Most REST APIs ship with two kinds of tests: unit tests that check functions in isolation, and integration tests that walk the happy path. “Create an item, read it back, delete it, get a 204.” Those tests are written by the same people who wrote the code, so they test the inputs those people expected. Nobody writes the test that sends a 65-character name, a quantity of 2^64, or a DELETE for an item that was never created, because nobody thought of it. ...

Every real-time collaborative editor has the same hard problem underneath it. Two people type into the same paragraph at the same moment, possibly while one of them is offline on a train, and when everything reconnects both screens have to end up showing exactly the same text without anyone’s edit vanishing. The family of data structures built to solve that is called a CRDT (Conflict-free Replicated Data Type): a structure designed so that copies of a document (called replicas) can accept edits independently and always merge to the same result, in any order, with no central referee deciding who wins. ...

The Rabbit Hole Generator gave me NEEDLE this week, and it lands right on a question I keep running into: once you let a coding agent run unattended, who decides whether it actually did the job? Most of the excitement around coding agents is about making them smarter. NEEDLE is interested in something much less glamorous. It assumes the agent is unpredictable, wraps it in a loop where every step around the agent is fixed and logged, and then refuses to take the agent’s word that it finished. I didn’t want to point a real AI model with its permission prompts switched off at anything, so I ran the whole thing against a fake agent: a 20-line shell script that succeeds, fails, hangs, and lies on cue. The lying one turned out to be the most interesting part. ...

Ask most teams what’s attached to the container image running in production and you’ll get an answer about their CI pipeline: “we sign it, we generate an SBOM, we attach provenance.” That’s a statement about what the pipeline tried to do. Whether the registry actually holds those things, linked to the right image, in a form the next tool can find, is a different question, and it’s surprisingly hard to answer in under a minute. ...

This week’s Rabbit Hole Generator pick was ocsfkit, and it’s aimed at a failure mode that doesn’t look like a failure at all: a security event that parses successfully, lands in your SIEM (Security Information and Event Management platform, the system that ingests and correlates security logs), and gets treated as trustworthy, while a real chunk of what it originally meant never made it through the translation. That translation step is normalization: taking a vendor’s raw event format (AWS GuardDuty’s JSON, Okta’s login logs, whatever a tool emits) and reshaping it into a common schema so different security tools can actually talk about the same event the same way. OCSF (Open Cybersecurity Schema Framework) is the industry’s current attempt at that common schema. The part nobody’s tooling handles well is what happens to the fields that don’t map cleanly. Most pipelines either silently drop them or silently guess, and a downstream analyst has no way to tell the difference between a field that was confidently mapped and one that was quietly invented. ...