Cosine similarity and the dot product
A from-zero tour of the maths under large language models: how words become coordinates, why similarity is an angle, and the single multiply-and-add a computer uses to compare two meanings.
Field Notes
A working notebook.
Always in progress.
Notes on event-driven Java, Spring Boot, Kafka, and secure systems for regulated banking.
LLMs, the whole thing · Part 1
Large Language Models, From the Ground Up - Part I: The Geometry of Meaning
The opening part of a series building LLMs from first principles. We start where every model starts: turning language into vectors and meaning into geometry, with a runnable script and its real numbers.
LLMs, the whole thing · Part 2
The Transformer Architecture: Encoder versus Decoder
Every modern LLM is a transformer, yet BERT, GPT and T5 behave very differently. The first article in a ground-up series on LLMs: the single distinction — the attention mask — that separates an encoder from a decoder.
Claude code insights report
Claude Code's /insights command handed me a mirror: 82 sessions of my own habits, scored. Here is what it got right about how I work, and the one thing that quietly costs me the most.
Running the box: Docker, Linux, the JVM
The localhost in your SSH tunnel isn't yours
My production Postgres publishes no port at all, and I still open it in DBeaver from my laptop. The one-line ssh -L everyone reaches for connects happily and then refuses every query — for a reason that's easy to miss, and eight bytes that prove when you've actually fixed it.
Security and privacy, in practice
Keycloak part 1: reading the login URL, parameter by parameter
I froze the redirect Spring sends you through and read it parameter by parameter. Three lookalike strings turned out to close three different attacks, and PKCE was already on without me asking for it.
I brokered my sign-in through Keycloak, and broke my own owner check
Putting a self-hosted identity server in front of LinkedIn deleted 240 lines of workaround and turned PKCE back on. It also handed out a privilege escalation — because the claim never changed, but the trust underneath it did.
Parking apps for employees: a fairness ledger to the rescue
First-come-first-served parking allocates alarm clocks. Give the lot memory — an append-only fairness ledger — and scarce slots become something you can defend out loud.
Four phases, and the one that never runs at all
What @TransactionalEventListener actually fires on commit, on rollback, and on neither -- plus a write inside AFTER_COMMIT that survives or vanishes depending on your connection pool. Measured in a playground, not quoted from the Javadoc.
publishEvent() is a method call, not a queue
Spring's plain @EventListener runs on your thread, inside your transaction, before your next line — and a chained event is fully handled before the original finishes. Everything here was verified by running it, not by reading the reference page.