Skip to content
Mahmudul Alam
MenuClose

Writing

Notes on how things actually work

Explanations of things I had to understand properly myself — internals, protocols, and the occasional security postmortem.

  • 22 posts
  • 2024 – 2026
22 posts

2026

Harness Engineering: The Model Is No Longer the Hard Part

Reliability in agent systems comes from the harness, not the model. What a harness actually does — context, tools, durability, budgets, approval — and why a good one survives a model swap.

  • ai
  • agents
  • harness-engineering
25 Aug 2026

How a ‘Dream Freelance Gig’ Tried to Run Malware on My Mac

A fake recruiter sent me a confidential project brief as a Git repo. Hidden in .git/hooks was a dropper that fires the moment you check out a branch.

  • security
  • malware
  • git
3 Jun 2026

Spec-Driven Development with Claude: A Professional Guide to Consistent AI-Assisted Coding

Spec-driven development with Claude: writing the spec first, structuring the context it reads, and the workflow that makes AI-assisted coding repeatable.

  • claude
  • ai
  • spec-driven-development
11 Apr 2026

jq: JSON on the Command Line

A practical guide to jq: piping JSON in, pretty-printing, filtering and reshaping it, with the handful of expressions worth committing to memory.

  • jq
  • json
  • command-line
2 Feb 2026

HTTP, Demystified: How Browsers and Servers Actually Talk

A working mental model of HTTP: URLs, methods and headers, then caching, cookies, CDNs, HTTP/2 and what HTTPS actually protects.

  • http
  • web-development
  • backend
1 Feb 2026

Beware: Marketplace Scammers Distributing Malware Through Fake Development Projects

How attackers are using freelance platforms to trick developers into running malicious code that steals data and credentials

  • security
  • malware
  • social-engineering
21 Jan 2026

2025

How Git Actually Works: commits, trees and the object model

How Git stores your code: the object model behind commits, trees and blobs, and what branches, merges and the reflog really are underneath.

  • git
  • version-control
  • internals
22 Dec 2025

TypeScript Utility Types: From Partial to Awaited

TypeScript’s utility types with real examples: Partial, Required, Pick, Omit, Record and Awaited, and when each one is the right tool for the job.

  • typescript
  • utility-types
  • type-safety
23 Nov 2025

AbortController: The Art of Graceful Cancellation in JavaScript

Cancelling async work with AbortController: aborting a fetch, wiring up timeouts, cleaning up on unmount, and composing more than one signal.

  • javascript
  • async
  • cancellation
24 Oct 2025

Demystifying JWT: what a token contains and how it is verified

What a JSON Web Token actually contains, how signing and verification work, and where JWTs go wrong in real authentication flows.

  • jwt
  • authentication
  • security
21 Oct 2025

CSS Specificity Explained in a Fun Way

A fun, beginner-friendly guide to understanding CSS specificity with practical examples and easy-to-remember rules.

  • css
  • frontend
  • specificity
22 Sept 2025

JavaScript Equality, Explained Like a Human

When to reach for ===, the few places == genuinely helps, and the coercion rules behind the comparisons that surprise people most.

  • javascript
  • equality
  • coercion
19 Sept 2025

The Secret Life of a Website Visit

A fun, story-style walkthrough of what really happens when you type a URL: DNS, TCP, TLS/SSL, HTTP, caching, rendering, CORS, cookies, CDNs, and more.

  • web-development
  • networking
  • dns
18 Sept 2025

Stop putting JWTs in localStorage: a fun, practical guide for frontend apps

Storing and refreshing JWTs safely in a frontend app: in-memory access tokens, HttpOnly refresh cookies, rotation, and the CORS and CSRF details.

  • security
  • jwt
  • frontend
10 Sept 2025

Closures in JavaScript: From Pizza Shops to Caching Superpowers

A fun and practical guide to understanding closures in JavaScript, with real-world use cases like caching, rate limiting, event handling, and more.

  • javascript
  • typescript
  • closures
9 Sept 2025

Imperative vs Declarative in JavaScript/TypeScript

A fun and practical guide to understanding when to use imperative vs declarative approaches in JS/TS, with lots of real-world examples.

  • javascript
  • typescript
  • imperative
6 Sept 2025

Promise Methods Playbook

A fun, practical guide to JavaScript promise methods — all, allSettled, race, any, resolve/reject, and finally — with examples you’ll actually use.

  • javascript
  • async
  • promises
4 Sept 2025

Implementing Web3 Wallet Authentication in Express.js

Wallet-based authentication in Express.js: verifying an Ethereum signature, issuing a session, and the replay and nonce problems to handle.

  • web3
  • authentication
  • express
1 Sept 2025

Domain-Driven Design in Next.js

Where domain logic belongs in a Next.js app, and how entities, use cases and repositories keep it out of the route handlers and components.

  • ddd
  • domain-driven-design
  • nextjs
27 Aug 2025

Stop Using GET Inside Server Actions

Why a GET inside a Next.js Server Action adds a round trip, how to fetch in a React Server Component instead, and when a Server Action is the right tool.

  • nextjs
  • server-actions
  • react-server-components
25 Aug 2025

2024

Custom Authentication in Next.js Using External Backend

Custom authentication in Next.js against an external backend: access and refresh tokens, silent renewal, and where each token should actually live.

  • nextjs
  • authentication
  • jwt
18 Sept 2024

Deleting Local Stale Branches in Git

Cleaning up a Git repository by deleting the local branches whose remotes are gone — one command, plus what is actually safe to remove.

  • git
  • version-control
  • development-tools
28 Aug 2024