Articles
Worth reading
A short take on pieces worth your time — architecture, AI, system design, and engineering careers — each one linked back to its original source.
42 articles
CQRS
Fowler's short bliki entry on Command Query Responsibility Segregation is the one to read before anyone on your team gets excited about splitting reads and writes into separate models, because his real point is restraint: CQRS earns its complexity in specific, collaborative-domain contexts, not as a default. I've seen it misapplied to plain CRUD systems more than once, and this piece is the fastest way to talk a team back from that. Short, opinionated, and still the reference everyone eventually cites.
Synchronize Virtual Thread Without Pinning
A tight, practical writeup of JEP 491, which finally fixes one of virtual threads' more annoying rough edges: a virtual thread inside a synchronized block used to pin to its carrier platform thread, quietly cancelling out the whole point of using virtual threads under lock contention. Baeldung's usual approach, show the pinning happen, then show it fixed, makes the improvement concrete rather than theoretical. Worth a read if you adopted virtual threads early and are still carrying workarounds for a problem newer JDKs have already solved.
Async IO in Python: A Complete Walkthrough
One of the more patient walkthroughs of Python's asyncio I've come across, building up from coroutines and the event loop to real async/await usage instead of just showing a toy example and moving on. Real Python's usual strength shows here: it doesn't skip the parts that actually confuse people, like why you can't just sprinkle "async" on a function and expect concurrency for free, or what happens when you forget to await something. Good to have on hand the next time someone on the team asks "wait, is this actually running concurrently or not."
OWASP Top 10 for LLM Applications
The LLM-specific sibling to the general OWASP Top 10, and the risks it names, prompt injection sitting at number one, plus excessive agency, insecure output handling, and supply chain risk for models and training data, are the ones I now walk through on every project that wires an LLM into something with real permissions. It's a useful corrective to how much AI security discussion still focuses on model behavior in the abstract rather than the concrete ways an LLM-powered feature gets exploited in production. Pair this with the standard OWASP Top 10 rather than treating it as a replacement; most LLM apps are still full of ordinary web vulnerabilities too.
Monitoring Distributed Systems
The Google SRE book chapter, written by Rob Ewaschuk and edited by Betsy Beyer, that introduced the "four golden signals": latency, traffic, errors, and saturation, as the minimum viable dashboard for any user-facing service. What's held up is the discipline behind it: pick a small number of signals you'll actually look at during an incident instead of a wall of graphs nobody reads at 3am. I still use this as the starting checklist whenever I'm setting up monitoring for a new service.