November 2, 2026

Software

Apps, browsers, productivity and developer tools.

package-lock.json and npm-shrinkwrap.json shown as two document files leading to an app install and a published package

npm · Oct 31

package-lock.json vs npm-shrinkwrap.json

Choose the right npm lockfile for an app, library or published package, and know what npm ci enforces.

HTTP content negotiation flow between a client and server, showing Accept, Content-Type and Vary headers

HTTP · Oct 27

HTTP Content Negotiation: Accept, Content-Type and Vary

Use Accept, Content-Type and Vary correctly so APIs select representations without breaking shared caches.

A Webtamine diagram routes a raw webhook body and Stripe signature through an HMAC check and timestamp window

Stripe · Oct 26

Stripe Webhook Signature Verification: Check the Raw Request

Verify Stripe webhooks with the raw body, signature header, endpoint secret, timestamp checks and duplicate controls.

A split Webtamine diagram shows numbered offset pages shifting after an insert and a cursor continuing after a stable record.

APIs · Oct 26

Cursor vs Offset Pagination: What Changes Under Inserts

Compare cursor and offset pagination when records move, repeat or change during a long API traversal.

A split editorial diagram contrasts a bearer token card with a DPoP token bound to a cryptographic key.

OAuth · Oct 25

DPoP vs Bearer Tokens: What Proof of Possession Changes

How DPoP binds OAuth tokens to a client key, what replay checks add and which risks still remain.

HTTP · Oct 23

ETag vs Last-Modified: Choosing an HTTP Validator

Choose the right HTTP validator for caching, conditional requests and safe concurrent updates.

Semantic Versioning · Oct 23

Semantic Versioning vs Calendar Versioning

SemVer signals API compatibility; CalVer signals release timing. Choose the contract your users need.

Two matching request envelopes approaching a locked gate, illustrating that encrypted early data can still be duplicated.

TLS · Oct 22

TLS 1.3 0-RTT: Why Early API Requests Can Replay

Early TLS requests save waiting, but encryption alone cannot prevent a repeated API action.

OAuth · Oct 18

OAuth vs API Keys: Choosing an API Authentication Method

OAuth and API keys identify different actors. Here is how to choose by principal, scope, lifetime and revocation.

Two repeated API requests converge on one lime idempotency key and one completed operation

APIs · Oct 16

Idempotency Keys: Safe API Retries Without Duplicates

Reuse one operation key for retries, but reconcile uncertain outcomes before changing the request.

Webhooks · Oct 14

Webhooks vs Polling: Which Integration Fails Better?

Webhooks push events. Polling asks on a schedule. Compare latency, retries, rate limits and hybrid recovery.

Three stacked paper boxes, a large black one, a cream one and a small lime one, beside a cream paper padlock, illustrating major, minor and patch releases and the lockfile.

Developer tools · Oct 10

Semantic Versioning: What Major, Minor and Patch Promise

Semantic versioning sets what a version bump promises. npm ranges decide which releases your project installs.

Notes and an attachment moving from an application into a folder

Notes apps · Sep 26

Can You Leave Your Notes App Without Losing Your Notes?

An export can preserve the words while losing the structure that made them useful.

A browser extension revealing documents through a permission boundary

Browser extensions · Sep 26

What Browser Extensions Can Read, and How to Check

Check the websites an extension can access as well as the browser features it can use.

Local notes open on a laptop beside a disconnected network cable

Local-first software · Sep 26

Local-First Apps: What Works Without the Internet

A local copy is useful. It does not automatically make every feature work offline.

Check the parts of an application that matter after installation: what happens offline, what leaves the device, which permissions remain active and whether your data can move elsewhere. These guides explain workflows and limits using the relevant product documentation.

Begin with notes-app exports, local-first software or browser-extension access. The Software desk pairs this background with release coverage. A guide is not presented as a hands-on review unless testing actually took place and its conditions are described.