Things I've written down.
Ruby, Rails, performance, security and applied machine learning. Updated when something feels finished.
Blocking 99.3% of spoofing attacks with nothing but a webcam
No infrared, no depth sensor, no GPU. What a multi-signal liveness pipeline actually catches, what it misses, and the cheapest check that beat all the expensive ones.
pgvector or a dedicated vector database?
For most applications the answer is the database you already run, and the threshold where that stops being true is higher than the marketing suggests.
The callback that fires in a test you didn't write
Active Record callbacks are convenient until a fixture, a seed script or a bulk import triggers side effects nobody expected.
Indexes that earn their keep
Adding an index is the reflex fix for a slow query. Column order, cardinality and write cost decide whether it does anything at all.
A CSP that actually stops XSS
Most content security policies are decorative. The directive that matters is script-src, and 'unsafe-inline' undoes the whole thing.
Fat models, skinny controllers, and the third option
Both halves of the old advice produce the same result at scale: one enormous class. Naming the operation is what actually helps.
Three threads, not five: what the GVL actually costs you
Rails ships a default most people never revisit. Here's how CRuby's global lock decides your thread count for you, and the arithmetic for picking workers.
Authenticated is not authorised
The most common real-world web vulnerability isn't injection. It's an endpoint that checks who you are and forgets to check what you may touch.
SQLite in production, honestly
It is a real option for real applications now — with one constraint that decides your entire deployment shape.
Four caches, and knowing which one you need
HTTP, fragment, low-level and query caching solve different problems. Reaching for the wrong one hides the bug instead of fixing it.