Skip to content

Writing

Engineering Notes

Write-ups of specific problems, with the code that fixed them. No round-ups, no tool lists.

  1. Go os/exec and .cmd files: a Windows injection trap

    Go quotes arguments for normal programs, not for batch files. Passing one hostile argument to an npm .cmd launcher from Go created a file on disk and no error. Here is the test, the fix, and what the fix costs.

    Engineering5 min

  2. Why Go crashed only in go test: uintptr and KeepAlive

    A Windows API call was reading a buffer Go's garbage collector had already freed. The bug was invisible for weeks because it needs a GC cycle to land inside a window a few microseconds wide.

    Engineering6 min

  3. Free to spend, not total balance: offline budget math

    Adding up account balances gives you a number that lies to you twice a month. Here is the single pass over a ledger that produces the number you can actually spend, and the double-counting bug I hit getting there.

    Mobile5 min

  4. GoHighLevel two-way sync: stopping your own messages echoing back

    In a two-way GoHighLevel sync, every message you post comes back to you as a webhook. An idempotency key won't catch it, because it isn't the same event.

    Automation4 min