Vary: Cookie quietly destroys your CDN hit rate
A single Vary: Cookie header turns every visitor into their own cache entry. Here is how it sneaks in, and how to keep cacheable pages cacheable.
Latest news
Blog
Cache-Control: no-cache does not mean what you think
no-cache still stores the response. The directive that forbids storing is no-store, and the difference matters for CDNs, browsers and privacy reviews.
font-display, preload and the crossorigin you forgot
Preloading a font without crossorigin makes the browser download it twice. The choice of font-display decides what users see while it loads.
Money in Python: Decimal, rounding and the 2.675 problem
float cannot hold 0.1 exactly, round() rounds halves to even, and Decimal(2.675) already contains the error. Three small facts that cause real reconciliation gaps.
Free-threaded Python: what is real and what is hype
There is an official build without the GIL, but it is a separate interpreter, most C extensions need to opt in, and your default python still has the GIL.
dataclass defaults, default_factory and slots=True
Python rejects a mutable default in a dataclass, but not in every place where the same mistake hides. Here is what the error protects you from.
Raspberry Pi GPIO from Python: the parts that go wrong
Bouncing buttons, 3.3 V pins, software PWM jitter and a library that does not run on newer boards. The code is short. The physical side is where the time goes.
asyncio timeouts and cancellation: what really stops
A timeout cancels the coroutine, but cancelling is a request, not a kill. Swallowing CancelledError, or shielding the wrong thing, leaves work running.
SSRF: checking the URL is not the same as checking the IP
A blocklist of "localhost" and "127.0.0.1" fails against decimal IPs, short forms and DNS names that point inward. Validate what the name resolves to.
