Get live statistics and analysis of mitali's profile on X / Twitter

Netflix and chill? Nah. Rust and suffer

most backend devs can make an api work. few understand what’s actually happening under the hood. let me break it down in simple terms 🧵

someone asked me: "what are your hobbies?" bro i'm a dev. i don't have "hobbies." i am: - planning to rewrite my entire node app in rust (i will not be doing this) - reading 100+ chapters of a reincarnation manhwa anytime where the duke is an ass but 'secretly pining' - listening to one playlist on repeat for 6 hours until it's just noise - staring blankly at a wall but actually thinking about rust stuffs and crabs in my head - wondering if "grass" is even real or just a myth people made up i am not a real person.

POV you applied to 200 jobs got 3 interviews and they all asked you to code "trapping rain water" problem.

was tryin something dumb lol ever wondered how chat apps know you’re typing? there’s no deep ML model behind it. the client just sends a tiny “user is typing” event every few seconds over a websocket. you stop -> it stops sending -> server tells everyone “typing...” is gone. just timers, events, and a socket that never sleeps. i made a smol rust websocket to fake it

was going through some backend stuff and found this thing called consistent hashing ngl half the internet kinda runs on this shit. it decides which server owns your data and somehow keeps it stable even when servers come or go. most basic load balancers (like nginx round robin) just reshuffle everything when a node changes. but the smarter ones, haproxy, aws alb, envoy, gloo mesh, use consistent hashing so your data sticks to the same place. been around for years but it’s still everywhere, cdn caches, db shards, even ai infra now. some newer setups use “bounded loads” so one node doesn’t get cooked when handling llm requests. wrote a smol rust version of it and honestly, it’s stupid simple

built a garbage collector in rust for no good reason rust already handles memory with ownership so GC is completely unnecessary but i made one anyway in 90 lines allocates objects, marks the ones you're using, frees the rest, reuses memory slots tested it with 5 objects, only kept 3 alive, it automatically freed the other 2. then when i allocated a new object it reused one of the freed slots instead of growing the heap mark-and-sweep algorithm, same thing java and python use but built from scratch no dependencies just standard library kinda funny building a garbage collector in the one language that specifically doesn't need one but here we are

started late but here i am lol

let's talk about unsafe rust. the biggest myth is that unsafe "turns off the borrow checker." that's just cap. all your normal, safe code inside an unsafe block is still 100% checked. unsafe is just you telling the compiler: "i'm enabling a few special stuff (like raw pointers) and i personally guarantee this code is correct." why? to build safe tools that the borrow checker is too dumbass to understand on its own. so, where do you actually see unsafe? FFI (talking to c/c++): this is the big one. every time you use a crate that wraps a c library (like openssl, ffmpeg, or just basic os calls), it's unsafe under the hood. rust can't check c code, so it's all on you. building safe stuff: your favorite types. vec has to use unsafe to get raw, uninitialized memory from the os. arc and mutex use unsafe to do the low-level atomic operations for thread safety. someone had to write this 'cursed' code once so we can all have nice things. peak performance: this is the "i'm smarter than the compiler" case. using get_unchecked(i) in a hot loop where you know the index is valid. or, using simd instructions (std::arch) to do parallel math on your cpu. high risk, high reward. low-level os/embedded dev: writing a kernel? talking directly to hardware? you're basically living in unsafe blocks. you have to write to specific memory addresses (0xb8000 for vga, anyone?). there's no 'safe' way to do that. you're not writing unsafe every day. you're using the safe tools that unsafe made possible.

ever wondered how APIs know your request’s actually you and not some rando spoofing it? lemme tell you: most APIs don’t really “trust” your key. they make you prove you didn’t fuck with the data you’re sending. it’s called HMAC signing, and it’s how servers verify a request’s actually from you. when you send a request, the server uses your secret key to create a cryptographic signature from your body and compares it with the one you sent. if they match, all good. if not, it knows something’s off. the logic’s simple: signature = HMAC_SHA256(secret, body) you send that with your request. the server runs the same math. if both match, you’re verified. HMAC just means hash-based message authentication code. sounds fancy, but it’s just “don’t trust what you didn’t hash yourself.” you can check a smol rust example below:

ever thought about how those “select all traffic lights” CAPTCHAs actually know you’re right? lemme tell you: they’re not doing any crazy shit. it’s literally a token + hash check. when the page loads, the backend generates a challenge id, stores the correct hash, and gives your browser a signed token that says “this is challenge X.” when you click your lil squares -> your selections get hashed -> the browser sends both your answer + that token back. server just checks if your hash matches the stored one and if your token hasn’t expired or been tampered with. if both pass, you’re human. if not, congrats on another round of “find all those damn traffic lights.” here’s a smol rust demo that does the same logic:

just dropped a side project in Rust , Veil. it’s an async encryption and multi-party computation playground with AES, hashing, string reversal, Shamir’s secret sharing, and XOR-based MPC, all running through a server + client CLI. started as a toy, now it actually works.

damn finally, i’m done. so, i’ve been working on conflux, a modular, actor-based real-time collaboration engine written in rust. it uses CRDTs (via Yrs), room-based websocket, and an actor-style design for concurrency. i added jwt, authentication, session tracking, awareness syncing, and a dashboard endpoint to see active rooms. each room is self-contained as it spawns, runs, and cleans itself up automatically. the code’s on github if you want to check it out. PS: i’ll drop a blog soon explaining how the architecture works and how CRDT sync happens under the hood.

played around with Rust and made a TCP proxy. it takes traffic from one port and forwards it to multiple backend servers. also checks if the backends are alive before sending anything.

finally done with ts. so, veridian supports init, hash-object, write-tree, commit-tree, cat-file. finally ran it in terminal and seeing the hashes pop is so satisfying. basically content-addressable storage + sha1 stuff + zlib compression all from scratch 🧵

POV: you're 21 and your high school friends are posting engagement pics while you're on your 5th cup of black coffee beefing with code that worked yesterday.

Netflix and chill? Nah. Rust and suffer

someone asked me: "what are your hobbies?" bro i'm a dev. i don't have "hobbies." i am: - planning to rewrite my entire node app in rust (i will not be doing this) - reading 100+ chapters of a reincarnation manhwa anytime where the duke is an ass but 'secretly pining' - listening to one playlist on repeat for 6 hours until it's just noise - staring blankly at a wall but actually thinking about rust stuffs and crabs in my head - wondering if "grass" is even real or just a myth people made up i am not a real person.

most backend devs can make an api work. few understand what’s actually happening under the hood. let me break it down in simple terms 🧵

started late but here i am lol

damn finally, i’m done. so, i’ve been working on conflux, a modular, actor-based real-time collaboration engine written in rust. it uses CRDTs (via Yrs), room-based websocket, and an actor-style design for concurrency. i added jwt, authentication, session tracking, awareness syncing, and a dashboard endpoint to see active rooms. each room is self-contained as it spawns, runs, and cleans itself up automatically. the code’s on github if you want to check it out. PS: i’ll drop a blog soon explaining how the architecture works and how CRDT sync happens under the hood.

finally done with ts. so, veridian supports init, hash-object, write-tree, commit-tree, cat-file. finally ran it in terminal and seeing the hashes pop is so satisfying. basically content-addressable storage + sha1 stuff + zlib compression all from scratch 🧵

was tryin something dumb lol ever wondered how chat apps know you’re typing? there’s no deep ML model behind it. the client just sends a tiny “user is typing” event every few seconds over a websocket. you stop -> it stops sending -> server tells everyone “typing...” is gone. just timers, events, and a socket that never sleeps. i made a smol rust websocket to fake it

happy diwali everyone. may your diyas burn brighter than your burnout

gm gm say it back or you're gay

POV you applied to 200 jobs got 3 interviews and they all asked you to code "trapping rain water" problem.

built a garbage collector in rust for no good reason rust already handles memory with ownership so GC is completely unnecessary but i made one anyway in 90 lines allocates objects, marks the ones you're using, frees the rest, reuses memory slots tested it with 5 objects, only kept 3 alive, it automatically freed the other 2. then when i allocated a new object it reused one of the freed slots instead of growing the heap mark-and-sweep algorithm, same thing java and python use but built from scratch no dependencies just standard library kinda funny building a garbage collector in the one language that specifically doesn't need one but here we are

just dropped a side project in Rust , Veil. it’s an async encryption and multi-party computation playground with AES, hashing, string reversal, Shamir’s secret sharing, and XOR-based MPC, all running through a server + client CLI. started as a toy, now it actually works.

ever thought about how those “select all traffic lights” CAPTCHAs actually know you’re right? lemme tell you: they’re not doing any crazy shit. it’s literally a token + hash check. when the page loads, the backend generates a challenge id, stores the correct hash, and gives your browser a signed token that says “this is challenge X.” when you click your lil squares -> your selections get hashed -> the browser sends both your answer + that token back. server just checks if your hash matches the stored one and if your token hasn’t expired or been tampered with. if both pass, you’re human. if not, congrats on another round of “find all those damn traffic lights.” here’s a smol rust demo that does the same logic:

let's talk about unsafe rust. the biggest myth is that unsafe "turns off the borrow checker." that's just cap. all your normal, safe code inside an unsafe block is still 100% checked. unsafe is just you telling the compiler: "i'm enabling a few special stuff (like raw pointers) and i personally guarantee this code is correct." why? to build safe tools that the borrow checker is too dumbass to understand on its own. so, where do you actually see unsafe? FFI (talking to c/c++): this is the big one. every time you use a crate that wraps a c library (like openssl, ffmpeg, or just basic os calls), it's unsafe under the hood. rust can't check c code, so it's all on you. building safe stuff: your favorite types. vec has to use unsafe to get raw, uninitialized memory from the os. arc and mutex use unsafe to do the low-level atomic operations for thread safety. someone had to write this 'cursed' code once so we can all have nice things. peak performance: this is the "i'm smarter than the compiler" case. using get_unchecked(i) in a hot loop where you know the index is valid. or, using simd instructions (std::arch) to do parallel math on your cpu. high risk, high reward. low-level os/embedded dev: writing a kernel? talking directly to hardware? you're basically living in unsafe blocks. you have to write to specific memory addresses (0xb8000 for vga, anyone?). there's no 'safe' way to do that. you're not writing unsafe every day. you're using the safe tools that unsafe made possible.

POV: you're 21 and your high school friends are posting engagement pics while you're on your 5th cup of black coffee beefing with code that worked yesterday.