Blog · page 26
Notes on engineering, design, and everything in between.
Hash and checksum: why CRC32 and MD5 have to be written by hand
The browser only offers the SHA family, and only in a secure context. CRC32 and MD5 are not in Web Crypto. Along the way: large files should not be read into memory whole, and checksums should not be compared by eye.
Regex Lab: hits, groups, replacement preview, and the zero-width trap
A regex tester has to do three things well: show where matches land and what each group captured, preview the replacement, and never hang on a zero-width match.
JSON Studio: format, validate and diff in one page
Built from the habit of writing throwaway commands to clean up JSON. It formats, minifies, sorts, pinpoints parse errors by line and column, and diffs two documents — all in the browser.
1059 assertions, no test framework: why pure logic must import nothing
My test suite is `node scripts/selftest.ts` — no framework, no dependencies. The price is that every module it touches must have zero relative imports, and that price bought a codebase shape.
SharePoint deserialisation RCE: CVE-2026-45659
A plain Site Member account is enough to run code on a SharePoint server. Microsoft rated exploitation unlikely, and CISA put it in the KEV catalogue with three days to remediate.
n8n unauthenticated RCE (Ni8mare): CVE-2026-21858
The form node skips Content-Type validation, so one application/json request makes it read an arbitrary file. The key inside the config forges an admin JWT, and a sandbox bypass turns that into RCE.