The wiki

Every acronym and specialist term in the drawing set, explained in plain language —351 entries. Hit a big word anywhere on the site; this is where it opens up.

Math 1

2²⁴The largest run of whole numbers a 32-bit float can count without skipping any.

Graphics 141

2D arrayA texture made of several stacked 2D image layers, selected by an index.
A/B validationChecking your implementation by running the same work through a trusted reference and comparing outputs.
access chainA shader instruction that computes a pointer to a specific piece inside a larger data structure.
adjacencyA way of feeding triangles or lines to the GPU that also hands over their neighboring vertices.
anisotropy / anisotropic filteringA texture-quality feature that keeps surfaces sharp when viewed at a steep angle.
apiVersionA field where a Vulkan driver states which version of the graphics API it supports.
barrierA synchronization point that makes parallel work wait until everyone reaches it or memory is consistent.
bit-exactProducing output identical to a reference down to every last bit.
bitmap textText drawn from pre-made pixel images of each character rather than scalable outlines.
blendCombining a newly drawn pixel with the color already on screen, as for transparency.
blend matrixThe full grid of ways a new pixel colour can be mathematically combined with the colour already on screen.
blendingMixing a newly drawn pixel's colour with the colour already sitting in the framebuffer, instead of overwriting it.
blitA fast bulk copy of a rectangular block of image pixels from one place to another, optionally scaling it.
BresenhamA classic algorithm that draws a straight line on a pixel grid using only integer addition — no slow division or floating point.
builtinSpecial pre-defined variables a shader program reads from or writes to in order to talk to the graphics pipeline.
command bufferA recorded list of GPU commands that you build up and then submit for the graphics card to execute.
compute pipelineA GPU setup for running general math work rather than drawing graphics.
compute shaderA GPU program that does general-purpose parallel math instead of producing pixels.
conformanceOfficial certification from a standards body that a driver genuinely meets the specification.
conformance groupA named bundle of official test cases covering one feature area of a graphics spec.
conformanceVersionA Vulkan field a driver fills in to state which version of the conformance tests it is officially certified against.
conformanceVersion / apiVersionTwo Vulkan version fields: one declaring which API level a driver targets, the other whether it's certified for it.
CTS / conformanceAn official test suite that checks whether an implementation actually obeys a standard.
cube mapA texture made of six square images arranged as the faces of a cube, sampled by pointing a direction outward from the center.
cullingThrowing away geometry the viewer can't see before spending time drawing it.
depth bufferA hidden per-pixel scratchpad that records how far away the nearest drawn surface is.
depth testThe per-pixel check that decides whether a new surface is in front of what's already been drawn.
dEQPKhronos's official test program for checking that a graphics driver conforms to standards like Vulkan.
descriptorA small handle that tells a shader where to find a resource like a texture or buffer.
descriptor / descriptor setA grouped bundle of resource bindings handed to a shader together.
direct-binding I/OAn optimization that wires a shader's inputs and outputs straight to their storage, skipping indirection.
draw callA single command telling the GPU to render a batch of geometry.
dynamic renderingA Vulkan feature that lets you render without pre-declaring a rigid render-pass object first.
elect / ballotGPU operations where a group of parallel threads votes or picks a single representative.
fixed-function tessellatorThe tessellator is a non-programmable GPU stage that subdivides coarse patches into many small triangles.
fpsFrames per second is how many complete images a renderer draws each second — higher means smoother motion.
fragmentA fragment is a candidate pixel produced when the GPU rasterizes a triangle, before it is finalized on screen.
fragment shaderA fragment shader is a small program the GPU runs for every fragment to decide its final color.
framebufferA framebuffer is the block of memory holding the image being rendered, essentially the picture that becomes the screen.
frustum clippingFrustum clipping discards or trims geometry that falls outside the pyramid-shaped volume the camera can actually see.
GDIGDI is the classic Windows Graphics Device Interface, an older API for drawing to the screen and printers.
geometry shaderA geometry shader is a programmable GPU stage that can take a primitive and emit new primitives from it.
gl_Layergl_Layer is a shader built-in variable that selects which layer of a layered render target to draw into.
gl_PrimitiveIDgl_PrimitiveID is a shader built-in giving the index number of the primitive currently being processed.
gl_PrimitiveID / gl_LayerA pair of shader built-ins: one identifies the current primitive, the other picks which render-target layer to write to.
GLSLGLSL is the OpenGL Shading Language, a C-like language for writing GPU shader programs.
GLSL.std.450GLSL.std.450 is the standard library of built-in math functions available to shaders in the SPIR-V format.
GPUA GPU is a processor specialized for doing many simple calculations in parallel — originally for graphics, now also for ML.
gradient quadA gradient quad is a simple benchmark: one rectangle filled with a smooth color gradient, used to measure raw draw speed.
honesty forkAn honesty fork is a deliberate code-path split so the software never claims to support a feature it does not truly back.
ICDAn ICD is the driver plug-in that a graphics loader uses to actually talk to a specific GPU.
immediate-mode UIAn immediate-mode UI rebuilds its widgets from scratch every frame instead of keeping persistent widget objects.
indexed drawAn indexed draw renders geometry using a list of indices that reference a shared pool of vertices, so vertices can be reused.
indirect drawAn indirect draw reads its own parameters — how many vertices, how many instances — from a GPU buffer instead of from the CPU.
instancingDrawing many copies of the same shape in a single GPU command instead of one command per copy.
IOSurfaceAn Apple mechanism for sharing a chunk of graphics memory between processes and the GPU without copying it.
KhronosThe industry consortium that writes open graphics and compute standards like Vulkan.
Khronos CTSThe official test suite that checks whether a graphics implementation actually conforms to the Vulkan spec.
maxMultiviewViewCountA Vulkan limit stating how many views a GPU can render simultaneously in a single pass using multiview.
MetalApple's low-level API for programming the GPU on Macs, iPhones, and iPads.
mip / LODChoosing which pre-shrunk version of a texture to use based on how far away a surface is.
mipmapA stack of pre-computed, progressively smaller copies of a texture image.
mipmap / LODPre-shrunk texture copies (mipmaps) plus the rule that picks which one to sample (LOD).
MoltenVKA translation layer that lets Vulkan graphics code run on Apple devices by converting it to Metal.
MRTWriting to several output images at once in a single rendering pass.
MSAAAn anti-aliasing technique that smooths jagged edges by sampling each pixel at several points.
multiviewRendering the same scene to several viewpoints in one pass, such as the two eyes of a VR headset.
NEONARM's instruction set for doing the same math on many numbers at once.
neuter-testedVerifying a feature is real by also testing it turned off, to prove the on/off switch is honest.
NotSupportedA test verdict meaning a feature is honestly absent — not broken, just not present.
NSViewThe basic building block for anything drawn on screen in a Mac app.
OpEmitVertex / OpEndPrimitiveThe GPU shader instructions that output a vertex and finish a shape inside a geometry shader.
OpKillThe GPU shader instruction that throws away the current pixel so it's never drawn.
OpPhiA shader instruction that picks a value depending on which code path was taken to reach it.
perspective divideThe step that makes far-away 3D things look smaller by dividing each point's coordinates by its distance value.
perspective-correct interpolationBlending values like color or texture across a triangle in a way that respects 3D depth, so surfaces don't look warped.
pipelineThe ordered assembly line of stages a GPU runs to turn 3D geometry into the colored pixels on screen.
pipeline-creation timeThe moment shaders get compiled to native GPU machine code — when a Vulkan pipeline object is built, before any drawing.
pixel lane / fragment laneOne slot in the GPU's parallel machinery that processes a single pixel, several of which run side by side at once.
post-processingVisual effects applied to the whole finished image after the 3D scene has already been drawn.
PPMA dead-simple uncompressed image file format that stores raw pixel color values in plain form.
primitiveThe basic shape a GPU actually draws — a point, a line, or a triangle.
primitive assemblyThe pipeline stage that groups individual vertices into the actual shapes (triangles, lines) to be drawn.
primitive restartA special marker value in an index list that says 'stop this strip of connected shapes and start a new one.'
push constantA tiny bit of data sent straight into a shader for the next draw, faster than the usual buffer setup.
rasterizerThe GPU component that turns geometric shapes into the actual grid of pixels that fill them.
rasterizer / rasterizationThe process of converting shapes into fragments (pixel-sized pieces) for the GPU to color in.
render pass / subpassVulkan's way of formally declaring a chunk of rendering and its internal steps up front, so the GPU can optimize it.
render targetThe image a GPU draws its output into — which need not be the screen itself.
resolveCollapsing a multi-sample (anti-aliased) image down to one clean sample per pixel.
retained modeA UI approach where you build a lasting tree of objects and the system remembers and redraws them for you.
robustBufferAccessA GPU safety feature that makes out-of-bounds buffer reads/writes in a shader return harmless results instead of crashing.
row-band parallelismSpeeding up rendering by splitting the image into horizontal strips and giving each strip to a different worker thread.
sample-rate / per-sample shadingRunning a pixel's shading calculation separately for each anti-aliasing sample instead of once for the whole pixel.
samplerA GPU object that describes how a texture should be read — how it's filtered and how coordinates outside its edges behave.
scanlineA single horizontal row of pixels being filled in as a shape is drawn.
scanline rasterizerThe engine that turns triangles and shapes into pixels by filling them one horizontal row at a time.
scissorA rectangle that clips rendering so pixels outside it are never drawn.
screen-space derivativeHow fast a value changes from one pixel to the next on screen, computed by comparing neighboring pixels.
shaderA small program that runs on the GPU to compute part of how a scene is drawn.
shaderInt32A Vulkan feature guaranteeing shaders can do exact 32-bit integer math.
shaderInt8/16Vulkan features letting shaders use 8-bit and 16-bit integer types, including in storage buffers.
shared memoryFast scratch memory that a group of GPU threads can all read and write to cooperate.
shuffleA GPU operation that lets threads in a small group directly swap values without going through memory.
sparseA GPU resource that only needs part of its memory actually backed, so huge resources can be partially loaded.
SPIR-VThe compiled binary format that Vulkan shaders are shipped in, independent of any GPU or source language.
sRGBThe standard color encoding for images and displays that stores brightness in a perceptual, gamma-curved way.
SSAAAn anti-aliasing method that renders the whole image at higher resolution then shrinks it for smooth edges.
SSBOA large GPU buffer that shaders can both read from and write to freely.
SSEIntel's family of x86 instructions that process several numbers at once for faster math.
stencilA per-pixel scratchpad the GPU uses to mask off which pixels are allowed to be drawn.
storage imageAn image that shaders can both read from and write to directly, like a 2D array in memory.
storage widthHow many bits are used to hold a single value in memory — typically 8, 16, or 32.
subgroupA small hardware bundle of shader threads on a GPU that all run in lockstep together.
subgroup quadA subgroup operation restricted to a 2x2 block of neighbouring pixels.
surfaceThe drawable target that connects a GPU to an actual window on screen.
swapchainA rotating queue of images the GPU draws into and then hands to the display one at a time.
swizzleReordering or duplicating the components of a vector or colour, like turning RGBA into BGRA.
TCS / TESThe two GPU shader stages that control and then generate the extra geometry when a surface is subdivided.
tessellationA GPU stage that subdivides coarse shapes into many finer triangles for extra detail.
tessellationShaderThe Vulkan on/off flag declaring whether a GPU driver actually supports tessellation.
texel / texelFetchA texel is one pixel of a texture; texelFetch grabs exactly that pixel with no smoothing.
texel bufferA plain memory buffer that a shader can read as if it were a one-dimensional texture.
texture samplingReading a smoothly-interpolated colour from a texture image inside a shader.
topologyHow a GPU interprets a list of vertices — as separate points, connected lines, or triangles.
UBOA block of constant values a GPU shader can read but not change during drawing.
uniformConstant data passed into a GPU shader that stays fixed for the whole draw.
unnormalizedCoordinatesA sampler mode that addresses a texture by actual pixel position instead of a 0-to-1 fraction.
vertex shaderA small GPU program that runs once per corner point of your 3D geometry.
vertex shadingThe rendering stage that processes each 3D corner point, mainly to compute where it lands on screen.
view maskA bit pattern that picks which of several simultaneous views a rendering pass draws into.
viewportThe rectangular region of the screen that your rendered image gets mapped onto.
VK_EXT_metal_surfaceA Vulkan add-on that lets a Vulkan program draw onto a window managed by Apple's Metal graphics system.
VK_TRUE / VK_FALSEVulkan's own spelling of the boolean values true and false.
VMAA common approach for carving big GPU memory allocations into many smaller pieces efficiently.
VulkanA modern, low-level programming interface for talking directly to graphics and compute hardware.
Vulkan 1.0/1.1/1.2/1.3/1.4The successive version levels of the Vulkan API, each folding in more features as standard.
Vulkan loaderThe middle layer that finds the right Vulkan driver and forwards your Vulkan calls to it.
WaylandThe modern protocol Linux uses to let applications put windows on screen.
WSIThe part of Vulkan that connects GPU rendering to an actual on-screen window.
X11The long-established system for displaying application windows on Unix and Linux.

OS 114

.ko moduleA driver file the Linux kernel can load and unload while running, without rebooting.
/etc/shadowThe Unix file that stores users' password hashes, readable only by the system.
/procA fake filesystem that lets you read live kernel state as if it were ordinary files.
/proc/faultsA live file that reports program faults, including the exact code location that failed.
acquire / releaseThe two paired steps of taking and giving back a lock, with memory-ordering guarantees.
address spaceThe private map of memory addresses a process is allowed to use.
ARM64 / aarch64The 64-bit version of the ARM architecture; 'aarch64' is just another name for it.
ARPThe protocol that finds a device's hardware address from its IP address on a local network.
atomicAn operation that happens all at once, with no chance for another thread to interrupt it midway.
bare metalSoftware running directly on the hardware with no operating system underneath.
big-endianA byte ordering that stores a number's most significant byte first.
BIOSThe low-level firmware that starts a machine and hands control to the operating system.
blast radiusHow much of a system a single failure takes down with it.
bootloader / mzBIOSThe very first code that runs when a machine powers on, whose job is to wake the hardware and hand control to the operating system.
cloneA system call that creates a new process or thread, letting the child share chosen resources with its parent.
CMPXCHGThe x86 CPU instruction that atomically compares a value in memory and swaps in a new one only if it matched.
CNTPARM's built-in hardware timer that counts real elapsed time, used during boot and scheduling.
CocoaApple's native application framework for building macOS app windows and interfaces.
code-segment selectorAn x86 register value that identifies which block of executable memory the CPU is currently running code from.
compare-and-swap (CAS)An atomic operation that updates a value only if it still equals what you expected, all in one indivisible step.
compositorThe component that takes all the individual windows and combines them into the single image shown on screen.
context switchThe kernel saving one thread's full state and loading another's, so a single CPU can juggle many tasks.
coreOne independent execution unit inside a CPU that can run a thread on its own.
CPU exception / trapThe CPU automatically jumping into special handler code when something like a fault or error occurs.
critical sectionA stretch of code that must be run by only one thread at a time to avoid corruption.
deadlockTwo tasks each frozen forever, each waiting for a resource the other is holding.
Device Tree Blob (DTB)A compact file that tells the operating system what hardware is present, since the CPU can't just discover it.
DHCPThe protocol that hands a device an IP address automatically when it joins a network.
DNSThe system that turns a human-readable name like example.com into the numeric address computers use.
double freeA memory bug where the same block of memory is released twice, corrupting the allocator.
DTBA binary file describing a machine's hardware, handed to the kernel at boot.
EL0 / EL1ARM's privilege tiers: EL0 is ordinary app code, EL1 is the operating-system kernel.
ELFThe standard file format for executable programs and libraries on Linux and similar systems.
execveThe specific system call that loads a new program and starts running it in place of the current one.
EXT4The standard, mature filesystem used by most Linux installations to organize files on disk.
FAT32An old, extremely widely supported filesystem, common on USB drives and memory cards.
faultA CPU exception raised when a program does something illegal, like touching memory it shouldn't.
file descriptorA file descriptor is a small integer the operating system hands you to refer to an open file, socket, or other I/O channel.
firmwareFirmware is the low-level software that runs first at power-on and prepares the machine before the operating system takes over.
forkfork is the Unix system call that creates a new process by duplicating the one that calls it.
fork / cloneCloning creates a new process or thread; the fresh child begins execution at its own defined entry point.
FP/SIMDFP/SIMD refers to a CPU's floating-point and vector registers, which hold decimal math and batched parallel data.
GICThe GIC is ARM's Generic Interrupt Controller, the hardware that routes device interrupts to CPU cores.
GPTGPT here means GUID Partition Table, the modern scheme for describing how a disk is divided into partitions.
GRUBGRUB is a widely used bootloader — the program that loads and starts an operating system kernel at boot.
i386i386 is the 32-bit Intel x86 architecture, an older CPU target the OS still supports.
ICMPICMP is the network protocol for control and diagnostic messages, most famously used by ping.
initrdA small temporary filesystem loaded into RAM at boot so the kernel has the tools it needs before the real disk is ready.
interrupt / IRQA hardware signal that yanks the CPU away from what it's doing to handle something urgent, like a keypress or timer.
interrupt controllerThe hardware traffic cop that decides which device interrupts reach the CPU and in what order.
IPCThe mechanisms that let separate programs talk to each other and pass data.
IPv4The most widely used addressing scheme of the internet, giving each device a numeric address like 192.168.0.1.
kernelThe core program of an operating system that controls memory, running programs, and hardware.
kernel argumentsSettings handed to the kernel at boot to change how it starts up.
kernel heapThe kernel's own pool of memory it hands out and takes back as it runs.
libcThe standard library of basic building-block functions every C program relies on.
linkerThe tool that stitches separately compiled code pieces into one runnable program, resolving the references between them.
load-exclusive/store-exclusive (LL/SC)An ARM pair of instructions used to update shared memory safely, by detecting if anyone else touched it in between.
MBRThe first sector of a disk that historically told the computer how the disk is partitioned and how to start booting.
mmapA system call that makes a file or a block of memory appear directly in a program's address space.
MMIO / memory-mapped I/OControlling hardware devices by reading and writing special memory addresses wired to the device instead of to RAM.
MMUThe hardware unit that translates the addresses a program uses into real physical memory locations.
mprotectA system call that changes what a program is allowed to do with a region of its memory — read, write, or execute.
mutexA lock that lets only one thread into a protected section at a time, putting others to sleep while they wait.
mutual exclusionThe guarantee that only one thread or CPU is inside a given critical section at any moment.
NATA networking trick that lets many devices behind one router share a single public internet address.
page faultThe interrupt that fires when a program touches memory that isn't currently mapped in.
page tableThe lookup structure the CPU uses to map a program's virtual addresses to real physical memory.
pagingThe virtual-memory scheme that splits memory into fixed-size chunks and maps them flexibly.
parted / mkfs / grub-installStandard Linux command-line tools for partitioning a disk, creating a filesystem, and installing a bootloader.
PC (program counter)The CPU register holding the address of the instruction currently being executed.
per-CPU stateData kept in a separate copy for each processor core, so cores don't step on each other.
PID / TIDUnique ID numbers the operating system assigns to each running program (PID) and each thread inside it (TID).
POSTThe self-check a computer runs the instant it powers on, before loading anything, to confirm the hardware works.
preemption / preemptiveWhen the OS forcibly pauses a running thread mid-execution to let a different one run.
program counter (PC)The CPU register that holds the address of the instruction currently being executed.
QEMUSoftware that emulates a whole computer, so an operating system can boot and run inside a window instead of on real hardware.
race / race conditionA bug where the outcome depends on the unpredictable timing of two things happening at once.
reaperA background kernel thread that cleans up threads that have finished, freeing their resources.
reassemblyPutting a message back together from network packets that arrived split up or out of order.
relocationFixing up a program's internal addresses when it gets loaded into a different memory spot than it was built for.
retransmitResending network data that got lost, so the receiver eventually gets a complete, correct stream.
return frameThe saved snapshot of a thread's state that the CPU restores to resume it exactly where it left off.
ring bufferA fixed-size log that wraps around, overwriting the oldest entries once it fills up.
RosettaApple's translation layer that lets software built for Intel (x86) Macs run on newer ARM-based Apple chips.
round-robinA scheduling rule that gives each waiting task an equal turn, one after another in a fixed rotation.
schedulerThe part of an operating system that decides which thread runs on the CPU next, and switches between them.
segfault / segmentation faultA crash triggered when a program touches memory it isn't allowed to access.
semaphoreA counter used to coordinate threads, letting a limited number proceed while others wait.
serial portA very simple, low-level hardware channel used to print text out of a machine one character at a time.
SMPA computer with multiple equal CPU cores that share the same memory and can all run tasks at once.
spinlockA lock where a CPU waiting for it just keeps re-checking in a tight loop until it's free.
stack pointerA CPU register that always points to the top of the current call stack in memory.
SVCThe ARM CPU instruction a program runs to ask the operating system kernel for a service.
syscallThe controlled doorway a program uses to ask the operating system kernel to do something for it.
TCPThe internet protocol that turns unreliable packets into a dependable, ordered stream of data.
timer tickA regular clock interrupt that lets the operating system periodically take control and switch tasks.
TLBA small fast cache in the CPU that remembers recent translations from virtual to physical memory addresses.
trap vectorA number the CPU records to say which kind of error or interrupt just occurred.
two-stage bootloaderA boot design where a tiny first program's only job is to load a bigger, smarter second program.
UDPA fast, fire-and-forget way to send network packets with no guarantee they arrive or arrive in order.
uidA number identifying which user an account or process belongs to.
use-after-freeA bug where a program keeps using a piece of memory after it has already been handed back and freed.
userspaceThe world where ordinary programs run, kept separate from the privileged core of the operating system.
virtioA standard way for a virtual machine to talk to fast, simplified virtual hardware.
virtio-blkThe virtio virtual disk — how a guest OS reads and writes storage inside a virtual machine.
virtio-net / virtio-pciThe virtio virtual network card, and the virtual PCI bus that virtio devices attach to.
virtual memoryGiving each program its own private-looking memory space that the hardware maps to real physical memory behind the scenes.
waitpidA system call a parent process uses to wait for and collect the exit status of its child.
wgetA command-line tool that downloads files or web pages over HTTP.
Win32The classic set of functions Windows programs call to do everything from open windows to read files.
x86 asm / ARM asmThe lowest-level human-writable code, one dialect for Intel-style CPUs and one for ARM chips.
x86_64The 64-bit version of the x86 CPU architecture used by modern PCs and servers.
zombie reapingCleaning up finished child processes that still occupy a slot in the process table.

Crypto 60

AEADEncryption that both hides data and proves it wasn't tampered with.
AESThe standard symmetric cipher used to encrypt data with a shared secret key.
AES / AES-GCMThe AES cipher, often used in GCM mode to encrypt and authenticate at once.
AES-GCMAES run in a mode that encrypts data and detects tampering in a single step.
BERserkA family of vulnerabilities that forge RSA signatures by exploiting sloppy padding checks.
Bleichenbacher forgeryA 2006 attack that forges RSA signatures when padding is parsed too loosely.
blindingA trick where a secret operation is scrambled with a random value first, so its timing or power use reveals nothing about the secret.
certificate authority (CA)A trusted party allowed to vouch for identities by signing digital certificates.
certificate chainAn ordered sequence of certificates linking the one you're checking up to a root you already trust.
ChaCha20-Poly1305A widely used pairing that both encrypts data (ChaCha20) and proves it wasn't tampered with (Poly1305).
chain verificationChecking that a certificate is legitimately signed all the way up to an issuer you trust.
constant timeCode whose running time doesn't depend on the secret values it handles, so timing reveals nothing.
constant-timeA coding discipline where execution timing never varies based on secret data.
constant-time equalA comparison that checks whether two secret values match without stopping early on the first difference.
CSPRNGA random-number generator strong enough for security use, where outputs can't be predicted even by an attacker.
DERA strict binary format for encoding structured data such as cryptographic certificates.
differential oracleA testing method that checks your code by comparing its output, byte for byte, against a trusted reference implementation.
Diffie-HellmanA method for two parties to agree on a shared secret over a public channel without ever transmitting it.
ECDSAA widely used way to create and verify digital signatures using elliptic-curve math.
ECDSA P-256ECDSA signatures using the specific, widely trusted NIST P-256 elliptic curve.
entropyRaw unpredictability — the fresh randomness that cryptography needs to be secure.
handshakeA handshake is the opening negotiation of a secure connection where both sides agree on keys before any data flows.
HKDFHKDF is a standard method for turning one shared secret into several strong, purpose-specific keys.
HMACHMAC is a way to attach a secret-keyed tag to a message so the receiver can verify it was not altered or forged.
initialisation vector (IV)An initialisation vector is a per-message random or unique value that makes encryption of the same data look different each time.
key materialThe actual secret bytes that make up a cryptographic key.
key scheduleThe step-by-step process that derives the actual encryption keys used in a session from an initial shared secret.
leaf certificateThe specific certificate that proves a single website's identity, at the bottom of a chain of trust.
low-order-point rejectionA safety check that refuses certain malicious inputs which would weaken elliptic-curve key exchange.
MD5An old hash function, now considered broken for security, that turns data into a short fixed-size fingerprint.
modular exponentiationRaising a number to a large power and taking the remainder — the core arithmetic behind RSA.
nonceA number used exactly once, to keep repeated encryptions from looking identical.
OpenSSLA widely used open-source library for encryption and secure network connections.
PKCS#1 v1.5An older standard way to pad data before RSA signs it, whose loose parsing has historically let attackers forge signatures.
pre-shared key (PSK)A secret both sides already agreed on beforehand, used to bootstrap secure communication without a fresh negotiation.
record layerThe part of TLS that chops your data into chunks and encrypts each one for sending.
RFC 8448An official document that walks through a complete example TLS 1.3 connection, byte by byte, for testing.
RFC 8996The official document that declares the old TLS 1.0 and 1.1 protocols obsolete and unsafe to use.
RSAA classic public-key cryptography system where a public key encrypts or verifies and a separate private key decrypts or signs.
security auditA careful review of a system by experts specifically looking for security weaknesses.
self-signed certificateA digital certificate signed by its own key rather than by a trusted authority.
SHA-1An older cryptographic hash function now considered broken and kept only for backward compatibility.
SHA-2 / SHA-256A widely trusted family of cryptographic hash functions that turn any data into a fixed-size fingerprint.
SHA-256/384/512The SHA-2 hash family at three output sizes — 256, 384, or 512 bits — trading speed for a longer fingerprint.
table-free AESAn AES encryption implementation that avoids memory lookup tables so its timing can't leak the secret key.
test vectorsOfficial known input-and-expected-output pairs used to prove a crypto implementation is correct.
timing leak / side channelWhen how long an operation takes secretly reveals the private data it worked on.
TLSThe protocol that encrypts internet connections — the 's' in HTTPS.
TLS 1.3The current, streamlined version of the TLS encryption protocol.
TLS 1.3 record layerThe part of TLS 1.3 that chops the data stream into chunks and encrypts each one.
to-be-signed (TBS) bytesThe exact bytes of a certificate that a digital signature actually covers.
traffic secret / traffic keysThe per-direction keys TLS derives to encrypt the actual data flowing each way.
transcript hashA running fingerprint of every handshake message, used to lock the keys to what was actually said.
trust anchorThe known-good root certificate that a chain of certificates must ultimately trace back to before you'll trust it.
volatileA C keyword that tells the compiler a variable's memory must really be touched and not optimized away.
wildcard matchingLetting one certificate cover many hostnames by matching a pattern like *.example.com.
X.509The standard format for digital certificates that bind an identity to a public key.
X25519A fast, widely trusted method for two parties to agree on a shared secret over an open channel.
X25519 / Curve25519Curve25519 is the underlying math; X25519 is the key-agreement function built on it.
zsecThe project's self-contained security core, built without relying on outside libraries.

Build 33

#ifdefA C preprocessor switch that includes or excludes code depending on a compile-time flag.
A/B testRunning the same suite twice — feature off, then on — to measure exactly what the feature changed.
assertionA runtime check that says 'this must be true here,' and complains loudly if it isn't.
bytecodeA compact, low-level instruction stream that a virtual machine or interpreter runs, sitting between source code and the raw CPU.
C subsetA deliberately limited slice of the C language — enough to be useful, small enough for a compact compiler to handle.
C99 / C23Two dated revisions of the C language standard — the 1999 one and the 2023 one.
calling conventionThe agreed rulebook for how one function passes arguments to another and gets a result back.
change orderA single tracked unit of work — one scoped, recorded change from start to finish.
CMakeA build system generator that turns one project description into builds for many compilers and platforms.
control flowThe order in which a program's statements run, shaped by its branches and loops.
cross-compileBuilding software on one kind of machine to run on a different kind.
fail closedWhen something isn't handled, default to the safe, restrictive path rather than guessing.
flakyA flaky test is one that sometimes passes and sometimes fails on unchanged code, making its result untrustworthy.
four-arch / x86_64 / aarch64 / arm64 / i386These are the four processor architectures the system targets, so fixes are checked to work on all of them.
freestandingFreestanding code runs without an operating system or standard library beneath it — it must supply its own basics.
glslcglslc is Google's command-line compiler that turns GLSL shader source into SPIR-V binaries.
hotload / zhotloadzhotload is this stack's live code hot-reload mechanism, updating running code in place.
intermediate representation (IR)A halfway code form a compiler uses between human source code and raw machine instructions.
interpreterA program that runs code by reading and executing it step by step, without first compiling it to machine code.
invariantA condition that is required to be true at all times while a system runs.
ISAThe full set of instructions a particular kind of CPU understands — its native vocabulary.
JITA compiler that turns code into fast native machine instructions on the fly, right as the program runs.
JIT backendThe part of a JIT compiler that emits actual machine code for one specific CPU architecture.
LLVMA large, mature open-source toolkit of reusable compiler parts used to build compilers and code generators.
off-by-oneA bug where a count or index is wrong by exactly one — stopping one step too early or late.
prologue / epilogueThe small bookkeeping code the compiler inserts at the start and end of every function to set up and tear down its workspace.
regressionWhen a change breaks something that used to work — a new failure in previously passing tests.
REPLAn interactive prompt where you type code, it runs immediately, and shows the result — then repeats.
SIMDA CPU technique that applies one instruction to several pieces of data at once for speed.
SSA IRA compiler's internal representation where every variable is assigned exactly once, making code easy to analyze and optimize.
stdint / stddef / stdboolThree tiny standard C headers that define fixed-size integers, basic type helpers, and a boolean type.
submoduleA git repository nested inside another git repository as a tracked dependency.
toolchainThe set of programs — compiler, assembler, linker — that turn source code into a runnable binary.

General 2

ECOThe unit of one devlog entry — a single documented engineering change.
hidden lineIn technical drafting, a hidden line is a dashed line showing an edge that exists but is obscured from view.