📝 Notes
93 articlesMD5 is broken: using SHA-256 as a fingerprint for files and data
When a hash does not match, the team may spend hours checking the CDN only to find the download was a 404 page. This note separates integrity checks, tamper detection and password storage, compares MD5 and SHA-256 in length and status, and shows a practical HMAC signing flow.
Regular expressions you cannot read or debug: live match highlighting
A seemingly correct phone-number regex caught just one of 2,000 lines because the m flag was missing in multiline text. This note covers the real boundaries of common symbols, greedy versus lazy matching, and tracking down dead anchors and catastrophic backtracking.
Chinese in URLs turns into %E4%BA%86: URL encoding and decoding
Landing page links open from a chat app with empty parameters, often because spaces were encoded as %20 or +, or an unescaped ampersand cut the query string short. This note covers the byte-level basis of percent-encoding, how three encoding rules differ, and how to recognise double encoding.
What exactly changed between two texts? Line-by-line diffing
Before a sale, twenty minutes of eyeballing a config sync missed worker_connections dropping from 1024 to 64. This note covers when text diffing fits, false differences caused by line endings and indentation, and using line counts to check whether a change got out of hand.
Converting between HEX, RGB and HSL: colour picking and comparison
The same button differs one shade between the design file and the web page, often from hand-converting HEX and HSL. This note breaks down how the three formats map to each other, the term the saturation formula omits, the byte-order trap in 8-digit HEX, and how dark mode derives state colours.
Crontab expressions explained, with predicted run times
Inheriting scheduled jobs left by someone else is risky when a day-of-month and day-of-week restriction is read as and. This note covers the five cron fields and their boundaries, what step values really trigger, silent failures caused by time zones and environment variables, and how to verify run times before shipping.
What BMI counts as overweight? Calculating body mass index against Chinese adult standards
A health report labels BMI 28.8 as obese, while the same height and weight count only as overweight under international cut-offs. This note uses China standard WS/T 428-2013 for adult weight to explain the thresholds, how to work back to the normal range, and why waist circumference deserves attention before BMI.
Batch-extracting phone numbers, emails and ID numbers from text
Picking phone numbers out of 1,800 tickets by hand covered only 400 in two hours, and an 11-digit order number was mistaken for a phone number. This note covers where rule-based extraction produces false positives and misses, why the post-deduplication gap matters, and how much spot-checking and logging is enough.
Why simplified-to-traditional conversion misses characters: one-to-many mappings
After converting an entire site character by character, the words for hair and noodles both came out wrong and more than 200 spots needed manual fixes. This note explains why one-to-many mappings fail by design, which characters to spot-check by word when going traditional-to-simplified, Hong Kong versus Taiwan vocabulary, and how to structure a review checklist.
ID photos and uploads at the wrong size: resizing pixels in the browser
Three rejected photos made clear that pixels, format and byte size are three independent checks. This note explains how to work back from an ID photo spec like 295x413, why locking the aspect ratio is the critical step, and what to adjust when the resized file is still over 20 KB.
QR codes with a logo: Wi-Fi, business cards and payment in one code
Of 88 table stickers printed, only 4 scans succeeded in three days, traced to contrast, error-correction level and logo coverage. This note covers three reasons a QR code will not scan, how much damage L/M/Q/H error correction tolerates, and whether to send vector or raster artwork to print.
Still using 123456? Generating a password that is effectively uncrackable
Port 22 on a test server logged 47,000 failed logins, which made clear that password strength depends mainly on length and character set. This note estimates brute-force time under the worst case of an unsalted fast hash, explains why dictionary mutations hit first, and why the random source must be cryptographically secure.