How One Regex Took Down Cloudflare: Catastrophic Backtracking, Tested in Your Browser
A 30-char string can hang a simple regex for 13 seconds. How ReDoS works, why it took down Cloudflare, and how to catch it in RegexLab.
Article archive
More articles
Browse older engineering guides and field notes, page 5.
Continue browsing
Articles
The SEC EDGAR XBRL API: Pull Any Company’s Financials as JSON (No Key)
How to pull any US public company's financials as free JSON from the SEC EDGAR XBRL API, plus the revenue-tag gotcha that breaks naive screeners.
I Stopped Pasting JWTs Into Online Base64 Decoders — Here’s the Browser-Only Fix
Online base64 decoders run server-side, so pasting a live JWT leaks the token. Base64Lab decodes JWTs and files in your browser. Here's how it works.
The SpaceX 424B Prospectus Is Free on SEC EDGAR — Here’s What It Says and How to Pull It
SpaceX's 424B4 final prospectus (filed June 12, 2026) priced the IPO at $135/share. The real terms off the cover page, plus Python to pull it from SEC EDGAR.
HouseStockWatcher Is Dead — Here’s How to Pull the Latest House Trades Yourself
The old HouseStockWatcher S3 bucket now 403s. Here's how to pull the latest US House stock trades from the Clerk's office in ~40 lines of Python.
Why the Web Crypto API Won’t Compute MD5 (and How HashForge Does It in Your Browser)
Why the Web Crypto API refuses MD5 and how HashForge generates MD5, SHA-256 and more in-browser without uploading a single byte.