Notes on systems engineering and development.https://thesyscall.ricardochu.com/https://thesyscall.ricardochu.com/posts/node2shell-brotli-out-of-bounds-write/https://thesyscall.ricardochu.com/posts/node2shell-brotli-out-of-bounds-write/How CVE-2026-111497 turns a Brotli decoder error into memory corruption, which Node.js applications are exposed, and how to patch them.Wed, 04 Nov 2026 00:00:00 GMTnodejssecuritybrotlimemory-safetyhttps://thesyscall.ricardochu.com/posts/typescript-content-mappers/https://thesyscall.ricardochu.com/posts/typescript-content-mappers/Content mappers give TypeScript virtual code to check, but source positions and permission to execute the mapper determine how useful and safe that check is.Wed, 04 Nov 2026 00:00:00 GMTtypescripttoolingeditorslanguage-servicehttps://thesyscall.ricardochu.com/posts/http-compression-spends-cpu-to-save-bytes/https://thesyscall.ricardochu.com/posts/http-compression-spends-cpu-to-save-bytes/Follow HTTP content negotiation, then measure where gzip, Brotli and zstd trade encoding time for fewer response bytes.Tue, 03 Nov 2026 00:00:00 GMTnetworkinghttpcompressionperformancehttps://thesyscall.ricardochu.com/posts/opencode-v2-shared-service-migration/https://thesyscall.ricardochu.com/posts/opencode-v2-shared-service-migration/Understand how OpenCode v2's shared service changes session routing, plugin and client contracts, and the permission behavior you need to check during migration.Tue, 03 Nov 2026 00:00:00 GMTopencodeaideveloper-toolsopen-source