index / 03 - blog archive
blog
archive stats
27
total
25
this yr
112K
words
ALLSYSTEMSENGINEERINGSECURITY
grep "..."
DeepInfer Explained: A Code-Level Tour of DeepSeek's Open-Source Inference Engine
DeepInfer is DeepSeek's open-source inference engine for V4.1-Flash. A code-level tour of DSpark, expert parallelism, async scheduling and kernels.
systems11/12/2638 min
Nemotron 3.5 ASR Benchmark on a Mac Neural Engine: Accuracy, Speed, and Every Way It Fails
Nemotron 3.5 ASR and Transcribe Lite on an M3 Pro via Core ML vs Orukeet and Parakeet: WER, speed, chunk tiers, empty output, first-word loss.
engineering11/11/2631 min
React Server Components, Cooked Again: The Unauthenticated Typed-Array RCE (GHSA-xqc2-xf4c-x3h3)
An unauthenticated RCE in React Server Components (GHSA-xqc2-xf4c-x3h3, CVSS 9.5) hits Next.js 16 and react-server-dom-* via typed-array Flight payloads.
security11/10/2614 min
NVIDIA Nemotron 3.5 ASR Streaming Explained: How It Works and How to Run It
NVIDIA Nemotron 3.5 ASR streaming explained: mel frames, cache-aware FastConformer, RNN-T, language prompts, chunk tiers, the 30B Transcribe, and code.
engineering11/09/2624 min
Speculative Listening Explained: What a Full-Duplex Voice Paper Means for On-Device Speech Recognition
Speculative listening decodes the next audio chunk before it arrives: 2.6-2.8x faster, lossless. Why it fails for ASR, and where it works in dictation.
engineering11/08/2629 min
*sshole (CVE-2026-123158): Is Your Alpine OpenSSH Affected, and How Do You Fix It?
CVE-2026-123158 (sshole) lets an oversized password bypass OpenSSH on musl Linux without PAM. How to check Alpine, OpenWrt and Docker, patch, and harden.
security11/07/2629 min
LiteLLM Got Compromised Again: Anatomy of the 1.107.0 Supply Chain Attack
How GitHub tokens leaked into AI gateway logs let attackers ship a credential-stealing LiteLLM 1.107.0 to PyPI and Docker, and what to rotate now.
security10/23/2622 min
eMudhra (emSign) CA Key Compromise: The Private Key Was the Number 4
Eight eMudhra (emSign) intermediate CA keys were tiny integers anyone could recover. Full timeline, CVEs, patched versions, and how to stay protected.
security10/22/2637 min
PHP2Shell: Anatomy of the CVE-2026-109618 and CVE-2026-109619 Unauthenticated RCE
PHP2Shell (CVE-2026-109618/109619) is an unauthenticated RCE hitting PHP 5, 7 and 8. The root cause, the live exploitation, and how to patch and harden.
security10/22/2615 min
Talk to Chart: Chatting With a TradingView Chart Using Jev, GPT-5 and My Own Pine Interpreter
Chat with a TradingView chart: TypeSafe's Jev routes asks into typed commands, GPT-5 plans the hard ones, and Pine runs in a Web Worker on my own interpreter.
engineering10/15/2616 min
nalgo: Building a Pure-Rust Algo Trading Platform for Indian Markets on NautilusTrader
How I am building nalgo: pure-Rust algo trading on NautilusTrader for Indian brokers. Connect your broker, write a strategy in plain English, let it trade.
engineering10/14/2617 min
20 Milliseconds of Writing Zeros: Profiling FluidAudio and Fixing It Upstream
Profiling Parakeet on Core ML found 20 ms zeroing a buffer one NSNumber at a time. FluidAudio#941: 72.6 to 48.2 ms, and review made the fix smaller and safer.
engineering10/13/2614 min
TapTalk Gets Faster: Orukeet, Silero VAD on Core ML, and the Microphone That Would Not Let Go
TapTalk: Orukeet (oruk.ai) as default engine, audio and Silero VAD moved from Rust to Swift and Core ML, key-up to paste 155 to 100 ms, three mic bugs fixed.
engineering10/12/2625 min
Rebuilding TapTalk: Ripping Out Whisper for NVIDIA Parakeet, Live Typing, and On-Device Multilingual Dictation
How I rebuilt TapTalk's engine: NVIDIA Parakeet and Nemotron on the Neural Engine, streaming live typing, Hindi and Hinglish, and Smart Mode rewrites.
engineering09/10/2622 min
Two Gates and a Process Boundary: Swapping vLLM's Suffix Drafter Without a Fork
Swapping vLLM's suffix drafter without a fork: two gates in two processes, one import-binding mistake, one process-boundary mistake, and the plugin fix.
engineering07/23/269 min
slate: Turning a Phone into a Stream Deck for macOS - One Command, a Pluggable Backend, and the Trade-offs Behind It
How I built slate, a free open-source phone-as-Stream-Deck for Mac over your LAN with no cloud: one Command, a pluggable Transport, one shared Zod schema.
engineering07/01/2620 min
No Public Ports: Zero-Trust Team SSH to a Private Azure Cluster with a Reverse Bastion and Cloudflare WARP
Team SSH to a private Azure dev cluster with zero open ports: one outbound cloudflared bastion, Cloudflare WARP, Google SSO, and the split-tunnel routing trap.
systems07/01/2617 min
Bear the Tokens: FP16 and Suffix Decoding to 9,000+ Tokens a Second on a Tesla T4
Pushing Qwen2.5-0.5B to 9,052 tok/s on a free Colab T4 in the H2Loop contest: AWQ INT4 dead ends, FP16, and model-free suffix speculative decoding.
engineering06/14/2621 min
Logpipe: Building a Distributed Logging Stack from Scratch with Vector and ClickHouse
How I built Logpipe, a small but real Vector + ClickHouse logging pipeline in Go: why aggregator batching matters, 'Too many parts', and disk buffers.
engineering06/14/2625 min
TapTalk: Building a Free, Local, Open-Source Alternative to SuperWhisper and Whisper Flow
How I built TapTalk, a free local speech-to-text app for macOS in Rust and SwiftUI: Whisper on the Neural Engine via Core ML, chip-tuned, push-to-talk.
engineering05/24/2621 min
The Three Levers: Backend-Driven UI, OTA Updates, and the End of Waiting for App Review
How Swiggy, Airbnb, PhonePe and Nubank ship UI without app store review, and how I built a BDUI + OTA system in React Native with Cloudflare Workers and EAS.
engineering04/30/2618 min
How a Roblox Cheat Script Took Down Vercel: Anatomy of a Supply Chain Breach
Dissecting the April 2026 Vercel breach: infostealer malware to OAuth hijack to customer data exposure. Full kill chain, trust lessons, survival guide.
security04/21/269 min
Building a Real-Time F&O Fair Value Engine for Indian Markets
How we built a production fair-value calculator on top of Dhan - Black-Scholes, cost of carry, live depth, and mispricing signals - for Saras and NSE F&O.
engineering04/11/267 min
Building a Prop Trading Engine on Advisor Intelligence
How we built end-to-end automated prop trading at Saras: 1000+ daily trade ideas to live execution on Dhan, with novel metrics that actually generate profits.
engineering04/11/2619 min
Building a World-Monitor News Engine for Traders: From ~115 Public Sources to a Daily Brief
How we built Saras's agentic news engine: scrape public macro and trade intelligence, dedupe at scale, enrich with structured AI, ship a trader-facing brief.
engineering04/11/267 min
Building a Memory Engine on Object Storage: A Deep Dive
Exploring how modern data systems separate storage and compute, with a hands-on implementation of a memory engine that works on object stores like S3.
systems12/29/2413 min
Reproducing CVE-2025-55182: Remote Code Execution in React Server Components
A deep dive into the critical RCE vulnerability affecting Next.js and React 19, with a full reproduction and technical breakdown.
security12/15/245 min
showing 27 of 27 posts