash changes. That is why rebasing commits others already have is dangerous.\n","permalink":"https://justroham.ir/glossary/rebase/","summary":"replays your commits on top of another base, producing new commits with new hashes.","title":"rebase"},{"content":"Your program asks a recursive resolver (for example a public one or your ISP\u0026rsquo;s). It walks from the root to the TLD to the authoritative server and returns the final answer, caching along the way.\n","permalink":"https://justroham.ir/glossary/recursive-resolver/","summary":"A DNS server that does the whole lookup for a client and caches the result.","title":"Recursive resolver"},{"content":"A ref is a file under .git/refs/ (branches, tags, remote-tracking branches) whose content is an object id. git for-each-ref lists them all and git update-ref writes them. A symbolic ref points to another ref instead of an id.\n","permalink":"https://justroham.ir/glossary/git-ref/","summary":"a human-readable name that points to a Git object.","title":"Ref"},{"content":"Refactoring means rewriting the inside (names, functions, nesting) while every input still produces the same output. If behavior changes on purpose, that is a different change and belongs in a different commit. Without tests that pin the behavior you cannot know which one you did.\n","permalink":"https://justroham.ir/glossary/refactoring/","summary":"Changing the structure of code without changing its observable behavior.","title":"Refactoring"},{"content":"It counters optimism: instead of asking how long our plan takes, ask how long projects like this usually took.\n","permalink":"https://justroham.ir/glossary/reference-class-forecasting/","summary":"Forecasting by looking at the outcomes of similar past projects, not at the details of this one.","title":"Reference-class forecasting"},{"content":"git reflog lists entries like HEAD@{1}. It is local to your clone, not pushed, and old entries expire (according to the docs, 90 days if reachable, 30 if not). It only knows about committed work. See git reset.\n","permalink":"https://justroham.ir/glossary/reflog/","summary":"A local log of where HEAD and branch tips have pointed, used to recover commits after a reset or deleted branch.","title":"reflog"},{"content":"With rotation every use returns a new refresh token and invalidates the old one. If an old one shows up again, the server can treat it as theft and revoke the whole family.\n","permalink":"https://justroham.ir/glossary/refresh-token/","summary":"A long-lived credential that the client exchanges for a new short-lived access token.","title":"Refresh token"},{"content":"A regression means there is a last good version and a first bad one, which is exactly what git bisect searches between. A test that fails now but passed before is the classic signal.\n","permalink":"https://justroham.ir/glossary/regression/","summary":"A bug that breaks something which used to work.","title":"Regression"},{"content":"The relational model stores facts as rows in tables. Each table has typed columns, and tables are connected by values (keys) rather than by pointers. SQL is the language used to query it.\n","permalink":"https://justroham.ir/glossary/relational-model/","summary":"A model where data lives in tables of rows and columns linked by keys.","title":"Relational model"},{"content":"Updating a vertex\u0026rsquo;s distance when a route through an edge is shorter than the best known.\nFor an edge u to v with weight w: if dist[u] + w is less than dist[v], set dist[v] to it. Dijkstra and Bellman-Ford are both built on this step.\n","permalink":"https://justroham.ir/glossary/relaxation/","summary":"Updating a vertex\u0026rsquo;s distance when a route through an edge is shorter than the best known.","title":"Relaxation"},{"content":"Remote-tracking branches live under .git/refs/remotes/\u0026lt;remote\u0026gt;/ and are updated only by git fetch or git push. They show what the remote looked like the last time you talked to it, not what it looks like now.\n","permalink":"https://justroham.ir/glossary/remote-tracking-branch/","summary":"a local, read-only record of a branch on a remote, like origin/main.","title":"Remote-tracking branch"},{"content":"For every key you score each node with a hash of the pair and pick the highest. Removing a node only moves its own keys. It needs no ring, but a lookup costs O(number of nodes). Compare Consistent hashing.\n","permalink":"https://justroham.ir/glossary/rendezvous-hashing/","summary":"Each key goes to the node with the highest hash(node, key) score (also called HRW).","title":"Rendezvous hashing"},{"content":"An entry is committed once a majority stores it (and, in Raft, the leader\u0026rsquo;s own term rules are met). Only committed entries are applied.\n","permalink":"https://justroham.ir/glossary/replicated-log/","summary":"An ordered list of commands copied to several nodes; if every node applies the same log in order, their state machines end up identical.","title":"Replicated log"},{"content":"In PostgreSQL streaming replication the primary sends its WAL to standbys, which replay it. Standbys serve read-only queries and can be promoted. It is not a backup: bad writes replicate too.\n","permalink":"https://justroham.ir/glossary/replication/","summary":"Keeping a second, continuously updated copy of a database on another server.","title":"Replication"},{"content":"Paths, timestamps and VCS state can leak into a binary and break this. Compare two builds\u0026rsquo; hashes to find out.\n","permalink":"https://justroham.ir/glossary/reproducible-build/","summary":"Building the same source twice gives byte-identical output, so a checksum can prove what was built.","title":"Reproducible build"},{"content":"With a request ID you can pull every log line of one request out of a busy log. It is often accepted from an incoming header (such as x-request-id) and returned to the caller so both sides can quote it.\n","permalink":"https://justroham.ir/glossary/request-id/","summary":"A unique identifier attached to one request and to every log line it produces.","title":"Request ID"},{"content":"It becomes possible when, for example, a proxy and a backend disagree on whether Content-Length or Transfer-Encoding decides the body length. This is only a concept here; the security series will cover defences.\n","permalink":"https://justroham.ir/glossary/request-smuggling/","summary":"An attack that exploits two HTTP parsers disagreeing about where a request ends.","title":"Request smuggling"},{"content":"Enable with rerere.enabled. Git stores the conflict and your fix in .git/rr-cache and fills the file next time the same conflict appears. It does not stage the file.\n","permalink":"https://justroham.ir/glossary/rerere/","summary":"Git feature (reuse recorded resolution) that replays a conflict resolution you made before.","title":"rerere"},{"content":"Each request adds a fraction of a token (for example 0.1) and each retry spends one, so retries stay near 10% of traffic. When the budget is empty the client fails fast instead of piling onto a struggling server.\n","permalink":"https://justroham.ir/glossary/retry-budget/","summary":"A cap on retries as a fraction of normal requests, often kept in a token bucket.","title":"Retry budget"},{"content":"A short outage makes many requests fail; their retries arrive together with new traffic and can keep the server overloaded after the original fault is gone. Backoff with jitter and a retry budget limit it.\n","permalink":"https://justroham.ir/glossary/retry-storm/","summary":"Overload made worse by clients that retry failed requests all at once.","title":"Retry storm"},{"content":"A reverse proxy terminates the client\u0026rsquo;s HTTP connection, reads the request, and sends a new request to a backend. Because it understands HTTP it can route by path, add headers and retry.\n","permalink":"https://justroham.ir/glossary/reverse-proxy/","summary":"A server that receives client requests and forwards them to backends on the client\u0026rsquo;s behalf.","title":"Reverse proxy"},{"content":"In a team an RFC usually means a longer proposal that people review and argue about. Once a decision is made, a short ADR can record the outcome.\n","permalink":"https://justroham.ir/glossary/rfc/","summary":"Request for Comments: a proposal document circulated for discussion before a decision is made.","title":"RFC"},{"content":"A fixed array with a head index and a count where positions wrap around with modulo, so removing from the front never shifts elements. When full it can double (copying once) to keep amortized O(1) pushes.\n","permalink":"https://justroham.ir/glossary/ring-buffer/","summary":"A fixed array with a head index and a count where positions wrap around with modulo, so removing from the front never shifts elements. When full it can double (copying once) to keep amortized O(1) pushes.","title":"Ring buffer"},{"content":"Rolling forward means shipping a fix as a new version rather than going back to the previous one. It is the usual answer when a rollback is unsafe, for example after data was written in a new format.\n","permalink":"https://justroham.ir/glossary/roll-forward/","summary":"fixing a bad release with a new release instead of reverting.","title":"Roll forward"},{"content":"It is easy for code and hard for data: a destructive migration cannot be undone by redeploying old code.\n","permalink":"https://justroham.ir/glossary/rollback/","summary":"Returning production to the previous known-good release, as opposed to rolling forward with a new fix.","title":"Rollback"},{"content":"With base b and modulus q the update is h = ((h - old * b^(m-1)) * b + new) mod q. Equal windows always give equal hashes; different windows may too (a collision).\n","permalink":"https://justroham.ir/glossary/rolling-hash/","summary":"A hash of a sliding window that is updated in O(1) by removing the old character and adding the new one.","title":"Rolling hash"},{"content":"A rolling update replaces the old version instance by instance, usually waiting for a readiness check before moving on. Old and new versions serve traffic together while it runs.\n","permalink":"https://justroham.ir/glossary/rolling-update/","summary":"a deploy that replaces instances one by one.","title":"Rolling update"},{"content":"RSS is the part of a process that is really in RAM. It differs from the virtual size (VSZ) and is usually the more useful number when looking at memory use.\n","permalink":"https://justroham.ir/glossary/rss/","summary":"Resident set size: the part of a process\u0026rsquo;s memory currently held in physical RAM, not its whole virtual size.","title":"RSS"},{"content":"FIN says \u0026ldquo;I am done sending\u0026rdquo; and is delivered in order; RST says \u0026ldquo;this connection is dead\u0026rdquo;. The peer sees ECONNRESET, and a connect to a closed port on loopback is answered with RST (connection refused).\n","permalink":"https://justroham.ir/glossary/tcp-rst/","summary":"A TCP segment that aborts a connection immediately, without the orderly FIN exchange.","title":"RST"},{"content":"A runbook answers \u0026ldquo;what do I do now?\u0026rdquo; during an incident: which command to run, what to check, who to call. It changes whenever the operation changes.\n","permalink":"https://justroham.ir/glossary/runbook/","summary":"Step-by-step instructions for operating a system and handling a known failure.","title":"Runbook"},{"content":"Persian letters take two bytes each in UTF-8, so indexing by byte splits letters.\n","permalink":"https://justroham.ir/glossary/rune/","summary":"In Go, an int32 holding one Unicode code point; a string is bytes, and one character can be several bytes.","title":"Rune"},{"content":"A saga gives up isolation: other readers can see the intermediate states. It can be run by an orchestrator that keeps a persisted state machine, or by services reacting to each other\u0026rsquo;s events (choreography).\n","permalink":"https://justroham.ir/glossary/saga/","summary":"A long business transaction split into local transactions, each with a compensating action that undoes it if a later step fails.","title":"Saga"},{"content":"The salt is not secret. It stops precomputed tables and makes the attacker work on each account separately.\n","permalink":"https://justroham.ir/glossary/salt/","summary":"A random value stored next to a password hash so equal passwords give different hashes.","title":"Salt"},{"content":"Lax skips the cookie on cross-site POSTs and sub-requests but sends it on normal top-level navigation; Strict is tighter; None needs Secure.\n","permalink":"https://justroham.ir/glossary/samesite/","summary":"A cookie attribute that limits when the browser sends the cookie on cross-site requests.","title":"SameSite"},{"content":"email = 'a' is sargable; lower(email) = 'a' is not unless an index on lower(email) exists. Casting the column or a leading % also breaks it.\n","permalink":"https://justroham.ir/glossary/sargable/","summary":"A condition written so an index can be used for it.","title":"Sargable"},{"content":"SAVEPOINT s1 marks the point and ROLLBACK TO s1 undoes everything after it; the transaction stays open and usable.\n","permalink":"https://justroham.ir/glossary/savepoint/","summary":"A named point inside a transaction that you can roll back to without abandoning the whole transaction.","title":"Savepoint"},{"content":"Formats such as CycloneDX and SPDX describe names, versions and hashes. When a new flaw is announced, an SBOM lets you search what you ship instead of guessing.\n","permalink":"https://justroham.ir/glossary/sbom/","summary":"Software Bill of Materials: a machine-readable list of the components inside a build.","title":"SBOM"},{"content":"The cost grows with the number of shards: every query makes one request per shard, and the slowest shard decides the latency. Queries that include the shard key go to one shard instead.\n","permalink":"https://justroham.ir/glossary/scatter-gather/","summary":"Sending a query to every shard and merging the partial answers, needed when the query does not contain the shard key.","title":"Scatter-gather"},{"content":"A schema describes what valid input looks like; parsing either returns clean data or a list of issues. Libraries such as Zod do this in code instead of a separate schema file.\n","permalink":"https://justroham.ir/glossary/schema-validation/","summary":"Checking untrusted data against a declared shape (types, ranges, required fields) at the boundary, before the rest of the code uses it.","title":"Schema validation"},{"content":"uv build produces a .tar.gz sdist and a .whl wheel side by side. Installers prefer a matching wheel and fall back to the sdist.\n","permalink":"https://justroham.ir/glossary/sdist/","summary":"The source distribution of a Python package: an archive of the sources plus metadata, built into a wheel at install time if needed.","title":"sdist"},{"content":"In Go a seam is often a function variable (var now = time.Now), a small interface or a parameter. Tests replace what is behind the seam, such as the clock or the database.\n","permalink":"https://justroham.ir/glossary/seam/","summary":"A place where you can change behavior without editing the code around it.","title":"Seam"},{"content":"A scanner matches known formats (like cloud key prefixes) and flags random-looking strings by Shannon entropy. It trades false positives for coverage. Real tools include gitleaks and trufflehog.\n","permalink":"https://justroham.ir/glossary/secret-scanning/","summary":"Searching code and git history for credentials by pattern and entropy.","title":"Secret scanning"},{"content":"A seed corpus is a small set of valid inputs (in Go, f.Add and files under testdata/fuzz). The fuzzer mutates them, so good seeds reach deep code quickly. Failing inputs are saved there and replayed by plain go test.\n","permalink":"https://justroham.ir/glossary/seed-corpus/","summary":"The starting inputs given to a fuzzer, ideally real samples.","title":"Seed corpus"},{"content":"A condition matching 0.1% of rows is highly selective and favors an index; one matching 70% is not, and a sequential scan is usually cheaper.\n","permalink":"https://justroham.ir/glossary/selectivity/","summary":"The fraction of rows a condition keeps.","title":"Selectivity"},{"content":"A counter-based primitive that lets at most N holders in at once; the rest wait. Use it to cap concurrency, for example at most 3 requests in flight. In asyncio it is asyncio.Semaphore(3) used with async with.\n","permalink":"https://justroham.ir/glossary/semaphore/","summary":"A counter-based primitive that lets at most N holders in at once; the rest wait.","title":"Semaphore"},{"content":"By convention a patch release fixes bugs, a minor release adds features compatibly, and a major release may break the API. A range such as ^1.2.3 accepts any version from 1.2.3 up to, but not including, 2.0.0.\n","permalink":"https://justroham.ir/glossary/semver/","summary":"A versioning scheme MAJOR.MINOR.PATCH, plus the range syntax (\u003ccode\u003e^\u003c/code\u003e, \u003ccode\u003e~\u003c/code\u003e) npm uses to pick versions.","title":"Semver"},{"content":"Weaker than linearizability: a read may return an older value than a write that already finished on another client, as long as one legal global order exists.\n","permalink":"https://justroham.ir/glossary/sequential-consistency/","summary":"All clients see one order of operations that keeps each client\u0026rsquo;s own order, but it need not match real time.","title":"Sequential consistency"},{"content":"The server keeps a response open with Content-Type: text/event-stream and writes data: lines; the browser\u0026rsquo;s EventSource reconnects by itself. The client cannot send messages on that channel.\n","permalink":"https://justroham.ir/glossary/server-sent-events/","summary":"A one-way, text-based stream of events from server to browser over a normal HTTP response.","title":"Server-Sent Events"},{"content":"Instances start, crash and move, so addresses cannot be hard-coded. Clients ask DNS, a registry or a message bus who is alive now.\n","permalink":"https://justroham.ir/glossary/service-discovery/","summary":"Finding the current network addresses of the instances of a service while they come and go.","title":"Service discovery"},{"content":"Envoy, Istio and Linkerd are well-known examples. The cost is another moving part per instance.\n","permalink":"https://justroham.ir/glossary/service-mesh/","summary":"A layer of sidecar proxies next to each service that handles discovery, load balancing, retries and TLS outside the application code.","title":"Service mesh"},{"content":"If an instance stops renewing, its entry expires after the TTL. Between the crash and the expiry the registry is stale.\n","permalink":"https://justroham.ir/glossary/service-registry/","summary":"A small service that stores which instances are alive; instances register with a TTL and keep renewing it.","title":"Service registry"},{"content":"The browser only holds an unguessable id; the server holds who the user is. Deleting the server entry ends the session at once.\n","permalink":"https://justroham.ir/glossary/session/","summary":"Server-side state that is looked up by a random id stored in a cookie.","title":"Session"},{"content":"Mode bits that make an executable run with its owner\u0026rsquo;s (or group\u0026rsquo;s) identity instead of the caller\u0026rsquo;s; on a directory, setgid makes new files inherit its group. They show as s in ls -l.\n","permalink":"https://justroham.ir/glossary/setuid/","summary":"Mode bits that make an executable run with its owner\u0026rsquo;s (or group\u0026rsquo;s) identity instead of the caller\u0026rsquo;s; on a directory, setgid makes new files inherit its group. They show as s in ls -l.","title":"setuid and setgid"},{"content":"Git runs the content (with a type and size header) through SHA-1 and uses the digest as the object id. Newer repositories can use SHA-256 instead, with 64 hex characters.\n","permalink":"https://justroham.ir/glossary/sha-1/","summary":"Hash function Git uses by default to name objects (40 hex characters).","title":"SHA-1"},{"content":"It shows how the new code would behave before any user depends on it. The mismatches are a to-do list: each one is either a bug in the new code or a quirk of the old one you must decide about.\n","permalink":"https://justroham.ir/glossary/shadow-mode/","summary":"Running the new implementation next to the old one on real inputs, serving only the old answer and counting differences.","title":"Shadow mode"},{"content":"git clone --depth 1 downloads only the latest commit. It is fast and small, but history commands see little. git fetch --unshallow restores the rest. See also partial clone.\n","permalink":"https://justroham.ir/glossary/shallow-clone/","summary":"A clone with truncated history, e.g. git clone \u0026ndash;depth 1.","title":"Shallow clone"},{"content":"A copy that duplicates only the outer container; the elements inside are still the same objects. A deep copy duplicates them too.\n","permalink":"https://justroham.ir/glossary/shallow-copy/","summary":"A copy that duplicates only the outer container; the elements inside are still the same objects. A deep copy duplicates them too.","title":"Shallow copy"},{"content":"Random keys use many different characters evenly, so their entropy is high; ordinary words score lower. Scanners use it to flag key-like strings, at the cost of false positives such as checksums.\n","permalink":"https://justroham.ir/glossary/shannon-entropy/","summary":"A measure of how random a string looks, in bits per character.","title":"Shannon entropy"},{"content":"Each row (or key) belongs to exactly one shard, chosen by range, hash or a lookup directory. It adds write capacity and room for data, but queries and transactions that span shards become expensive. It differs from partitioning inside one database node.\n","permalink":"https://justroham.ir/glossary/sharding/","summary":"Splitting one dataset across several nodes by a shard key, so each node owns only part of the data.","title":"Sharding"},{"content":"Normally each process has its own memory. A shared memory block is mapped by several, so no copying or pickling is needed, but you must synchronize access yourself and release it (in Python: close() in each process, unlink() once).\n","permalink":"https://justroham.ir/glossary/shared-memory/","summary":"A block of memory that several processes map at once, so they can read and write the same bytes without copying.","title":"shared memory"},{"content":"A SharedArrayBuffer is not copied between worker threads: all of them see the same bytes. Plain reads and writes on it can race, so use Atomics (for example Atomics.add) for indivisible updates.\n","permalink":"https://justroham.ir/glossary/shared-array-buffer/","summary":"A memory block visible to several threads at once, used with Atomics.","title":"SharedArrayBuffer"},{"content":"When a property fails on a large random input, the library tries smaller variants and keeps the smallest that still fails. You debug [0 1 0] instead of a 37-element slice.\n","permalink":"https://justroham.ir/glossary/shrinking/","summary":"Reducing a failing random input to the smallest one that still fails.","title":"Shrinking"},{"content":"The forced kill (signal 9); it cannot be caught or ignored, so no cleanup code runs. Use it only after SIGTERM failed. A shell reports exit status 137 (128+9).\n","permalink":"https://justroham.ir/glossary/sigkill/","summary":"The forced kill (signal 9); it cannot be caught or ignored, so no cleanup code runs.","title":"SIGKILL"},{"content":"A small asynchronous message the kernel or another process sends to a process, such as SIGTERM or SIGINT. A process may catch most signals with a handler (trap in shell), ignore them, or take the default action. SIGKILL and SIGSTOP cannot be caught.\n","permalink":"https://justroham.ir/glossary/signal/","summary":"A small asynchronous message the kernel or another process sends to a process, such as SIGTERM or SIGINT.","title":"Signal"},{"content":"The signal a process gets when it writes to a pipe whose reader has closed (signal 13). It is why yes | head -1 stops: yes is ended by SIGPIPE and the pipeline status shows 141.\n","permalink":"https://justroham.ir/glossary/sigpipe/","summary":"The signal a process gets when it writes to a pipe whose reader has closed (signal 13).","title":"SIGPIPE"},{"content":"Orchestrators send it before the unstoppable SIGKILL. In Node.js you handle it with process.once('SIGTERM', ...).\n","permalink":"https://justroham.ir/glossary/sigterm/","summary":"The polite signal that asks a process to stop, which it may catch to clean up first.","title":"SIGTERM"},{"content":"Every virtual environment has its own, which is why a package installed in one is not importable from another.\n","permalink":"https://justroham.ir/glossary/site-packages/","summary":"The folder inside an environment where installed third-party packages are placed.","title":"site-packages"},{"content":"The Go allocator rounds each request up to one of a fixed set of block sizes. That is why a slice\u0026rsquo;s capacity can be larger than the growth formula alone predicts.\n","permalink":"https://justroham.ir/glossary/size-class/","summary":"The Go allocator rounds each request up to one of a fixed set of block sizes. That is why a slice\u0026rsquo;s capacity can be larger than the growth formula alone predicts.","title":"Size class"},{"content":"With FOR UPDATE SKIP LOCKED each worker claims rows nobody else has locked, so several workers can take different jobs from the same table at once. It is meant for queue-like tables, not for general reads, because the result depends on who holds what at that moment.\n","permalink":"https://justroham.ir/glossary/skip-locked/","summary":"A \u003ccode\u003eSELECT ... FOR UPDATE\u003c/code\u003e option that skips rows other sessions have locked instead of waiting, used to build job queues.","title":"SKIP LOCKED"},{"content":"An SLI is a number you can compute from counts, for example good requests divided by all requests. It is the measurement; the target is the SLO.\n","permalink":"https://justroham.ir/glossary/sli/","summary":"Service level indicator: a measured ratio of good events to total events, such as non-5xx requests.","title":"SLI"},{"content":"A Go slice is a three-word header: a pointer to a backing array, a length and a capacity. Copying the header does not copy the elements.\n","permalink":"https://justroham.ir/glossary/slice/","summary":"A Go slice is a three-word header: a pointer to a backing array, a length and a capacity. Copying the header does not copy the elements.","title":"Slice (Go)"},{"content":"The estimate is previous_count * (1 - elapsed/window) + current_count. It needs a few numbers per key, unlike a sliding log that stores every timestamp.\n","permalink":"https://justroham.ir/glossary/sliding-window/","summary":"An approximate limiter that weights the previous fixed window by how much of it still overlaps the last interval.","title":"Sliding window counter"},{"content":"An SLO (service level objective) is the reliability goal. The gap between 100% and the SLO is the error budget.\n","permalink":"https://justroham.ir/glossary/slo/","summary":"A target for a service level indicator over a window, for example 99.5% of requests succeed in 30 days.","title":"SLO"},{"content":"A slow client sends headers or body a few bytes at a time and never finishes, so each connection occupies server resources. Timeouts such as headersTimeout and requestTimeout are the main defence.\n","permalink":"https://justroham.ir/glossary/slowloris/","summary":"A denial-of-service pattern where a client sends a request extremely slowly to hold server connections open.","title":"Slowloris"},{"content":"Typically: start the binary on loopback and request its health endpoint.\n","permalink":"https://justroham.ir/glossary/smoke-test/","summary":"A very small check that the built artifact starts and answers at all, before deeper checks or deploy.","title":"Smoke test"},{"content":"It is an optimization, not a source of truth: it can be deleted and recomputed from the events.\n","permalink":"https://justroham.ir/glossary/event-snapshot/","summary":"A saved copy of folded state at some version, so loading replays only the events after it.","title":"Snapshot (event sourcing)"},{"content":"In PostgreSQL, REPEATABLE READ works this way. Reads never block and never see later commits, but write skew is still possible.\n","permalink":"https://justroham.ir/glossary/snapshot-isolation/","summary":"Each transaction reads from a consistent snapshot of the data taken when it started.","title":"Snapshot isolation"},{"content":"One IP and port can serve many sites. SNI lets the client say example.com in the ClientHello, before any HTTP, so the server can choose the matching certificate.\n","permalink":"https://justroham.ir/glossary/sni/","summary":"Server Name Indication: the client names the host it wants inside the TLS handshake.","title":"SNI"},{"content":"A TCP connection is identified by the four values source address, source port, destination address and destination port. A listening socket accepts connections; each accepted one is a new socket.\n","permalink":"https://justroham.ir/glossary/socket/","summary":"The operating system handle an application uses to send and receive over the network.","title":"Socket"},{"content":"A weakness anywhere in this chain reaches your users even if your own code is perfect. Defending it means knowing what you depend on, pinning it, verifying it and updating it on purpose.\n","permalink":"https://justroham.ir/glossary/software-supply-chain/","summary":"Everything your software is built from and delivered by: dependencies, registries, build tools and CI.","title":"software supply chain"},{"content":"git sparse-checkout set app makes the working tree contain only app/. Combined with a partial clone, only the needed blobs are downloaded. Useful for large monorepos.\n","permalink":"https://justroham.ir/glossary/sparse-checkout/","summary":"Checking out only chosen directories into the working tree.","title":"Sparse checkout"},{"content":"After a promotion, an old primary that is still running keeps accepting writes and their histories diverge. Merging them afterwards is manual and often lossy.\n","permalink":"https://justroham.ir/glossary/split-brain/","summary":"Two nodes both believe they are the primary and accept different writes.","title":"Split-brain"},{"content":"It happens when you build SQL by concatenating strings. The defense is parameterized queries ($1): the values travel separately from the SQL text, so they can never be read as SQL.\n","permalink":"https://justroham.ir/glossary/sql-injection/","summary":"An attack where user input becomes part of the SQL text and changes its meaning.","title":"SQL injection"},{"content":"Applications should branch on SQLSTATE, not on the error text. Class 23 covers integrity violations: 23505 unique, 23503 foreign key, 23514 check.\n","permalink":"https://justroham.ir/glossary/sqlstate/","summary":"A five-character standard error code, e.g. 23505 for a unique violation.","title":"SQLSTATE"},{"content":"git merge --squash applies the combined changes of a branch to your working tree and stops. You commit once yourself. The result has no link back to the original commits, so Git will still list the branch as not merged.\n","permalink":"https://justroham.ir/glossary/squash-merge/","summary":"collapses all commits of a branch into one new commit on the target branch.","title":"squash merge"},{"content":"Made with ssh-keygen -s and read with ssh-keygen -L. Servers trust the CA via TrustedUserCAKeys. Unlike x509 there is no chain.\n","permalink":"https://justroham.ir/glossary/ssh-certificate/","summary":"A public key signed by a CA key, with principals and a validity period, instead of a list of raw keys.","title":"SSH certificate"},{"content":"The private file proves who you are by signing a challenge; the public line goes into the server\u0026rsquo;s authorized_keys. ed25519 is the compact modern type. The private file must be mode 0600.\n","permalink":"https://justroham.ir/glossary/ssh-key-pair/","summary":"A private key you keep plus a public key you share, used to log in without a password.","title":"SSH key pair"},{"content":"You type the passphrase once; ssh asks the agent over a socket. Anyone who can use that socket can sign as you, which is why agent forwarding to untrusted hosts is risky.\n","permalink":"https://justroham.ir/glossary/ssh-agent/","summary":"A process that keeps decrypted private keys in memory and signs on behalf of ssh.","title":"ssh-agent"},{"content":"Typical targets are internal services on loopback or a private network. An allow-list of hosts is the usual defense.\n","permalink":"https://justroham.ir/glossary/ssrf/","summary":"Server-side request forgery: making the server fetch a URL chosen by the user, so it reaches places the user cannot.","title":"SSRF"},{"content":"If you sort orders by city and two orders share a city, a stable sort keeps them in the order they arrived. That is what makes \u0026ldquo;sort by date, then by city\u0026rdquo; work. Merge sort is stable; plain quicksort and heap sort are not. In Go, sort.Stable and slices.SortStableFunc guarantee it.\n","permalink":"https://justroham.ir/glossary/stable-sort/","summary":"A sort that keeps equal elements in their original relative order.","title":"Stable sort"},{"content":"A last-in, first-out collection: you only push and pop at one end. Typical uses are undo history, bracket matching and the call stack.\n","permalink":"https://justroham.ir/glossary/stack/","summary":"A last-in, first-out collection: you only push and pop at one end. Typical uses are undo history, bracket matching and the call stack.","title":"Stack"},{"content":"The index lists every tracked path with its file mode and the id of its blob. git add updates it, git commit turns it into a tree, and git restore --staged pulls entries back out.\n","permalink":"https://justroham.ir/glossary/staging-area/","summary":"the snapshot of what the next commit will contain, stored in .git/index.","title":"Staging area (index)"},{"content":"The start method decides how a child process begins. With spawn a fresh interpreter imports your main module again (hence the if __name__ == '__main__': guard); fork copies the parent. multiprocessing.get_start_method() shows the current one.\n","permalink":"https://justroham.ir/glossary/start-method/","summary":"How multiprocessing creates a child process: spawn (fresh interpreter), fork (copy of the parent) or forkserver.","title":"start method"},{"content":"git stash saves modified tracked files and reverts the working tree to HEAD; git stash pop reapplies the newest entry and drops it. Untracked files are included only with -u.\n","permalink":"https://justroham.ir/glossary/stash/","summary":"a stack of shelved changes you can put back later.","title":"Stash"},{"content":"When a statement exceeds the limit the server cancels it with SQLSTATE 57014; the connection stays usable. It can be set per session, role or database. Related: lock timeout.\n","permalink":"https://justroham.ir/glossary/statement-timeout/","summary":"A PostgreSQL setting that cancels any single statement running longer than the given time.","title":"statement_timeout"},{"content":"Tools such as go vet and staticcheck read the code and report suspicious patterns, for example a wrong format verb. They are fast and tireless, but they only know the patterns they were written for.\n","permalink":"https://justroham.ir/glossary/static-analysis/","summary":"Checking source code for likely bugs without running it.","title":"Static analysis"},{"content":"Power is the probability that a test rejects the null hypothesis when the effect is real. With few samples it is low: a test that stays quiet may simply have seen too little data, not a healthy system.\n","permalink":"https://justroham.ir/glossary/statistical-power/","summary":"the chance a test detects a real effect.","title":"Statistical power"},{"content":"Example: at least 99% of client requests succeed within 300 ms. An experiment passes when the steady state still holds while the fault is active. See SLO.\n","permalink":"https://justroham.ir/glossary/steady-state/","summary":"A measurable description of normal behaviour, such as an SLO, that an experiment must not violate.","title":"Steady state"},{"content":"PostgreSQL does this with a dictionary that belongs to a text search configuration such as english. The simple configuration does no stemming. Stemming is language specific, and irregular forms such as ran may not be reduced.\n","permalink":"https://justroham.ir/glossary/stemming/","summary":"Reducing a word to its stem so that different forms match, for example running, runs and run all become run.","title":"Stemming"},{"content":"A directory mode bit (t in ls -l) that lets only a file\u0026rsquo;s owner or the directory\u0026rsquo;s owner delete or rename entries, as in /tmp.\n","permalink":"https://justroham.ir/glossary/sticky-bit/","summary":"A directory mode bit (t in ls -l) that lets only a file\u0026rsquo;s owner or the directory\u0026rsquo;s owner delete or rename entries, as in /tmp.","title":"Sticky bit"},{"content":"A reliability scheme: send one packet, wait for its acknowledgement, resend on timeout. It needs a sequence number so the receiver can spot duplicates. It is simple but sends only one packet per round trip.\n","permalink":"https://justroham.ir/glossary/stop-and-wait/","summary":"A reliability scheme: send one packet, wait for its acknowledgement, resend on timeout.","title":"Stop-and-wait"},{"content":"strace runs a command, or attaches to a running process, and prints each system call with its arguments and return value. It relies on ptrace, so a traced process runs slower.\n","permalink":"https://justroham.ir/glossary/strace/","summary":"Linux tool that prints the system calls and signals of a process.","title":"strace"},{"content":"The name comes from a description by Martin Fowler of a vine that grows around a tree. A router sends a growing share of calls to the new implementation until the old one can be deleted.\n","permalink":"https://justroham.ir/glossary/strangler-fig/","summary":"Replacing a system piece by piece behind a router, so old and new run side by side.","title":"Strangler fig"},{"content":"A stream is a source or a destination of data that is processed piece by piece. Node.js has four kinds: Readable, Writable, Duplex and Transform. Streams are connected with pipeline, and a slow consumer is protected by backpressure.\n","permalink":"https://justroham.ir/glossary/stream/","summary":"An object that moves data in chunks, so a program never needs the whole thing in memory.","title":"Stream"},{"content":"Each letter violates a security property (authenticity, integrity, non-repudiation, confidentiality, availability, authorization). You apply the six questions to every element of a diagram.\n","permalink":"https://justroham.ir/glossary/stride/","summary":"A checklist of six threat categories: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege.","title":"STRIDE"},{"content":"Python\u0026rsquo;s match statement, which destructures a value by shape (literals, sequences, mappings, classes) and can add guards.\n","permalink":"https://justroham.ir/glossary/structural-pattern-matching/","summary":"Python\u0026rsquo;s match statement, which destructures a value by shape (literals, sequences, mappings, classes) and can add guards.","title":"Structural pattern matching"},{"content":"A type is satisfied by any object that has the right methods, with no explicit inheritance. In Python, typing.Protocol describes this shape for type checkers.\n","permalink":"https://justroham.ir/glossary/structural-typing/","summary":"A type is satisfied by any object that has the right methods, with no explicit inheritance. In Python, typing.Protocol describes this shape for type checkers.","title":"Structural typing (Protocol)"},{"content":"A style where concurrent tasks live inside a scope that waits for all of them and cancels the rest if one fails. In Python, asyncio.TaskGroup gives this: no task outlives the async with block, and errors are collected into an ExceptionGroup.\n","permalink":"https://justroham.ir/glossary/structured-concurrency/","summary":"A style where concurrent tasks live inside a scope that waits for all of them and cancels the rest if one fails.","title":"Structured concurrency"},{"content":"Fields like level, reqId and res.statusCode can be filtered by tools without regular expressions. Pino, the logger inside Fastify, writes one JSON object per line.\n","permalink":"https://justroham.ir/glossary/structured-logging/","summary":"Writing each log line as a JSON object with named fields instead of free text.","title":"Structured logging"},{"content":"Modern clients match the host name only against the SAN list (DNS names and IP addresses). The Common Name field alone is no longer enough for them; Go, for example, rejects such a certificate.\n","permalink":"https://justroham.ir/glossary/subject-alt-name/","summary":"The certificate extension that lists the DNS names and IPs it is valid for.","title":"SubjectAltName (SAN)"},{"content":"The parent repo does not copy the files; it stores a gitlink to a commit in the other repo, plus the URL in .gitmodules. A plain clone leaves the directory empty until you run git submodule update --init.\n","permalink":"https://justroham.ir/glossary/submodule/","summary":"A repository nested inside another one and pinned to one exact commit.","title":"Submodule"},{"content":"A subnet is a block of addresses that share a prefix, usually one broadcast domain. A larger block can be split into smaller subnets by lengthening the prefix, for example a /24 into four /26.\n","permalink":"https://justroham.ir/glossary/subnet/","summary":"A contiguous block of IP addresses sharing one prefix.","title":"Subnet"},{"content":"The imports field of package.json: private aliases that start with # and map to files. import x from '#config' resolves through package.json, so you avoid long ../../ paths. Aliases only work inside your own package.\n","permalink":"https://justroham.ir/glossary/subpath-imports/","summary":"The \u003ccode\u003eimports\u003c/code\u003e field of package.json: private aliases that start with \u003ccode\u003e#\u003c/code\u003e and map to files.","title":"Subpath imports"},{"content":"With git subtree add/pull/split the files become ordinary files in your repo, so collaborators need no extra step. split can extract a subdirectory\u0026rsquo;s history back out.\n","permalink":"https://justroham.ir/glossary/subtree/","summary":"A way to copy another repository\u0026rsquo;s files into a subdirectory of yours, keeping their history mergeable.","title":"Subtree"},{"content":"A program that runs one command as another user (usually root) if the sudoers policy allows it, and logs the attempt.\n","permalink":"https://justroham.ir/glossary/sudo/","summary":"A program that runs one command as another user (usually root) if the sudoers policy allows it, and logs the attempt.","title":"sudo"},{"content":"The policy file that says which users may run which commands as which target users via sudo; edit it only with visudo, which checks the syntax.\n","permalink":"https://justroham.ir/glossary/sudoers/","summary":"The policy file that says which users may run which commands as which target users via sudo; edit it only with visudo, which checks the syntax.","title":"sudoers"},{"content":"A surrogate key is an identifier invented by the database, for example a GENERATED ALWAYS AS IDENTITY integer. It never changes, unlike a natural key such as an email. Keep a UNIQUE constraint on the natural key anyway. See primary key.\n","permalink":"https://justroham.ir/glossary/surrogate-key/","summary":"An artificial row identifier with no business meaning, such as an identity number.","title":"Surrogate key"},{"content":"SwapTotal and SwapFree in /proc/meminfo show its size and use. Swap can postpone an out-of-memory situation, but a machine that constantly swaps is usually slow.\n","permalink":"https://justroham.ir/glossary/swap/","summary":"Disk (or compressed memory) space the kernel uses to move rarely used anonymous memory pages out of RAM.","title":"Swap"},{"content":"A small file whose content is a path to another file. It has its own inode and dangles if the target is removed.\n","permalink":"https://justroham.ir/glossary/symbolic-link/","summary":"A small file whose content is a path to another file. It has its own inode and dangles if the target is removed.","title":"Symbolic link"},{"content":"With the default on, a commit returns only after its WAL is flushed, which is what makes it durable. Turning it off is faster but a crash can lose the last few commits (the database stays consistent).\n","permalink":"https://justroham.ir/glossary/synchronous-commit/","summary":"The PostgreSQL setting that decides whether COMMIT waits until its WAL is flushed to disk.","title":"synchronous_commit"},{"content":"The order is emerg, alert, crit, err, warning, notice, info, debug. Lower numbers are more important, so a filter such as journalctl -p err means priority 3 and everything more severe.\n","permalink":"https://justroham.ir/glossary/syslog-severity/","summary":"The eight standard log levels from 0 (emerg) to 7 (debug), defined by syslog(3).","title":"Syslog severity"},{"content":"A system call is how a program asks the kernel to do something: open a file, read, create a process. On Linux strace lists them for a process.\n","permalink":"https://justroham.ir/glossary/syscall/","summary":"A request from a program to the kernel, such as open or read; tools like strace list them.","title":"System call"},{"content":"systemd starts the other processes, supervises them, restarts them when configured to and stops them in order. Its building block is the unit, described by a unit file. It also provides systemctl, journalctl and systemd-analyze.\n","permalink":"https://justroham.ir/glossary/systemd/","summary":"The init system and service manager on most Linux distributions, running as PID 1.","title":"systemd"},{"content":"Plain VACUUM makes the space reusable inside the file but usually does not shrink it; VACUUM FULL rewrites the table and does.\n","permalink":"https://justroham.ir/glossary/table-bloat/","summary":"Wasted space in a table or index left by dead row versions that were never reused.","title":"Table bloat"},{"content":"Splitting one big logical table into smaller physical tables (partitions) by a key such as a date range, a list of values or a hash. In PostgreSQL the parent table holds no rows itself; each row lives in exactly one partition. Queries and inserts still use the parent\u0026rsquo;s name. See partition pruning.\n","permalink":"https://justroham.ir/glossary/partitioning/","summary":"Splitting one big logical table into smaller physical tables (partitions) by a key such as a date range, a list of values or a hash.","title":"Table partitioning"},{"content":"You can tell it happened by checking pg_relation_filenode() before and after: a new number means a new file. On a big table a rewrite blocks reads and writes for as long as the copy takes.\n","permalink":"https://justroham.ir/glossary/table-rewrite/","summary":"An ALTER that copies the whole table into a new file while holding a strong lock.","title":"Table rewrite"},{"content":"If one request makes 100 calls and each is slow 1% of the time, 1 - 0.99^100 ≈ 63% of requests see at least one slow call.\n","permalink":"https://justroham.ir/glossary/tail-latency/","summary":"The slowest few percent of requests (p99, p999), which dominate what users feel in fan-out systems.","title":"Tail latency"},{"content":"TCP numbers bytes, acknowledges them and retransmits lost ones, so the application sees a stream, not messages. Message boundaries are the application\u0026rsquo;s job.\n","permalink":"https://justroham.ir/glossary/tcp/","summary":"A reliable, ordered byte-stream protocol on top of IP.","title":"TCP"},{"content":"With SO_KEEPALIVE on, the kernel sends small probes after the connection has been idle for a while. If the peer never answers, the connection is closed with an error. It is different from HTTP keep-alive, which is about reusing a connection.\n","permalink":"https://justroham.ir/glossary/tcp-keepalive/","summary":"Probe packets the kernel sends on an idle connection to detect a dead peer.","title":"TCP keepalive"},{"content":"Each layer talks to the same layer on the other side and uses the layer below as a service: link (one hop on one network), internet (IP, hop-by-hop routing), transport (TCP/UDP, ports) and application (HTTP, DNS, gRPC). The 7-layer OSI model is a finer teaching split of the same idea.\n","permalink":"https://justroham.ir/glossary/tcp-ip-model/","summary":"The 4-layer model of the internet: link, internet, transport, application.","title":"TCP/IP model"},{"content":"A working loop with three steps: red (write a small test that fails), green (write the least code that passes), refactor (clean up while the tests stay green). You repeat it in small steps.\n","permalink":"https://justroham.ir/glossary/tdd/","summary":"Test-driven development: write a failing test, make it pass, then clean up (red, green, refactor).","title":"TDD"},{"content":"Technical debt is a metaphor: a shortcut gets you something now, and you pay \u0026ldquo;interest\u0026rdquo; later as slower and riskier changes. The metaphor is useful only if you can name the cost of leaving it and the cost of fixing it. See refactoring for one way to pay it down.\n","permalink":"https://justroham.ir/glossary/technical-debt/","summary":"Shortcuts or aging choices in code that make future change slower, like a loan that charges interest.","title":"Technical debt"},{"content":"An object or function that stands in for a real dependency during a test, like mock.fn() in Node.js. It can also record the calls it receives.\n","permalink":"https://justroham.ir/glossary/test-double/","summary":"A fake object (mock, stub, fake) that replaces a real dependency in a test.","title":"Test double"},{"content":"A way to think about the cost of tests. Tests near the bottom (unit) are cheap, fast and stable; tests near the top (end-to-end) are slow, costly and more likely to be flaky. It is a trade-off model, not a rule.\n","permalink":"https://justroham.ir/glossary/test-pyramid/","summary":"A model: many fast unit tests, fewer integration tests, very few end-to-end tests.","title":"Test pyramid"},{"content":"A tool that finds test files, runs them and reports the results. In Node.js the built-in node:test module does this with node --test.\n","permalink":"https://justroham.ir/glossary/test-runner/","summary":"The tool that finds and runs test files and reports the results.","title":"Test runner"},{"content":"Threads of one process see the same variables, which makes sharing cheap and makes unsynchronized writes dangerous. The OS schedules them; see race condition.\n","permalink":"https://justroham.ir/glossary/thread/","summary":"An independent flow of execution inside a process that shares its memory with other threads.","title":"Thread"},{"content":"The size is set with the UV_THREADPOOL_SIZE environment variable. Jobs beyond the pool size wait in a queue and finish in batches.\n","permalink":"https://justroham.ir/glossary/thread-pool/","summary":"A fixed set of worker threads that run blocking work (files, crypto, DNS) for Node.js; default size 4.","title":"Thread pool"},{"content":"You draw the system, mark where data crosses a boundary, list threats per element and decide a mitigation for each. It is cheapest when done at design time.\n","permalink":"https://justroham.ir/glossary/threat-modeling/","summary":"A structured way to ask what you are building, what can go wrong and what you will do about it, before attackers ask the same questions.","title":"Threat modeling"},{"content":"The client sends a segment with the SYN flag, the server answers SYN+ACK, and the client confirms with ACK. Both sides now know each other\u0026rsquo;s initial sequence numbers and the connection is ESTABLISHED.\n","permalink":"https://justroham.ir/glossary/three-way-handshake/","summary":"SYN, SYN-ACK, ACK: how TCP opens a connection.","title":"Three-way handshake"},{"content":"Seeing the ancestor tells Git which side changed a line. merge.conflictStyle = zdiff3 prints the ancestor text inside conflicts.\n","permalink":"https://justroham.ir/glossary/three-way-merge/","summary":"Merge that compares two branch tips against their common ancestor.","title":"Three-way merge"},{"content":"A classic case is several workers waiting on the same listening socket. The epoll(7) man page names EPOLLEXCLUSIVE as a flag that limits such wake-ups; check the man page for the exact semantics.\n","permalink":"https://justroham.ir/glossary/thundering-herd/","summary":"Many waiting processes or threads are all woken by one event, but only one can use it, wasting work.","title":"Thundering herd"},{"content":"After the close sequence the side that sent its FIN first stays in TIME_WAIT for about twice the maximum segment lifetime (2*MSL, according to the docs). It lets late packets die out and a lost final ACK be re-sent.\n","permalink":"https://justroham.ir/glossary/time-wait/","summary":"The state of the side that closed first, kept for a while after the connection ends.","title":"TIME_WAIT"},{"content":"TLS (Transport Layer Security) sits between TCP and the application protocol. After a handshake the two sides share keys, the client has checked the server\u0026rsquo;s certificate, and all data is encrypted and tamper-evident. HTTPS is HTTP over TLS.\n","permalink":"https://justroham.ir/glossary/tls/","summary":"Transport Layer Security: encrypts and authenticates a connection on top of TCP.","title":"TLS"},{"content":"You check a condition and act later, but something else can change it in between. The fix is to make check and use one atomic step, or to act on the thing you checked. See race condition.\n","permalink":"https://justroham.ir/glossary/toctou/","summary":"Time-of-check to time-of-use: the state changes between the check and the action that relied on it.","title":"TOCTOU"},{"content":"State is two numbers: the token count and the last refill time. A leaky bucket used as a meter makes the same decisions.\n","permalink":"https://justroham.ir/glossary/token-bucket/","summary":"A limiter that refills tokens at a fixed rate and spends one per request, allowing bursts up to its capacity.","title":"Token bucket"},{"content":"A tolerant reader takes only the fields it needs and ignores the rest. Adding a field to a response is then a safe, non-breaking change. A strict decoder that rejects unknown fields turns the same change into an outage.\n","permalink":"https://justroham.ir/glossary/tolerant-reader/","summary":"A client that ignores fields it does not know, so additive API changes do not break it.","title":"Tolerant reader"},{"content":"If a deleted slot were simply emptied, a key that was placed after it by probing would become unreachable. A tombstone keeps the chain intact; a later insert may reuse it, and a rehash drops them all.\n","permalink":"https://justroham.ir/glossary/tombstone/","summary":"A marker left in an open-addressing table when an entry is deleted, so lookups keep probing past it.","title":"Tombstone"},{"content":"Using await directly at the top of an ES module, outside any async function. It works only in ES modules; modules that import this one wait until it finishes.\n","permalink":"https://justroham.ir/glossary/top-level-await/","summary":"using \u003ccode\u003eawait\u003c/code\u003e directly at the top of an ES module, outside any async function.","title":"Top-level await"},{"content":"If edge u -\u0026gt; v means \u0026ldquo;u must come before v\u0026rdquo;, a topological order lists all vertices so that every edge points forward. It exists only for a DAG, and it is usually not unique.\n","permalink":"https://justroham.ir/glossary/topological-sort/","summary":"An ordering of a DAG\u0026rsquo;s vertices in which every edge goes from earlier to later.","title":"Topological sort"},{"content":"A tool that sends packets whose TTL (hop limit) starts at 1 and grows. Each router that drops a packet because the TTL reached zero answers with an ICMP message, which reveals that hop. See TTL and ICMP.\n","permalink":"https://justroham.ir/glossary/traceroute/","summary":"Lists the routers on the path to a host by sending packets with a growing TTL.","title":"traceroute"},{"content":"Traits play the role of interfaces, and are used both as generic bounds (T: Display, static dispatch) and as trait objects (dyn Display, dynamic dispatch). Unlike Go interfaces, a type must explicitly impl a trait.\n","permalink":"https://justroham.ir/glossary/trait/","summary":"A set of methods a type can implement, Rust\u0026rsquo;s way of sharing behavior.","title":"Trait"},{"content":"In PostgreSQL every statement runs inside a transaction; without BEGIN each statement gets its own (autocommit). COMMIT makes the changes permanent and ROLLBACK discards them.\n","permalink":"https://justroham.ir/glossary/transaction/","summary":"A group of statements that the database treats as one unit: all of them take effect, or none do.","title":"Transaction"},{"content":"They appear deeper in npm ls --all. Their versions are chosen by npm and pinned in the lockfile.\n","permalink":"https://justroham.ir/glossary/transitive-dependency/","summary":"A package you did not ask for directly but that one of your dependencies needs.","title":"transitive dependency"},{"content":"A commit points to one root tree, which is how a whole project snapshot is stored.\n","permalink":"https://justroham.ir/glossary/git-tree/","summary":"The Git object that represents a directory: names, modes and hashes of blobs and subtrees.","title":"tree"},{"content":"A right rotation lifts the left child above its parent. An AVL tree needs a single rotation for the LL and RR cases and a double rotation for LR and RL.\n","permalink":"https://justroham.ir/glossary/tree-rotation/","summary":"A local rewiring of two or three nodes that changes the shape of a search tree but keeps its in-order sequence.","title":"Tree rotation"},{"content":"In-order traversal of a binary search tree yields the keys in sorted order. Level-order uses a queue and visits the tree row by row.\n","permalink":"https://justroham.ir/glossary/tree-traversal/","summary":"A systematic order for visiting every node: pre-order, in-order, post-order or level-order.","title":"Tree traversal"},{"content":"A trie (prefix tree) stores a set of strings so that each node is a prefix and each edge adds one character. Insert, search and prefix queries walk one path of length equal to the word. It makes autocomplete natural: find the prefix node, then list what lies below it.\n","permalink":"https://justroham.ir/glossary/trie/","summary":"A tree where each edge is one character, so words that share a prefix share a path. Lookup cost depends on the word length, not on the number of words.","title":"Trie"},{"content":"Handy during a migration to keep an old and a new column in sync while the application is still being changed.\n","permalink":"https://justroham.ir/glossary/trigger/","summary":"A function the database runs automatically before or after an INSERT, UPDATE or DELETE on a table.","title":"Trigger"},{"content":"The PostgreSQL extension pg_trgm provides similarity(), the % operator and trigram operator classes for GIN indexes, which also speed up LIKE '%text%'.\n","permalink":"https://justroham.ir/glossary/trigram/","summary":"A group of three consecutive characters; comparing the trigram sets of two strings gives a similarity score used for fuzzy matching.","title":"Trigram"},{"content":"Everyone integrates small changes into main at least daily, and unfinished work is hidden behind feature flags instead of long-lived branches. It relies on fast CI and good tests.\n","permalink":"https://justroham.ir/glossary/trunk-based-development/","summary":"everyone integrates small changes into the main branch at least daily.","title":"Trunk-based development"},{"content":"Anything that crosses a trust boundary must be validated or authenticated. Most threats cluster on these lines.\n","permalink":"https://justroham.ir/glossary/trust-boundary/","summary":"A line in a diagram where data passes between parts that trust each other differently, for example from the internet into your API.","title":"Trust boundary"},{"content":"How an object behaves in a boolean context. In Python zero, None and empty containers are false; most other values are true.\n","permalink":"https://justroham.ir/glossary/truthiness/","summary":"How an object behaves in a boolean context. In Python zero, None and empty containers are false; most other values are true.","title":"Truthiness"},{"content":"to_tsvector('english', 'running shoes') gives 'run':1 'shoe':2. You match it against a tsquery with the @@ operator, and index it with a GIN index.\n","permalink":"https://justroham.ir/glossary/tsvector/","summary":"A PostgreSQL type holding a document as a sorted list of normalized words (lexemes) with their positions, used for full-text search.","title":"tsvector"},{"content":"TTFB is the time from sending a request to receiving the first byte of the response. A large TTFB usually means the server was busy thinking; a large time after it means the body was slow. Tools measure it from different starting points, so say which one you use.\n","permalink":"https://justroham.ir/glossary/ttfb/","summary":"Time to first byte: how long until the first byte of the response arrives.","title":"TTFB"},{"content":"Each DNS record carries a TTL (time to live). A caching resolver counts it down, so repeated queries show smaller values until it expires and the resolver asks the authoritative server again.\n","permalink":"https://justroham.ir/glossary/ttl/","summary":"How many seconds a cached record may be reused before asking again.","title":"TTL"},{"content":"In phase one every participant makes its work durable and votes yes or no. In phase two the coordinator, having logged its decision, tells all to commit or abort. It gives atomicity across systems, but a prepared participant must wait for the coordinator and keeps its locks meanwhile.\n","permalink":"https://justroham.ir/glossary/two-phase-commit/","summary":"A protocol where a coordinator asks all participants to prepare, then tells them all to commit or all to abort.","title":"Two-phase commit (2PC)"},{"content":"In SQLite a column declared INTEGER has integer affinity: the text '12' is stored as the integer 12, but 'abc' is stored as text without an error. Each value carries its own type. STRICT tables enforce the declared type.\n","permalink":"https://justroham.ir/glossary/type-affinity/","summary":"SQLite\u0026rsquo;s rule that a column prefers a type and converts values when it can, but does not strictly enforce it.","title":"Type affinity"},{"content":"A tool such as mypy that reads type hints and reports type errors without running the program.\n","permalink":"https://justroham.ir/glossary/type-checker/","summary":"A tool such as mypy that reads type hints and reports type errors without running the program.","title":"Type checker"},{"content":"An optional annotation such as x: int or -\u0026gt; str that states the expected type. The interpreter stores it but does not enforce it; type checkers read it.\n","permalink":"https://justroham.ir/glossary/type-hint/","summary":"An optional annotation such as x: int or -\u0026gt; str that states the expected type. The interpreter stores it but does not enforce it; type checkers read it.","title":"Type hint"},{"content":"Defences: review every new dependency name, install from a reviewed lockfile instead of typing names by hand, and prefer well-known packages.\n","permalink":"https://justroham.ir/glossary/typosquatting/","summary":"Publishing a malicious package whose name is a near-miss of a popular one, hoping for a typo.","title":"typosquatting"},{"content":"If the business says \u0026ldquo;place an order\u0026rdquo;, the method is Place, not Submit or Finalize. One word means one thing inside a bounded context.\n","permalink":"https://justroham.ir/glossary/ubiquitous-language/","summary":"The shared vocabulary used by developers and domain experts, and used literally in the code.","title":"Ubiquitous language"},{"content":"UDP sends independent datagrams with just a port and a checksum added to IP. Nothing is retransmitted for you, so the application handles loss, which suits small request/response protocols such as DNS.\n","permalink":"https://justroham.ir/glossary/udp/","summary":"A connectionless datagram protocol on top of IP, with no delivery guarantee.","title":"UDP"},{"content":"A per-process mask of permission bits that are removed from the mode of newly created files and directories. With 022, a new file gets 644 and a directory 755.\n","permalink":"https://justroham.ir/glossary/umask/","summary":"A per-process mask of permission bits that are removed from the mode of newly created files and directories. With 022, a new file gets 644 and a directory 755.","title":"umask"},{"content":"Since Node 15 the default is to crash the process with exit code 1 (checked here on Node 20). Always handle or return the promise.\n","permalink":"https://justroham.ir/glossary/unhandled-rejection/","summary":"A rejected promise that nobody handled with catch or try/catch.","title":"Unhandled rejection"},{"content":"Union by size keeps a size per root and always hangs the smaller tree under the larger one. A node\u0026rsquo;s depth then grows only when its tree at least doubles, so depth stays at most log2 n. Union by rank is the same idea using an estimate of height.\n","permalink":"https://justroham.ir/glossary/union-by-size/","summary":"When merging two trees, attach the smaller under the larger root so trees stay shallow.","title":"Union by size"},{"content":"Union-find, also called a disjoint set, keeps elements in groups that never overlap. Find(x) returns the representative of x\u0026rsquo;s group and Union(a, b) merges two groups. With path compression and union by size, a sequence of operations is almost linear in total, according to the literature.\n","permalink":"https://justroham.ir/glossary/union-find/","summary":"A structure that tracks which elements belong to the same group, with Find (which group?) and Union (merge two groups).","title":"Union-find"},{"content":"Names end with the unit type: .service, .timer, .socket, .target, .mount, .path. Sections such as [Unit], [Service] and [Install] hold the settings. After editing one you run systemctl daemon-reload.\n","permalink":"https://justroham.ir/glossary/unit-file/","summary":"A small INI-like text file that tells systemd how to run or schedule one thing.","title":"Unit file"},{"content":"SQLAlchemy\u0026rsquo;s Session is a unit of work: you add and modify objects, and it emits the INSERT/UPDATE statements when it flushes, in dependency order. Commit makes them permanent; rollback discards them.\n","permalink":"https://justroham.ir/glossary/unit-of-work/","summary":"A pattern where an object tracks changes and writes them together in one transaction.","title":"Unit of work"},{"content":"Some formats describe not only data but also which function to call to rebuild it. If an attacker controls the bytes, they choose the function. Plain-data formats like JSON, plus schema validation, avoid this. See pickle.\n","permalink":"https://justroham.ir/glossary/unsafe-deserialization/","summary":"Rebuilding objects from untrusted bytes with a format that can run code while decoding, such as Python pickle.","title":"Unsafe deserialization"},{"content":"A v1 payload with amount 5 is read as amount_cents 500 plus a currency; the stored row stays untouched.\n","permalink":"https://justroham.ir/glossary/upcasting/","summary":"Converting an old stored event shape to the current one while reading, instead of editing stored events.","title":"Upcasting"},{"content":"After free(p) the pointer still holds the old address, and reading it may even appear to work. In Rust the ownership and borrow rules turn the same mistake into a compile error.\n","permalink":"https://justroham.ir/glossary/use-after-free/","summary":"Using a pointer after the memory it points to has been freed.","title":"Use-after-free"},{"content":"In a simple queue the waiting time grows like 1/(1-ρ), so latency explodes as utilization ρ nears 100%. That is why capacity plans target 50-70%, not 95%.\n","permalink":"https://justroham.ir/glossary/utilization/","summary":"The fraction of time a server is busy: arrival rate divided by service rate.","title":"Utilization"},{"content":"Commands include uv init, uv add, uv run, uv sync and uv pip. It writes uv.lock.\n","permalink":"https://justroham.ir/glossary/uv/","summary":"A fast tool that manages Python versions, virtual environments, dependencies and lock files.","title":"uv"},{"content":"Autovacuum runs it in the background; you can also run VACUUM table by hand. Frequent updates need it to keep up.\n","permalink":"https://justroham.ir/glossary/vacuum/","summary":"The PostgreSQL maintenance command that removes dead row versions and updates the visibility map.","title":"VACUUM"},{"content":"Two Money values with the same amount and currency are equal. A constructor validates them, so an invalid value cannot exist.\n","permalink":"https://justroham.ir/glossary/value-object/","summary":"An immutable object with no identity, compared by its values, such as money or an email address.","title":"Value object"},{"content":"Each process increments its own slot and takes the element-wise max on receive. The price is a vector as large as the number of participants.\n","permalink":"https://justroham.ir/glossary/vector-clock/","summary":"One counter per process; comparing two vectors tells before, after or concurrent exactly.","title":"Vector clock"},{"content":"If one vector dominates the other, the older value is dropped; if they are concurrent, both are kept as siblings for the application to merge.\n","permalink":"https://justroham.ir/glossary/version-vector/","summary":"A vector clock attached to a stored value so replicas can tell an update from a conflicting one.","title":"Version vector"},{"content":"Usually one end stays in the host and the other is moved into a network namespace.\n","permalink":"https://justroham.ir/glossary/veth/","summary":"A pair of virtual Ethernet interfaces: what goes in one end comes out the other.","title":"veth"},{"content":"Created with python3 -m venv .venv or uv venv. Inside it, sys.prefix differs from sys.base_prefix. See also site-packages.\n","permalink":"https://justroham.ir/glossary/virtual-environment/","summary":"An isolated folder with its own interpreter link and site-packages, so each project has its own dependencies.","title":"virtual environment"},{"content":"VACUUM sets the bits; an update to a page clears its bit. Index Only Scans depend on it.\n","permalink":"https://justroham.ir/glossary/visibility-map/","summary":"A per-table bitmap that marks heap pages where all rows are visible to every transaction.","title":"Visibility map"},{"content":"The log makes crash recovery and replication possible. Every change to a table or an index produces WAL records, so the number of WAL bytes is a deterministic way to measure how much work a write did.\n","permalink":"https://justroham.ir/glossary/wal/","summary":"Write-ahead log: PostgreSQL records every change in a sequential log before it touches the data files.","title":"WAL"},{"content":"The := operator in Python, which assigns a value to a name inside an expression, e.g. if (n := len(x)) \u0026gt; 5.\n","permalink":"https://justroham.ir/glossary/walrus-operator/","summary":"The := operator in Python, which assigns a value to a name inside an expression, e.g. if (n := len(x)) \u0026gt; 5.","title":"Walrus operator"},{"content":"After an HTTP handshake the same TCP connection carries small frames in both directions, so the server can push without being asked. It is defined in RFC 6455.\n","permalink":"https://justroham.ir/glossary/websocket/","summary":"A protocol for a persistent two-way message channel, started by an HTTP upgrade.","title":"WebSocket"},{"content":"The name encodes the Python and platform it supports, for example py3-none-any for pure Python. Installing a wheel means unpacking it into site-packages.\n","permalink":"https://justroham.ir/glossary/wheel/","summary":"A built Python package: a zip file ending in .whl that can be installed without running any build step.","title":"wheel"},{"content":"A new item is started only when another finishes. It shortens cycle time but too low a limit leaves people idle.\n","permalink":"https://justroham.ir/glossary/wip-limit/","summary":"A cap on how many items may be in progress at once.","title":"WIP limit"},{"content":"After expanding a variable, the shell splits the result on spaces, tabs and newlines (IFS) and then applies globbing. Quoting an expansion as \u0026ldquo;$var\u0026rdquo; prevents both.\n","permalink":"https://justroham.ir/glossary/word-splitting/","summary":"The shell step that splits an unquoted expansion into separate words.","title":"Word splitting"},{"content":"Instead of spawning one goroutine per job, start N workers that read from a jobs channel. This bounds memory and downstream load. The producer closes the jobs channel when done; workers exit when range ends.\n","permalink":"https://justroham.ir/glossary/worker-pool/","summary":"A fixed number of goroutines consuming jobs from a shared queue.","title":"Worker pool"},{"content":"Node.js\u0026rsquo;s worker_threads module starts extra threads in the same process. Each has its own event loop and memory; data moves by copying with postMessage, by transfer, or through a SharedArrayBuffer.\n","permalink":"https://justroham.ir/glossary/worker-threads/","summary":"Threads inside one Node process, each with its own event loop and heap, for CPU-bound work.","title":"Worker threads"},{"content":"The working tree is the first of Git\u0026rsquo;s three areas. Changes here are invisible to the next commit until you stage them with git add.\n","permalink":"https://justroham.ir/glossary/working-tree/","summary":"the files on disk that you edit, as opposed to what Git has staged or committed.","title":"Working tree"},{"content":"git worktree add ../fix -b fix lets you have two branches checked out at once without cloning again. Git refuses to check out the same branch in two worktrees.\n","permalink":"https://justroham.ir/glossary/worktree/","summary":"An extra working directory attached to the same repository, with its own checked-out branch.","title":"Worktree"},{"content":"Classic example: two on-call doctors each check that the other is still on duty, then both go off duty. Snapshot isolation allows it; SERIALIZABLE does not.\n","permalink":"https://justroham.ir/glossary/write-skew/","summary":"Two transactions read overlapping data, each updates a different row, and together they break a rule neither broke alone.","title":"Write skew"},{"content":"An X.509 certificate contains a public key, the subject it belongs to, the issuer that signed it, a validity period (not before and not after) and extensions such as the SubjectAltName. openssl x509 -text prints all of it.\n","permalink":"https://justroham.ir/glossary/x509-certificate/","summary":"A signed document binding a public key to a name, with a validity period.","title":"X.509 certificate"},{"content":"Reads items from stdin and runs a command with them as arguments. Use -0 with find -print0 so file names containing spaces survive.\n","permalink":"https://justroham.ir/glossary/xargs/","summary":"Reads items from stdin and runs a command with them as arguments. Use \u003ccode\u003e-0\u003c/code\u003e with \u003ccode\u003efind -print0\u003c/code\u003e so file names containing spaces survive.","title":"xargs"},{"content":"It happens when untrusted input is written into a page without escaping for the place it lands in. The main defense is context-aware output encoding, with a Content Security Policy as a second layer.\n","permalink":"https://justroham.ir/glossary/xss/","summary":"Cross-site scripting: attacker-controlled text is rendered as HTML or JavaScript in another user\u0026rsquo;s browser.","title":"XSS"},{"content":"The rank-r key is requested with probability proportional to 1/r^s. Real traffic is often skewed like this, which is why a small cache can have a high hit rate.\n","permalink":"https://justroham.ir/glossary/zipf-distribution/","summary":"A skewed access pattern where a few keys get most requests and a long tail gets few.","title":"Zipf distribution"},{"content":"A child that has exited but whose parent has not yet called wait, so its table entry remains. It shows state Z in ps. It cannot be killed; it disappears when the parent reaps it or exits.\n","permalink":"https://justroham.ir/glossary/zombie-process/","summary":"A child that has exited but whose parent has not yet called \u003ccode\u003ewait\u003c/code\u003e, so its table entry remains.","title":"Zombie process"}]