612 failed logins in an hour: reading Event ID 4625 to tell an attack from… an old laptop
Red logs don’t always mean an attack. How SOC analysts triage Windows logon failures: which fields matter, when it’s brute force, when it’s a stale password.
System Design
Databases, networking, architecture — explained by example. · 11 articles
Bloom filters: why “no” is certain but “yes” only means “maybe”
A tiny bit array in RAM lets RocksDB and Cassandra skip countless pointless disk reads — at the cost of the occasional false alarm.
Saved, but still seeing old data? Replication lag and read-your-writes
Nothing was lost — you’re just reading from a replica that hasn’t caught up yet. The cleanest fix: read-your-writes.
Why is the first request always slower? The TCP handshake costs a full RTT
First request 160ms, next ones just 80ms — even with an instant server. The culprit is the SYN / SYN-ACK / ACK greeting.
Retry storms: why exponential backoff isn’t enough without jitter
12 clients retrying at once knock over a 6-slot server. Backoff decides how long to wait; jitter decides whether the server survives.
Write-Ahead Log: the database said “saved”, then the power died — is the data safe?
All 6 writes were acked but only 3 reached the table — and after a power cut nothing is lost, because the log is written first and the table later.
Circuit breakers: fail fast instead of waiting on a dead service
The service is down, yet every call still waits 1000ms for an error. A circuit breaker counts failures, trips, and fails fast.
Backpressure: when the producer is 3× faster, how does the queue not overflow?
The producer pushes 3 msg/s, the consumer handles 1. Without backpressure the queue grows until it runs out of memory. With it, the consumer sets the pace.
How do video sites serve huge audiences? CDN plus peer-to-peer over WebRTC
The CDN sends only a few original copies; viewers’ players pass the rest to each other — and fall back to the CDN the moment a peer leaves.
Connection pools: 45ms to open a connection vs. 0.2ms to borrow one
The query takes 12ms but the API is still slow? Connection setup is often the culprit. A pool removes that cost — until load exceeds it and requests queue.
From 250ms to 0ms: how requests short-circuit through 4 cache layers
Browser, CDN, Redis, database — stacked. A request pays only down to the layer that answers, and every miss teaches the stack.
No matching articles
Try another keyword or clear the topic filter.
Never miss a new article
Follow binhAI via RSS (Feedly, Inoreader, Slack…) to get new articles as soon as they’re published.