https://kfir-g.dev/blog/ Technical articles about Python, FastAPI, Cybersecurity, and more by Kfir Gisman. en-us Wed, 05 Aug 2026 00:00:00 GMT https://kfir-g.dev/blog/blogs/2026-08-05_sqlite-under-the-hood Wed, 05 Aug 2026 00:00:00 GMT Discover how SQLite packs a full ACID-compliant database into a single file embedded inside your app. Learn about VDBE bytecode, flat B+ trees, and crash-safe WAL mode. https://kfir-g.dev/blog/blogs/2026-08-05_sqlite-under-the-hood https://kfir-g.dev/blog/blogs/2026-07-26_elasticsearch-under-the-hood Sun, 26 Jul 2026 00:00:00 GMT Stop waiting on slow O(N) database scans. Peek under the hood of Elasticsearch and Apache Lucene to discover how inverted indexes, analyzer pipelines, immutable segment files, and two-phase scatter-gather distributed searches collapse billions of records into sub-10ms responses. https://kfir-g.dev/blog/blogs/2026-07-26_elasticsearch-under-the-hood https://kfir-g.dev/blog/blogs/2026-07-03_rethinking-system-architecture-kafka Fri, 03 Jul 2026 00:00:00 GMT Stop tangling your microservices in a messy web of direct API requests. Strip away the marketing complexity and dive into how Kafka leverages a dead-simple, append-only commit log, strict partition ordering, and low-level zero-copy optimizations to decouple backend systems with zero infrastructure debt. https://kfir-g.dev/blog/blogs/2026-07-03_rethinking-system-architecture-kafka https://kfir-g.dev/blog/blogs/2026-06-19_the-astral-trilogy-python-pipelines Fri, 19 Jun 2026 00:00:00 GMT Stop wrestling with a fragmented, legacy soup of Python tooling. Learn how the modern Astral Trilogy—uv, ruff, and ty—completely unifies package management, PEP 8 linting, code formatting, and strict environment-aware type checking into a single pyproject.toml configuration and a blazing-fast 15-second GitHub Actions CI/CD pipeline. https://kfir-g.dev/blog/blogs/2026-06-19_the-astral-trilogy-python-pipelines https://kfir-g.dev/blog/blogs/2026-05-30_exploiting-starlette-host-injection Sat, 30 May 2026 00:00:00 GMT Stop assuming your framework's high-level string properties represent network truth. Trace a live CVE-2026-48710 exploit pipeline using uv and curl to watch how a query delimiter (?) injected into the Host header splits global middleware logic from backend routing execution, and discover why a simple framework upgrade fails without migrating to low-level ASGI scopes. https://kfir-g.dev/blog/blogs/2026-05-30_exploiting-starlette-host-injection https://kfir-g.dev/blog/blogs/pydantic-core-engine-deep-dive Fri, 22 May 2026 00:00:00 GMT Stop thinking of data validation as secondary boilerplate. Peel back the layers of Pydantic V2’s compiled Rust core (pydantic-core) to see how native machine-code type coercion operates at C-speeds, break down its exact structural ValidationError matrix, and explore the corporate expansion powering PydanticAI and Logfire. https://kfir-g.dev/blog/blogs/pydantic-core-engine-deep-dive https://kfir-g.dev/blog/blogs/2026-05-09_strawberry-graphql-meat Sat, 09 May 2026 00:00:00 GMT Stop over-fetching data and start engineering better contracts. This deep dive explores Strawberry GraphQL, a type-hint-driven library for Python. Learn about AST execution, solving the N+1 problem with DataLoaders, and why moving from REST to a Schema-first approach reduces architectural friction. https://kfir-g.dev/blog/blogs/2026-05-09_strawberry-graphql-meat https://kfir-g.dev/blog/blogs/2026-05-01_anyio-hidden-secrets Fri, 01 May 2026 00:00:00 GMT Efficiency isn't just about speed; it's about reliability. Dive deep into Structured Concurrency with AnyIO. Learn how to eliminate "zombie tasks," bridge the gap between sync and async code, and build resilient Python backends using Task Groups and thread offloading. https://kfir-g.dev/blog/blogs/2026-05-01_anyio-hidden-secrets https://kfir-g.dev/blog/blogs/2026-04-13_s3-engineering-guide Mon, 13 Apr 2026 00:00:00 GMT Move beyond basic S3 uploads. Learn to engineer a resilient file-handling pipeline using chunked streaming to save RAM, server-side MD5 verification for data integrity, and non-blocking async wrappers to keep your FastAPI event loop responsive under heavy load. https://kfir-g.dev/blog/blogs/2026-04-13_s3-engineering-guide https://kfir-g.dev/blog/blogs/2026-04-04_modern-python-postgres-stack Sat, 04 Apr 2026 00:00:00 GMT Master the relational backbone of modern backends. This guide covers the transition to Psycopg3, implementing high-performance connection pooling with async support, transaction integrity patterns, and leveraging PostgreSQL's JSONB for hybrid SQL/NoSQL architectures. https://kfir-g.dev/blog/blogs/2026-04-04_modern-python-postgres-stack https://kfir-g.dev/blog/blogs/2026-02-25_robust-http-python-guide Wed, 25 Feb 2026 00:00:00 GMT Stop treating API calls as secondary utilities. This guide explores building production-grade HTTP clients in Python using HTTPX and Tenacity, covering HTTP/2 multiplexing, exponential backoff with jitter, memory-efficient streaming, and header discipline. https://kfir-g.dev/blog/blogs/2026-02-25_robust-http-python-guide https://kfir-g.dev/blog/blogs/2026-02-13_redis-internals-and-data-structures Fri, 13 Feb 2026 00:00:00 GMT A deep dive into the high-performance world of Redis. This guide explores the single-threaded event loop, specialized data structures like SkipLists and ZipLists, and how to leverage Redis beyond simple caching to build scalable, low-latency backend systems. https://kfir-g.dev/blog/blogs/2026-02-13_redis-internals-and-data-structures https://kfir-g.dev/blog/blogs/2026-02-07_protobuf-fastapi-guide Sun, 07 Feb 2026 00:00:00 GMT An in-depth exploration of using Protocol Buffers with FastAPI. This guide covers everything from installation and setup to advanced usage patterns, performance considerations, and best practices for integrating Protocol Buffers into your FastAPI applications. https://kfir-g.dev/blog/blogs/2026-02-07_protobuf-fastapi-guide https://kfir-g.dev/blog/blogs/2026-01-29_how-uvicorn-listens-on-a-port Thu, 29 Jan 2026 00:00:00 GMT A deep dive into what happens before a FastAPI request reaches your code. This post explains how Uvicorn binds to a port, how the Linux TCP stack handles SYN and accept queues, and why backend engineers must understand the TCP accept path to debug load issues, timeouts, and dropped connections in production. https://kfir-g.dev/blog/blogs/2026-01-29_how-uvicorn-listens-on-a-port https://kfir-g.dev/blog/blogs/2026-01-25_eda-vs-request-response Sun, 25 Jan 2026 00:00:00 GMT A deep, practical comparison between Event-Driven Architecture and classic Request/Response systems. Covers coupling, data reuse, reactivity, architectural flexibility, and real-world backend design trade-offs with concrete examples and diagrams. https://kfir-g.dev/blog/blogs/2026-01-25_eda-vs-request-response https://kfir-g.dev/blog/blogs/2026-01-10_the-ultimate-celery-internals-guide Sat, 10 Jan 2026 00:00:00 GMT A deep, end-to-end breakdown of Celery’s architecture - from FastAPI task calls, AMQP routing, serialization, worker pools, retries, scheduling, and result backends. This guide explains how Celery actually works under the hood and how to build reliable distributed task systems in Python. https://kfir-g.dev/blog/blogs/2026-01-10_the-ultimate-celery-internals-guide https://kfir-g.dev/blog/blogs/2026-01-06_understanding-amqp-protocol Tue, 07 Jan 2026 00:00:00 GMT A practical deep dive into the AMQP protocol. Learn how brokers, exchanges, queues, and acknowledgements work together-and why AMQP quietly powers reliable backend systems at scale. https://kfir-g.dev/blog/blogs/2026-01-06_understanding-amqp-protocol https://kfir-g.dev/blog/blogs/2026-01-06_async-tasks-fastapi-celery Mon, 06 Jan 2026 00:00:00 GMT A backend-focused deep dive into async task execution in Python. Explains the limits of FastAPI background tasks and why mature systems rely on Celery, message brokers, and distributed workers. https://kfir-g.dev/blog/blogs/2026-01-06_async-tasks-fastapi-celery https://kfir-g.dev/blog/blogs/2025-12-31_feed-identity-vs-content-integrity/ Wed, 31 Dec 2025 00:00:00 GMT A concise explanation of the distinction between feed identity and content integrity in podcasting, highlighting their roles in ensuring listeners access the correct content. https://kfir-g.dev/blog/blogs/2025-12-31_feed-identity-vs-content-integrity/ https://kfir-g.dev/blog/blogs/2025-12-30_podcasts-as-a-supply-chain-missing-security-model/ Tue, 30 Dec 2025 00:00:00 GMT Podcasting operates as a large-scale, automated content distribution system, yet lacks the security properties commonly expected from supply chains. This article examines implicit trust assumptions in podcast RSS, content provenance, integrity, and why security modeling matters as podcasts grow in influence, monetization, and scale. https://kfir-g.dev/blog/blogs/2025-12-30_podcasts-as-a-supply-chain-missing-security-model/ https://kfir-g.dev/blog/blogs/2025-12-27_how-swes-should-do-daily-research/ Fri, 27 Dec 2025 00:00:00 GMT Research is a daily discipline, not a one-time task. This post breaks down how strong software engineers research tools, products, topics, and trends-and why consistent, ongoing research quietly compounds over time. https://kfir-g.dev/blog/blogs/2025-12-27_how-swes-should-do-daily-research/ https://kfir-g.dev/blog/blogs/2025-12-25_From-Passive-FastAPI-Developer-to-Real-FastAPI-Engineer--Part-4 Thu, 25 Dec 2025 00:00:00 GMT Wrapping up advanced ASGI concepts with real-world FastAPI patterns. Focused insights on improving performance, middleware, and background tasks. https://kfir-g.dev/blog/blogs/2025-12-25_From-Passive-FastAPI-Developer-to-Real-FastAPI-Engineer--Part-4 https://kfir-g.dev/blog/blogs/2025-12-20_From-Passive-FastAPI-Developer-to-Real-FastAPI-Engineer--Part-3 Fri, 20 Dec 2025 00:00:00 GMT Exploring ASGI middleware, background tasks, and advanced request/response patterns in FastAPI. Learn how middleware intercepts requests and how background tasks enable non-blocking workloads. https://kfir-g.dev/blog/blogs/2025-12-20_From-Passive-FastAPI-Developer-to-Real-FastAPI-Engineer--Part-3 https://kfir-g.dev/blog/old-blogs/2025-12-08_From-Passive-FastAPI-Developer-to-Real-FastAPI-Engineer--Part-2-c02de4a20dad Mon, 08 Dec 2025 00:00:00 GMT Continuing the series on FastAPI and ASGI. Advanced concepts, best practices, and performance tips. https://kfir-g.dev/blog/old-blogs/2025-12-08_From-Passive-FastAPI-Developer-to-Real-FastAPI-Engineer--Part-2-c02de4a20dad https://kfir-g.dev/blog/old-blogs/2025-11-21_From-Passive-FastAPI-Developer-to-Real-FastAPI-Engineer--Part-1--ASGI-059a588a54ae Fri, 21 Nov 2025 00:00:00 GMT Understanding ASGI by Breaking Down an HTTP Request. Learn how FastAPI uses ASGI for async web development. https://kfir-g.dev/blog/old-blogs/2025-11-21_From-Passive-FastAPI-Developer-to-Real-FastAPI-Engineer--Part-1--ASGI-059a588a54ae