Engineering notes
Things I have had to understand properly.
I write these mostly after debugging something and discovering my mental model was wrong. They are the explanations I wish I had found first — practical rather than academic, and honest about the parts I originally misunderstood.
- Identity 5
- Security 4
- Architecture 3
- OAuth 2.0 3
- Debugging 2
- Devices 2
- AI Engineering 1
- Android 1
- JWT 1
- LLM 1
What changes when software engineering meets AI
A backend engineer's notes on what an LLM really changes in a system: a non-deterministic component with no contract, and the ordinary discipline around it.
Designing IAM as a separate domain
Identity needs its own domain boundary: authentication decisions leak into state, session lifetime and service trust, so scattering them erases your trust boundaries
Debugging production: start with evidence
A procedure for debugging production systems, where the expensive failure mode is not being wrong but being confident and wrong before you have gathered anything.
Building one application across Samsung Tizen, LG webOS and Android
What changes when the browser is welded to firmware, the device is in a shop you cannot visit, and the vendor API has no common shape.
Why the same video plays on one device and fails on another
A layered mental model for digital signage playback failures: container vs codec vs profile and level vs the hardware decoder that actually has to run it.
Authentication and authorization are different questions
Why treating a valid session as permission produces a whole bug class, and where the ownership check actually belongs.
JWT, JWKS and RS256 — how token verification actually works
A JWT is signed, not encrypted, and verifying one means checking the signature and the claims — here is how RS256, kid, JWKS and alg confusion fit together.
PKCE: the attack it stops, and why it is now the default
Why a public OAuth client cannot prove who it is at the token endpoint, how a stolen authorization code turns into real tokens, and how PKCE makes that code inert.
OIDC vs OAuth 2.0 — what actually happens when you log in
OAuth 2.0 grants permission, not identity. Here is what OpenID Connect adds, why an access token is the wrong thing to read, and how nonce differs from state.
Understanding the OAuth 2.0 Authorization Code flow from first principles
The Authorization Code flow is not a list of steps to memorise. It falls out of one constraint: the only lever an authorization server has is a redirect.