System Design Simple

How big apps really work, explained simply with diagrams. System design, AI coding tools (Claude, Codex) and web security. New short video + article every week.

[System Design Simple @SysDesignSimple]

Our demo's 3 a.m. login rule raised 78.9 false alarms per 1,000 logins, and only 1.9% of its alerts were real. Giving each user a habit card of their own hours, country and devices cut that to 3.8 per 1,000 and caught 15 of 20 plant…

#Security #SystemDesign #CyberSecurity

[System Design Simple @SysDesignSimple]

1M rides a day. What do you do in the first 5 minutes?

Write functional requirements as user actions and non-functional ones as SLOs: an SLI (good ÷ valid events), a target and a window. 99.9% over 30 days leaves a 43.2 minute error…

https://t.co/ZkNjofG6nE

#SystemDesign

[System Design Simple @SysDesignSimple]

Claude Code cloud sessions: how the setup script, cache and network access really work

Each Claude Code cloud session runs in a fresh Ubuntu 24.04 VM. A cloud environment decides its network access, variables and a setup script. The…

https://t.co/CsbDWjDGQ3

#SystemDesign

[System Design Simple @SysDesignSimple]

Multi-tenancy: pool vs silo, tenant context, and noisy neighbor limits

Multi-tenancy serves several customers in one environment, with dedicated (silo) resources, shared (pool) resources, or a mix per layer. In pooled layers, a tenant ID…

https://t.co/JtsvJj7hii

#SystemDesign

[System Design Simple @SysDesignSimple]

Prompt injection: why the AI obeyed a hidden line

Prompt injection works because a model reads the page you ask it to summarize in the same token stream as your instructions, so hidden text can steer it. Marking the page as data plus a…

https://t.co/igM52ql1A5

#SystemDesign

[System Design Simple @SysDesignSimple]

Monolith vs microservices: fault isolation and its cost

Separate services can contain process-fatal faults; bulkheads contain resource exhaustion. Shared dependencies and synchronous calls can still propagate failures. In our simulation…

https://t.co/AyKtxypy9d

#SystemDesign

[System Design Simple @SysDesignSimple]

AI agent permissions: would an agent delete my files?

Unrestricted destructive tools can cause unrecoverable loss without retained versions. In our scripted lab a careless 7-step tidy plan with full access lost 7 of 10 important files, 0…

https://t.co/tPkYEuF4j6

#SystemDesign

[System Design Simple @SysDesignSimple]

Eventual consistency: stale likes and safe withdrawals

A like count can be a few behind because reads go to copies that lag, and that is cheap. For a balance, an atomic conditional debit prevents overdrafts under the stated assumptions:…

https://t.co/l57Cu5Swr4

#SystemDesign

[System Design Simple @SysDesignSimple]

I clicked an AI answer's source and the quote wasn't there. In our lab with 10 synthetic docs, all 60 cited links opened, but 30 planted quotes were missing. A normalized exact match caught 30 of 30 fakes and passed every real quote; a loose …

#AISystems #SystemDesign #AI

[System Design Simple @SysDesignSimple]

47,999 rewrites, because I renamed one mug. Same SQLite engine, same 100,000 users: one document per user vs normalized tables.

#SystemDesign #Database #SQL

[System Design Simple @SysDesignSimple]

Design Instagram's feed: system design in five steps

System design is turning requirements and load into an API, a data model and an architecture whose costs you can compute, then measure. For a feed of 20 posts from 150 follows at an…

https://t.co/n4PgN9QEV6

#SystemDesign

[System Design Simple @SysDesignSimple]

Claude Code sessions can message each other: how the hand-off works

Claude Code sessions can list the other sessions on the same machine and send them short messages. On one machine a message travels over a local socket owned by your…

https://t.co/wG8rG1CJ3f

#SystemDesign

[System Design Simple @SysDesignSimple]

How a leaked password check works without sending the full password

A leaked password check hashes the password with SHA-1 and sends only the first 5 hex characters (a 20-bit prefix) to the Pwned Passwords range API. The service returns…

https://t.co/Rq4aelkMfI

#SystemDesign

[System Design Simple @SysDesignSimple]

Load balancer vs reverse proxy: one door, two jobs

A reverse proxy is a server that takes the client's request and makes its own request to your servers; load balancing (spreading requests over several servers) and caching are two jobs…

https://t.co/dOfx5Ld5SD

#SystemDesign

[System Design Simple @SysDesignSimple]

One database writes, ten read: primary and read replicas

Most apps read far more than they write, so one primary database takes every write and copies each change to read replicas, which serve the reads. In our one-machine simulation, 10…

https://t.co/S7AJI3VohB

#SystemDesign

[System Design Simple @SysDesignSimple]

I hid a fake password in a file and sent the folder to an AI. In our local simulation (scripted stand-in model, nothing transmitted) the password was in 40 of 40 prompts and 40 of 40 simulated log lines, but only 22 of 40 scripted answe…

#AISystems #SystemDesign #Security

[System Design Simple @SysDesignSimple]

Summarize this page, you say. In our simulation (a toy model on one Mac, defence strengths set by us), a hidden line steered 109 of 200 summaries; marking the page as data plus a rule cut it to 28, and only removing the email too…

#PromptInjection #AISystems #SystemDesign

[System Design Simple @SysDesignSimple]

How to create an AI agent skill: one SKILL.md, reused by two agents

An AI agent skill is a folder holding a SKILL.md file: front matter with a name and a description, then plain instructions. The agent reads only the description until a…

https://t.co/K1vtnoBhJI

#SystemDesign

[System Design Simple @SysDesignSimple]

How to check WordPress for CVE-2026-119977: the version, the auto-update blockers and the upgrade folder

CVE-2026-119977 is a race in WordPress full-package core upgrades. Affected branches start at 4.7; releases below each branch's…

https://t.co/HW5BJixdvJ

#SystemDesign

[System Design Simple @SysDesignSimple]

How to check Rails image uploads and lock down ImageMagick (GHSA-f3w6-w445-fwh9)

Per Rails advisory GHSA-f3w6-w445-fwh9, Active Storage apps that analyze untrusted uploads with ImageMagick can allow server file writes. Upgrade…

https://t.co/MTHlh24GhF

#SystemDesign