21 August 2026

The AI productivity gap

Explains why AI doesn’t let us create software quicker. For senior developers, writing code was never the hard part. And to counter the argument that juniors are the ones mostly likely to be put out of a job by AI:

it’s juniors who stand to gain the most from AI – especially if they are good at using AI as a learning tool

An Architectural View of ML.NET

Refresher of how to use Microsoft ML, specifically using ML.NET instead of Python.

How and Why Netflix Built a Real-Time Distributed Graph: Part 3 — Querying the graph with gRPC

Really detailed description of the architectural choices needed to balance network latency, disk latency, memory usage, etc to perform a large graph query quickly and efficiently.
And how to optimize depending on exactly what is being asked by the query.
And how to optimize different caching strategies for different kind of data.

Also an interesting concept: “fail-open: a slow or unavailable source never blocks the query, and we just return the graph data without it”.

They explain their decisions and what they learned along the way. Not everything turned out as expected.

A nice conclusion “Closing: Principles for Distributed Systems” - not just about RPC, or graph, but distributed systems in general.

Passkeys in ASP.NET Core 10: Passwordless Authentication with Identity

Describing how to add Passkeys to a .NET app using the .NET Core Identity.

A deliberately limited scope has been implemented in the API - it isn’t intended as a general-purpose WebAuthn library:

• Adding a passkey to an existing account
• Passwordless account creation
• Passwordless sign-in

What isn’t implemented:

• No attestation statement validation by default - that’s usually okay
• No 2FA integration - only as a primary factor
• No account recovery flow - that’s up to you

Understanding the Fetch Metadata HTTP headers: Sec-Fetch-Site and friends

The browser tells you where a request came from and what it will be used for, providing another layer on top of CSRF tokens and SameSite cookies.

CSS: the bomb inside your inbox

Webmail clients render untrusted CSS in trusted UI and try to sanitise it. This post is about some research for how to exploit that, ending up with a keylogger in pure CSS.

I expect that these specific issues will be fixed by the time we’re reading this, but the general lesson is that CSS is more than just visual styling - there is exploitable logic in there too.