MCALAB Blog
Things that actually broke while building Zıpla and our Mac apps, what we measured, and what we ended up doing. Not a list of generic tips: every post is the record of something that happened to us — what we tried, what blew up, what finally worked.
Bu yazının Türkçesi: Türkçe sürüm.
I read the same npm attack in five countries' sources — I got five different stories
I followed the keyv compromise through US reporting, then went looking for the same incident family in Chinese, Russian, French and Israeli sources. What I found was not one story in five languages, but four different questions asked of the same facts.
I stopped reading security news and started reading bulletins — the difference showed up in week one
I put CERT-FR's weekly bulletin next to US security journalism. One explains the incident, the other hands me my queue. Plus the US patching mandate that quietly changed this year.
.NET 10 made 267 MB of garbage disappear from the same code — I measured exactly where the limit is
Which code shapes does .NET 10's widened escape analysis actually move to the stack, and how big can an array be before it stops? I measured it on Apple Silicon by flipping a single JIT switch, and found the cutoff byte by byte.
Tomorrow is the Play deadline — but your app is not getting removed
31 August 2026 is Google Play's target API level deadline. What actually happens, what doesn't, and the thing API 36 really breaks in a portrait-locked game.
Ransomware is giving up on encryption — and that invalidates your backup strategy
Payment rates fell to 28% in 2025, so operators dropped encryption and moved to stealing data and threatening to publish it. Restoring from backup no longer resolves the incident, because the problem is not availability. It is disclosure.
Calling Claude Code from a shell script like a typed function — I measured --json-schema
--json-schema is not a valid-JSON guarantee, it is a hidden tool call. Six runs later: twice as slow, keys going missing, and a silent zero exit code when it fails.
The same behaviour is a vulnerability in one product and a feature in another — nobody has defined what a bug is for agentic browsers
Zenity showed a zero-click attack class against five agentic browsers at Black Hat. They disclosed to all five vendors; some shipped fixes, some argued the behaviour was intended. That split is the actual story.
I wrote .NET on Windows for years, then moved to a Mac — the first wall I hit in Rider was the keyboard
Picking the Visual Studio keymap isn't enough: Rider's macOS version leaves 41 of the Windows shortcuts undefined. I opened the keymap files and dumped every setting I'd changed.
How much more does Turkish cost in tokens? I measured it on my own site
The Turkish and English copy on mcalab.com.tr is the same length in characters. Run it through a tokenizer and Turkish comes out 39% heavier. Here is the full measurement.
A model was switched off for nineteen days — put that in your architecture
In June 2026 Anthropic's most capable model went dark worldwide on a government directive. It was not an outage, and the lesson for a solo developer is not the one you would expect.
Which AI for which job — I decide by the shape of the work, not the brand
I stopped comparing models and started classifying tasks. Four categories, one decision table, and the three jobs I do not hand to an AI.
MCP threw sessions away — and it is the most honest move in the spec
The 2026-07-28 release removed the initialization handshake and the session header. What you lost was not elegance, it was glue. Here is what changed and how to migrate.
Your agent burned 7,600 tokens before it said hello
Tool definitions ship on every single turn and nobody adds them up. I costed a real agent loop using the numbers in Anthropic's own documentation.
Why comparing model prices side by side is misleading — three hidden multipliers
The dollars-per-million-tokens number tells you almost nothing on its own. Tokenizers, long-context cliffs and expiry-dated discounts change the answer completely.
I delegated to an agent, it checked its own work, and it was still wrong
I handed this site's dark theme to an AI agent. It computed the contrast ratios itself, said everything passed, and shipped cards whose borders you could not see. Then I fixed it, and my fix failed too. 24 measurements and the one rule I took from it.
My 128-line Markdown parser is 3x faster than marked — and fails 13 of 14 tests
I wrote a dependency-free Markdown converter, then actually benchmarked it. My stated reason turned out to be nonsense; the real reason was something else entirely.
Advertise & partner
If you want to advertise on this blog or inside our apps, or talk about sponsorship and cross-promotion, there is one address:
ads@mcalab.com.tr