mhtirogla
Home
Systems
API
Pricing
About
Log in
← Back
Home
›
Systems
›
Observability and operations
uem
unified endpoint management
Intune, Jamf, Kandji
System
Techniques · 30
Primitives · 81
uem
Desired-state reconciliation
distributed · medium: Declare the target in a store; controllers repeatedly diff actual against desired from full state and apply idempotent fixes, so missed events only delay convergence.
›
Deterministic simulation testing
distributed · medium: Run the whole system in one thread under a seeded scheduler with simulated network, disk and clock, so every failure replays from its seed.
›
Device shadow state sync
distributed · medium: Desired vs reported device state documents with versions and delta reconciliation
Durable job queue
distributed · medium: Persisted tasks that workers lease for a visibility timeout, ack on success and retry with backoff; at-least-once execution that survives worker and queue crashes.
›
Primary-backup replication
distributed · medium: One node orders all writes and ships them to standbys; the acknowledgement rule (none, one, all) sets what a crash loses, and an external arbiter decides who takes over.
›
Mobile push delivery
networking · medium: Sending notifications through APNs and FCM: HTTP/2 requests, token hygiene, collapse keys, TTL and priority, and the retry rules that keep you un-throttled.
›
Certificate revocation
security · medium: CRLs, OCSP, OCSP stapling, short-lived certificates and CRLite-style filters for revoked certificates
Exponential backoff with jitter
systems · low: Retry after delays that grow geometrically and are randomized, so failed clients spread out instead of hammering a recovering service in synchronized waves.
›
X509 certificates
security · low: Certificate chains, path validation, SANs, revocation and short-lived issuance
Hdr histogram
data-structures · low: Log-linear bucketed histograms with bounded relative error for latency percentiles
Process supervision
hardware-os · low: A parent process starts services, reaps their exits and restarts them under a delay and burst-limit policy, then stops them with SIGTERM before SIGKILL.
›
Mdm command protocol
networking · low: Device management: server wakes device via push, device fetches queued commands over HTTPS and returns acknowledgements
Aes xts disk encryption
security · low: AES-XTS tweakable sector encryption for block devices; why no integrity and how sector tweaks work
Ldap directory
security · low: LDAP directory model, bind, search filters and group membership queries for enterprise identity
Mutual TLS
security · low: TLS where the client also proves a certificate key, so every connection carries a verified, rotatable machine identity.
›
OAuth 2 and OpenID Connect
security · low: Delegated authorization (OAuth 2) and login on top of it (OIDC); use authorization code + PKCE for every user-facing client.
›
Graceful draining
systems · low: On a termination signal, stop taking new work, finish in-flight work until a deadline, tell clients to reconnect elsewhere, then exit; clients resume from a token.
›
Conditional writes
distributed · low: Put-if-absent / if-match compare-and-swap on objects or keys as a commit primitive
Cooperative scheduling
concurrency · low: Green threads/coroutines yielding at await points on a user-space scheduler
Record replay
distributed · low: Record every nondeterministic input (time, randomness, I/O, model and tool outputs, per-tick player input) and re-execute deterministically for debugging, replays and state rebuild
PRNGs (PCG, xoshiro)
numerics · low: Small, fast, statistically strong non-cryptographic generators: PCG32 and xoshiro256**, with seeding, parallel streams and unbiased ranges.
›
Delta encoding
compression · low: Store differences between consecutive values instead of the values, turning sorted IDs, timestamps and counters into small numbers that pack into few bits.
›
Message sequence numbers
distributed · low: A per-stream counter on every message lets the receiver detect loss, duplicates and reordering, ack cheaply and resume after reconnect with "send from N".
›
+ 23 more techniques
+ 65 more primitives
System
Techniques · 30
Primitives · 81
uem
Desired-state reconciliation
distributed · medium: Declare the target in a store; controllers repeatedly diff actual against desired from full state and apply idempotent fixes, so missed events only delay convergence.
›
Deterministic simulation testing
distributed · medium: Run the whole system in one thread under a seeded scheduler with simulated network, disk and clock, so every failure replays from its seed.
›
Device shadow state sync
distributed · medium: Desired vs reported device state documents with versions and delta reconciliation
Durable job queue
distributed · medium: Persisted tasks that workers lease for a visibility timeout, ack on success and retry with backoff; at-least-once execution that survives worker and queue crashes.
›
Primary-backup replication
distributed · medium: One node orders all writes and ships them to standbys; the acknowledgement rule (none, one, all) sets what a crash loses, and an external arbiter decides who takes over.
›
Mobile push delivery
networking · medium: Sending notifications through APNs and FCM: HTTP/2 requests, token hygiene, collapse keys, TTL and priority, and the retry rules that keep you un-throttled.
›
Certificate revocation
security · medium: CRLs, OCSP, OCSP stapling, short-lived certificates and CRLite-style filters for revoked certificates
Code signing
security · medium: Signing binaries/apps with certificate chains, entitlements, timestamping and notarization
Coverage-guided fuzzing
security · medium: Mutate inputs, run an instrumented target, and keep any input that reaches a new code edge; feedback turns blind guessing into incremental search.
›
Device posture checks
security · medium: Collecting and verifying device health (OS version, disk encryption, EDR running, managed cert) before granting access
Envelope encryption
security · medium: Encrypt each object with its own data key and wrap that key under a KMS-held key, so rotation re-wraps 60 bytes and deleting a key shreds data.
›
Hardware root of trust
security · medium: Secure elements/TPM/TEE holding device keys, attestation and monotonic counters
Policy engines (PDP/PEP, Cedar, Reg…
security · medium: Decide allow/deny for (principal, action, resource, context) in a separate engine with default deny, forbid-wins and an auditable list of determining policies.
›
Remote attestation
security · medium: Hardware-signed evidence (TPM quotes, SGX/TDX quotes, SEV-SNP reports, key attestation) proving device, key or enclave state to a verifier
Saml
security · medium: SAML 2.0 assertions, XML signatures, SP/IdP flows and canonicalization pitfalls
Scim provisioning
security · medium: SCIM 2.0 user/group provisioning API: create, patch, deprovision, filters
Point-in-time recovery
storage · medium: Periodic base backups plus a continuously archived change log let you rebuild the state as of any instant, then branch from there.
›
Staged rollout
systems · medium: Rolling, blue-green and canary rollout with health gates and automatic rollback
Datalog evaluation
compilers · medium: Semi-naive bottom-up evaluation of recursive Datalog rules
Delta debugging
compilers · medium: Ddmin minimization of failing inputs or change sets
Fault injection
distributed · medium: Inject latency, errors, kills and partitions via proxies, netem or hooks
Watch notifications
distributed · medium: A store numbers every write; clients list at revision R, then watch from R+1 and receive an ordered change stream with no gap, no duplicate, and a resume point.
›
Hardware security module (HSM)
security · medium: A tamper-resistant device or service that generates keys, signs, decrypts and wraps with them internally, and releases a key only as ciphertext.
›
Measured boot
security · medium: Each boot stage hashes the next into TPM PCRs (extend) and logs events for later attestation
ARIES recovery
storage · medium: Three-pass crash recovery (analysis, redo, undo) for steal/no-force buffer pools; repeats history, then rolls back losers with compensation log records.
›
Burn rate alerting
systems · medium: Multi-window multi-burn-rate alerts on SLO error-budget consumption
Syscall interception
security · medium: Intercept syscalls via ptrace, seccomp user notify or a user-space kernel
Buffer pool
storage · medium: The database's own page cache (frames, page table, pin counts, dirty bits, replacement) so it, not the OS, controls eviction, write order and I/O.
›
MVCC
storage · medium: Keep timestamped versions of each row so readers see a consistent snapshot without blocking writers; the default concurrency control in modern databases.
›
Rollup aggregation
storage · medium: Fold raw events into one mergeable partial aggregate per time bucket and dimension key, then merge fine buckets into coarser ones, so long ranges read few rows and stay exact.
›
Exponential backoff with jitter
systems · low: Retry after delays that grow geometrically and are randomized, so failed clients spread out instead of hammering a recovering service in synchronized waves.
›
X509 certificates
security · low: Certificate chains, path validation, SANs, revocation and short-lived issuance
Hdr histogram
data-structures · low: Log-linear bucketed histograms with bounded relative error for latency percentiles
Process supervision
hardware-os · low: A parent process starts services, reaps their exits and restarts them under a delay and burst-limit policy, then stops them with SIGTERM before SIGKILL.
›
Mdm command protocol
networking · low: Device management: server wakes device via push, device fetches queued commands over HTTPS and returns acknowledgements
Aes xts disk encryption
security · low: AES-XTS tweakable sector encryption for block devices; why no integrity and how sector tweaks work
Ldap directory
security · low: LDAP directory model, bind, search filters and group membership queries for enterprise identity
Mutual TLS
security · low: TLS where the client also proves a certificate key, so every connection carries a verified, rotatable machine identity.
›
OAuth 2 and OpenID Connect
security · low: Delegated authorization (OAuth 2) and login on top of it (OIDC); use authorization code + PKCE for every user-facing client.
›
Graceful draining
systems · low: On a termination signal, stop taking new work, finish in-flight work until a deadline, tell clients to reconnect elsewhere, then exit; clients resume from a token.
›
Conditional writes
distributed · low: Put-if-absent / if-match compare-and-swap on objects or keys as a commit primitive
Cooperative scheduling
concurrency · low: Green threads/coroutines yielding at await points on a user-space scheduler
Record replay
distributed · low: Record every nondeterministic input (time, randomness, I/O, model and tool outputs, per-tick player input) and re-execute deterministically for debugging, replays and state rebuild
PRNGs (PCG, xoshiro)
numerics · low: Small, fast, statistically strong non-cryptographic generators: PCG32 and xoshiro256**, with seeding, parallel streams and unbiased ranges.
›
Delta encoding
compression · low: Store differences between consecutive values instead of the values, turning sorted IDs, timestamps and counters into small numbers that pack into few bits.
›
Message sequence numbers
distributed · low: A per-stream counter on every message lets the receiver detect loss, duplicates and reordering, ack cheaply and resume after reconnect with "send from N".
›
Mqtt protocol
networking · low: MQTT pub/sub: topics, QoS 0/1/2, retained messages, sessions and keepalive
Dead-letter queue
distributed · low: A side queue for messages that keep failing: after N delivery attempts or a permanent error, park them with the reason so the main queue keeps moving.
›
Leases
distributed · low: A lock that expires on its own: bounded-time ownership that survives crashes and partitions, given bounded clock drift and fencing tokens on writes.
›
Idempotency keys
finance · low: Client-chosen unique key per logical operation, stored with a request fingerprint and the final response, so retries replay the first result instead of acting twice.
›
Write-ahead log
storage · low: Append each change to a checksummed sequential log and fsync it before touching data pages; the basis of crash durability in nearly every database.
›
Health checking
systems · low: Decide per backend whether to route to it using probes and real-traffic errors, with consecutive-count hysteresis, capped ejection and a panic fallback.
›
HTTP/2
networking · low: Binary multiplexed framing for HTTP over one TCP connection: streams, per-stream and per-connection credit windows, HPACK header compression and the limits that contain abuse.
›
JSON Web Token (JWT)
security · low: A signed, URL-safe token carrying claims; the verifier's job is the checklist (pinned algorithm, key by kid, exp, aud, iss), not the format.
›
Token bucket
systems · low: A bucket of up to b tokens refilled at rate r; requests spend tokens, enforcing an average rate while allowing bursts of b.
›
Bloom filter
data-structures · low: Bit array answering "definitely not present" or "probably present" in about 10 bits per key for 1 % false positives; inserts are cheap, deletes impossible.
›
HTTP caching semantics
networking · low: The rules (RFC 9111) that decide whether a stored response is still fresh, and how a cheap conditional request revalidates it when it is not.
›
ECDSA signatures
security · low: The elliptic-curve signature standardised in FIPS 186-5 (P-256) and used by secp256k1 ledgers; 64-byte signatures, but a repeated or biased nonce leaks the private key.
›
Cryptographic hashes (SHA-2, BLAKE3)
security · low: Collision-resistant fingerprints of data; SHA-256 for interoperability, BLAKE3 for speed, HMAC/HKDF for keyed uses.
›
Trusted timestamping
security · low: RFC 3161 time-stamp tokens: a TSA signs a hash with time, proving data existed then
Code coverage instrumentation
compilers · low: Insert counters into compiled code to record which blocks, edges or lines ran; a spanning tree of the control-flow graph cuts the counters needed.
›
Fast hash functions
data-structures · low: Non-cryptographic hashes built from 64×64→128-bit multiplies and xor-shifts; pick by key size, trust level and whether the hash is persisted.
›
Sanitizers
security · low: ASan/UBSan/TSan shadow memory and instrumentation to catch memory bugs
Hardware backed keystore
security · low: Non-exportable keys in Secure Enclave, StrongBox, TPM: generation, use policies, biometric gating
AEAD (AES-GCM, ChaCha20-Poly1305)
security · low: Authenticated encryption that encrypts and detects tampering in one call; the only kind of symmetric encryption you should use.
›
Aes key wrap
security · low: AES Key Wrap (RFC 3394/5649) and AES-GCM-SIV for deterministic, authenticated wrapping of key material
Csprng
security · low: OS-backed cryptographically secure random numbers (getrandom), and when a fast PRNG is not enough
Key sealing
security · low: Encrypting data so only a specific measured enclave/boot state can decrypt it (TPM/SGX sealing)
Secure boot chain
security · low: Each boot stage verifies the signature of the next before running it, anchored in an immutable ROM key hash, with version counters against downgrade and a TPM log of what ran.
›
Recursive-descent parsing
compilers · low: Hand-written top-down parser with one function per grammar rule; simple, fast, with full control over error messages and recovery.
›
Authorization models (RBAC, ABAC, R…
security · low: How to decide who may do what to which object; roles for coarse rules, relationships for sharing, and checks on every object.
›
Trusted execution environments
security · low: Enclaves/confidential VMs with remote attestation for computing on sealed data
Replay protection window
security · low: A highest-seen counter plus a bitmap of the last W numbers rejects duplicates and stale messages in O(1) with a few hundred bytes of state.
›
Rsa cryptosystem
security · low: RSA key generation, OAEP encryption and PSS/PKCS#1 v1.5 signatures, key sizes and padding pitfalls
XML Streaming Parser
storage · low: Tokenize XML into start, text and end events in constant memory, so a few fields can be extracted from huge, broken or hostile documents.
›
Cursor pagination
networking · low: Keyset/opaque-cursor pagination for stable incremental reads from APIs and tables
JSON Schema validation
security · low: Compile a JSON Schema once, then check every untrusted document against it, within hard size and depth limits, and report failures as JSON Pointers.
›
Object storage
cloud · low: S3-compatible blob storage at cents per GB-month with 11 nines durability; pick by egress price, request price and latency, not by storage price alone.
›
Copy on write snapshots
storage · low: Point-in-time snapshots by sharing pages/extents and copying only on write
Deterministic bucketing
systems · low: Hash a stable unit id with a per-purpose salt into a bucket; "in" means bucket below the percentage, so assignment is stateless, repeatable and only grows on ramp-up.
›
Traffic splitting
systems · low: Weighted routing between versions for canaries and A/B, sticky by hash
Strongly connected components
graphs · low: Tarjan/Kosaraju SCCs for cycle detection in dependency graphs
Topological sort
graphs · low: Order the vertices of a DAG so every edge points forward; the core of build systems, schedulers and dependency resolution, with cycle detection for free.
›
B+ tree
storage · low: Balanced high-fanout search tree with all values in linked leaves; the default on-disk index for point lookups and range scans.
›
Hash join
storage · low: Build a hash table on the smaller input's join key and probe it with every row of the larger one; the linear-time workhorse for equi-joins.
›
Failure bisection
search-sort · low: Binary search over commits, batches or inputs to isolate a failure
Transparent interception
networking · low: Redirect traffic to a local proxy (iptables TPROXY/REDIRECT, eBPF) without app changes
Grpc protocol
networking · low: GRPC framing over HTTP/2: unary and streaming RPCs, deadlines, status
Dual control approval
security · low: Four-eyes / maker-checker approval with quorum policies for sensitive operations
Secure memory zeroization
security · low: Keep secrets in one locked, fixed-size, non-copyable region, erase them with writes the compiler must keep, and exclude them from dumps and swap.
›
Sliding-window counters
systems · low: Count events in the last W seconds with a ring of sub-bucket counters; the two-bucket weighted estimate gives rate limits in 16 bytes per key.
›
Ebpf
hardware-os · low: Verified in-kernel programs on hooks (kprobes, XDP, tc) with maps
Ptrace process control
hardware-os · low: Ptrace: attach, read and write registers and memory, single-step, intercept signals
Seccomp bpf
security · low: Syscall filtering with seccomp BPF programs
fsync, O_DSYNC and O_DIRECT
hardware-os · low: What fsync, fdatasync, O_DSYNC, O_DIRECT and F_FULLFSYNC really guarantee on Linux and macOS, and the exact call sequences for crash-safe files.
›
LRU and CLOCK
systems · low: LRU evicts the least recently used entry via hash map plus linked list; CLOCK approximates it with a reference bit, so hits take no lock.
›
S3-FIFO
systems · low: Three FIFO queues (small, main, ghost) that evict one-hit wonders quickly and keep reused objects; low miss ratios with no list moves on hits.
›
Hash aggregation
storage · low: GROUP BY via hash tables with partitioning and spill to disk
Time partitioning
storage · low: Cut a table into fixed-interval time blocks so queries read only overlapping blocks and retention drops a whole block as one metadata change.
›
Control-flow graph
compilers · low: Split a linear instruction list into basic blocks and connect them by jumps; the graph every optimizer, SSA builder and dataflow pass walks.
›
Bit packing and PFOR
compression · low: Store blocks of integers with exactly b bits each and patch rare outliers separately (PFOR); the fastest integer codec family, billions of values per second.
›
Varint (LEB128)
compression · low: Variable-length integers in 7-bit groups with a continuation bit; small numbers take 1 byte, the wire format of Protobuf, WebAssembly and DWARF.
›
d-ary heap
data-structures · low: Array heap with d children per node (d = 4 typical): half the binary heap's depth, siblings in one cache line, faster priority queues.
›
Fencing tokens
distributed · low: A number that grows with every lock grant and is checked by the protected resource, so a paused ex-holder's late write is rejected.
›
BFS and DFS
graphs · low: The two basic graph traversals; BFS gives hop distances and levels, DFS gives discovery/finish order for cycles, components and topological order.
›
Minimum spanning tree
graphs · low: Cheapest set of edges connecting all vertices; Kruskal sorts edges and joins components with union-find, Prim grows one tree, Boruvka merges in parallel rounds.
›
Union-find
graphs · low: Disjoint-set forest with union by size and path compression; merges sets and answers same-set queries in effectively constant time.
›
CRC32C checksums
hardware-os · low: The Castagnoli CRC-32 with dedicated instructions on x86 (SSE4.2) and ARMv8. It is the standard fast integrity check for storage blocks, logs and network frames.
›
SIMD programming
hardware-os · low: Process 4-16 lanes per instruction with AVX2, AVX-512 or NEON via Rust std::arch, with runtime dispatch and a portable fallback.
›
Sparse matrices (CSR)
numerics · low: Compressed sparse row stores only nonzeros as row pointers, column indices and values; SpMV streams them once, so it is memory-bandwidth bound.
›
Constant time code
security · low: Writing secret-dependent code without branches or memory lookups on secrets; constant-time compare and select
Copy for AI
Similar systems
Share the most building blocks with this one.
compliance-automation
41 %
physical-access-control
38 %
iga
36 %
zero-trust
35 %
agent-identity
34 %