index / 03 - blog archive

blog

archive stats
27
total
25
this yr
112K
words
ALLSYSTEMSENGINEERINGSECURITY
grep "..."

DeepInfer Explained: A Code-Level Tour of DeepSeek's Open-Source Inference Engine

DeepInfer is DeepSeek's open-source inference engine for V4.1-Flash. A code-level tour of DSpark, expert parallelism, async scheduling and kernels.
systems11/12/2638 min

Nemotron 3.5 ASR Benchmark on a Mac Neural Engine: Accuracy, Speed, and Every Way It Fails

Nemotron 3.5 ASR and Transcribe Lite on an M3 Pro via Core ML vs Orukeet and Parakeet: WER, speed, chunk tiers, empty output, first-word loss.
engineering11/11/2631 min

React Server Components, Cooked Again: The Unauthenticated Typed-Array RCE (GHSA-xqc2-xf4c-x3h3)

An unauthenticated RCE in React Server Components (GHSA-xqc2-xf4c-x3h3, CVSS 9.5) hits Next.js 16 and react-server-dom-* via typed-array Flight payloads.
security11/10/2614 min

NVIDIA Nemotron 3.5 ASR Streaming Explained: How It Works and How to Run It

NVIDIA Nemotron 3.5 ASR streaming explained: mel frames, cache-aware FastConformer, RNN-T, language prompts, chunk tiers, the 30B Transcribe, and code.
engineering11/09/2624 min

Speculative Listening Explained: What a Full-Duplex Voice Paper Means for On-Device Speech Recognition

Speculative listening decodes the next audio chunk before it arrives: 2.6-2.8x faster, lossless. Why it fails for ASR, and where it works in dictation.
engineering11/08/2629 min

*sshole (CVE-2026-123158): Is Your Alpine OpenSSH Affected, and How Do You Fix It?

CVE-2026-123158 (sshole) lets an oversized password bypass OpenSSH on musl Linux without PAM. How to check Alpine, OpenWrt and Docker, patch, and harden.
security11/07/2629 min

LiteLLM Got Compromised Again: Anatomy of the 1.107.0 Supply Chain Attack

How GitHub tokens leaked into AI gateway logs let attackers ship a credential-stealing LiteLLM 1.107.0 to PyPI and Docker, and what to rotate now.
security10/23/2622 min

eMudhra (emSign) CA Key Compromise: The Private Key Was the Number 4

Eight eMudhra (emSign) intermediate CA keys were tiny integers anyone could recover. Full timeline, CVEs, patched versions, and how to stay protected.
security10/22/2637 min

PHP2Shell: Anatomy of the CVE-2026-109618 and CVE-2026-109619 Unauthenticated RCE

PHP2Shell (CVE-2026-109618/109619) is an unauthenticated RCE hitting PHP 5, 7 and 8. The root cause, the live exploitation, and how to patch and harden.
security10/22/2615 min

Talk to Chart: Chatting With a TradingView Chart Using Jev, GPT-5 and My Own Pine Interpreter

Chat with a TradingView chart: TypeSafe's Jev routes asks into typed commands, GPT-5 plans the hard ones, and Pine runs in a Web Worker on my own interpreter.
engineering10/15/2616 min

nalgo: Building a Pure-Rust Algo Trading Platform for Indian Markets on NautilusTrader

How I am building nalgo: pure-Rust algo trading on NautilusTrader for Indian brokers. Connect your broker, write a strategy in plain English, let it trade.
engineering10/14/2617 min

20 Milliseconds of Writing Zeros: Profiling FluidAudio and Fixing It Upstream

Profiling Parakeet on Core ML found 20 ms zeroing a buffer one NSNumber at a time. FluidAudio#941: 72.6 to 48.2 ms, and review made the fix smaller and safer.
engineering10/13/2614 min

TapTalk Gets Faster: Orukeet, Silero VAD on Core ML, and the Microphone That Would Not Let Go

TapTalk: Orukeet (oruk.ai) as default engine, audio and Silero VAD moved from Rust to Swift and Core ML, key-up to paste 155 to 100 ms, three mic bugs fixed.
engineering10/12/2625 min

Rebuilding TapTalk: Ripping Out Whisper for NVIDIA Parakeet, Live Typing, and On-Device Multilingual Dictation

How I rebuilt TapTalk's engine: NVIDIA Parakeet and Nemotron on the Neural Engine, streaming live typing, Hindi and Hinglish, and Smart Mode rewrites.
engineering09/10/2622 min

Two Gates and a Process Boundary: Swapping vLLM's Suffix Drafter Without a Fork

Swapping vLLM's suffix drafter without a fork: two gates in two processes, one import-binding mistake, one process-boundary mistake, and the plugin fix.
engineering07/23/269 min

slate: Turning a Phone into a Stream Deck for macOS - One Command, a Pluggable Backend, and the Trade-offs Behind It

How I built slate, a free open-source phone-as-Stream-Deck for Mac over your LAN with no cloud: one Command, a pluggable Transport, one shared Zod schema.
engineering07/01/2620 min

No Public Ports: Zero-Trust Team SSH to a Private Azure Cluster with a Reverse Bastion and Cloudflare WARP

Team SSH to a private Azure dev cluster with zero open ports: one outbound cloudflared bastion, Cloudflare WARP, Google SSO, and the split-tunnel routing trap.
systems07/01/2617 min

Bear the Tokens: FP16 and Suffix Decoding to 9,000+ Tokens a Second on a Tesla T4

Pushing Qwen2.5-0.5B to 9,052 tok/s on a free Colab T4 in the H2Loop contest: AWQ INT4 dead ends, FP16, and model-free suffix speculative decoding.
engineering06/14/2621 min

Logpipe: Building a Distributed Logging Stack from Scratch with Vector and ClickHouse

How I built Logpipe, a small but real Vector + ClickHouse logging pipeline in Go: why aggregator batching matters, 'Too many parts', and disk buffers.
engineering06/14/2625 min

TapTalk: Building a Free, Local, Open-Source Alternative to SuperWhisper and Whisper Flow

How I built TapTalk, a free local speech-to-text app for macOS in Rust and SwiftUI: Whisper on the Neural Engine via Core ML, chip-tuned, push-to-talk.
engineering05/24/2621 min

The Three Levers: Backend-Driven UI, OTA Updates, and the End of Waiting for App Review

How Swiggy, Airbnb, PhonePe and Nubank ship UI without app store review, and how I built a BDUI + OTA system in React Native with Cloudflare Workers and EAS.
engineering04/30/2618 min

How a Roblox Cheat Script Took Down Vercel: Anatomy of a Supply Chain Breach

Dissecting the April 2026 Vercel breach: infostealer malware to OAuth hijack to customer data exposure. Full kill chain, trust lessons, survival guide.
security04/21/269 min

Building a Real-Time F&O Fair Value Engine for Indian Markets

How we built a production fair-value calculator on top of Dhan - Black-Scholes, cost of carry, live depth, and mispricing signals - for Saras and NSE F&O.
engineering04/11/267 min

Building a Prop Trading Engine on Advisor Intelligence

How we built end-to-end automated prop trading at Saras: 1000+ daily trade ideas to live execution on Dhan, with novel metrics that actually generate profits.
engineering04/11/2619 min

Building a World-Monitor News Engine for Traders: From ~115 Public Sources to a Daily Brief

How we built Saras's agentic news engine: scrape public macro and trade intelligence, dedupe at scale, enrich with structured AI, ship a trader-facing brief.
engineering04/11/267 min

Building a Memory Engine on Object Storage: A Deep Dive

Exploring how modern data systems separate storage and compute, with a hands-on implementation of a memory engine that works on object stores like S3.
systems12/29/2413 min

Reproducing CVE-2025-55182: Remote Code Execution in React Server Components

A deep dive into the critical RCE vulnerability affecting Next.js and React 19, with a full reproduction and technical breakdown.
security12/15/245 min
showing 27 of 27 posts
© 2026 Dhruv VakharwalaNext.js · TypeScript · Tailwind · Cloudflare