Windows 10's last consumer patch
Consumer extended security updates end today. A very large number of machines stop receiving fixes, and most of them still work fine.
latest · issue 234 · October 15, 2026
The test double taxonomy
Mock, stub, fake, spy, dummy. The words are used interchangeably and the distinctions are the useful part.
Node 26 goes long-term support
Even-numbered releases become LTS every October. What that actually promises, and what it does not.
Pagination is harder than it looks
Offset pagination is wrong in two ways that only show up at scale, and the fix changes your API.
The write path
What actually happens between your code returning success and the data being safe. Most systems are less durable than their authors think.
Python 3.15 and the free-threading endgame
An October release, as always. The question is no longer whether the GIL can go — it is whether the ecosystem follows.
Error handling across a boundary
Errors that cross a service or module boundary need different treatment from the ones that stay home.
Q3 2026, in one page
A statutory clock started, two languages shipped on schedule, and the quarter's real subject was the boring parts of the craft.
The dashboard nobody looks at
Most dashboards are built during an incident and never opened again. A few are worth keeping, and they look different.
Least privilege, actually applied
Everyone agrees with the principle. Almost nobody has checked what their service can actually reach.
Reading an RFC
Specifications look impenetrable and follow strict conventions. Knowing the conventions makes them the best documentation available.
The migration that never finished
Half-completed migrations are the most expensive state a system can be in, and the most common one.
Choosing an ID
Integers, UUIDs, ULIDs, or something with meaning. The decision is permanent and it leaks into everything.
Why your tests are slow
Six causes, ranked by how often they are the real problem, and the fix for each.
The graph nobody drew
Your service dependency graph exists whether or not anyone has written it down. Writing it down takes an afternoon.
The Cyber Resilience Act's reporting clock starts today
From today, actively exploited vulnerabilities in products sold into the EU must be reported within 24 hours. Here's what that requires.
Timeouts: every one of them
A request crosses a dozen components with a timeout each, and almost nobody has ever added them up.
Java 27 and the LTS question
Six-month releases, an LTS every two years, and a decision most teams make by default rather than deliberately.
The debugging notebook
Writing down what you tried is the cheapest debugging technique there is, and almost nobody does it.
The annual Postgres upgrade you keep deferring
A new major version every autumn, a five-year support window, and a migration that gets worse the longer you leave it.