Things I have built, studied, and contributed to.

Configuration and scripts served from a URL that never moves, filled in per caller and versioned so any revision is restorable. A Gist serves stale content after an edit; here a write evicts the cache, and a route id nobody minted never reaches the database.

Opening an email should not tell the sender you opened it. Remote images are blocked by default, and the ones you allow go through a WARP tunnel the app builds itself in Rust, rather than a proxy that would do the logging instead.

Short links that outlive what they point at: destinations are edited in place, and every earlier one stays restorable. Deletion is refused by a database trigger rather than by code that has to remember.

A weekend team spends its first hours on login and ships a password table nobody would defend on Monday. This starts past both: passkeys by default, and roles the server decides rather than the token.

Self-hosted software rots quietly: the container running today is whatever its dependencies were the day it was built. These rebuild twice daily on a pipeline where workers steal from their peers once they run dry, so nothing waits behind the slowest shard.

An agent is only as consistent as the procedure it is handed, and one pasted into a single repository does not travel. These are Markdown that names no project, written once and read everywhere, this site included.

People ask whether an address is safe before signing a lease, and an incident count answers badly: it punishes density and says nothing about what comes next. A Poisson fit over Toronto Police data answers with a probability instead.

Behavioural studies fail on delivery more often than on design: missed prompts, silent dropout, answers that never arrive. PromptPipe reaches participants on WhatsApp, where they already are, and counts what was delivered apart from what was answered.

An interaction shown to work in a study's own editor has not been shown to work anywhere. This carries the CHI 2024 ABScribe interface into Gmail, LinkedIn, and Reddit, which strip any markup they did not author, so a variant's identity rides inside the text as zero-width characters.

Every nudge stops working once you have seen it enough times, which is why most screen-time apps fade in a week. Focus Flow keeps choosing: prompts are weighted by measured success under a cooldown, so an early winner cannot crowd out the untried.

Reference examples get copied verbatim, and a reversed bit shift compiles, runs, and prints plausible numbers. The kernel puts tgid in the high 32 bits and pid in the low ones; the documented example had them the other way round, as did the uid/gid page beside it.

An address meant never to leave the device was leaving it: Android probes its resolver on port 853, netstack answered only on 53, and the rest fell through to the exit node's default route. The client logged it out, the exit node logged it refused; fixed upstream eight days later.