OneCeylon logo
OneCeylon
Tech & Careers
NOTEBOOK Engineering · Research · Field notes

The notebook.

Where the engineers and researchers at OneCeylon write about what they are making. No hot takes, no roadmaps — just the work, and what we learned doing it.

Latest · 26 August 2026
ENGINEERING 10 min read · By OneCeylon Engineering

The Inverted Rate Limiter.

A single array index put every honest visitor in the world into one shared budget, and handed every attacker a private one they could renew per request. It throttled the innocent, waved through the abuse, and reported success the whole time.

Read the full post
one chain, two ends X-FORWARDED-FOR 1.2.3.4 , 5.6.7.8 , 198.51.100.22 trust boundary [0] the client picked this nginx wrote this WHAT THE LIMITER DID every visitor "unknown" 1 shared budget one attacker forged, rotated ∞ private budgets throttled the innocent · waved through the abuse
Earlier in the notebook
25 AUGUST 2026
ENGINEERING

The Send button worked. Enter didn't.

One config object, two ways to send a message, and a callback that stopped being true after the first render. Replies, photos and locations were silently dropped — but only on the keyboard path, and only in a way nobody could report.

React TipTap Stale closures 8 min
By OneCeylon Engineering
Read the post
24 AUGUST 2026
ENGINEERING

Nobody ever got a push notification from us.

Our Web Push had a settings toggle, a green "On for this browser", and a zero percent delivery rate. Two independently fatal bugs — and error handling that named only the failures we had predicted, leaving success as the unhandled remainder.

Web Push Cryptography VAPID 9 min
By OneCeylon Engineering
Read the post
22 APRIL 2026
ENGINEERING

Putting 5,000 travel questions on a map.

A traveller standing in Galle Fort wants to know what people have asked about the streets around her. The first version of our query took fourteen seconds. Here is how we got it to ninety milliseconds — and the clustering algorithm we picked along the way.

PostGIS Geospatial Query performance 11 min
By Ruwan de Silva
Read the post
12 APRIL 2026
RESEARCH

Teaching SerendAI to read a Sri Lankan pharmacy sign at 9pm.

A field report on multilingual photo translation for travellers in Sri Lanka. How we got from "unusable on real street signs" to something a visitor in Nuwara Eliya can trust after dark — and the preprocessing trick that finally moved the numbers.

SerendAI Photo translation Sinhala / Tamil OCR 10 min
By Anjali Wickremasinghe
Read the post
Up next

More, soon.

ENGINEERING · COMING SEPTEMBER

One ENUM, seven migrations, and no two of them agreeing.

RESEARCH · COMING OCTOBER

On-device sign translation — getting the whole pipeline onto a mid-range Android phone.

FIELD NOTES · COMING NOVEMBER

How one visitor in Kandy quietly shaped six months of our roadmap.

§ — Working with us

Liked the writing? Come work on what comes next.

We are hiring two people right now: a senior backend engineer to own the API and the data platform underneath all of this, and a paid ML research intern to work on SerendAI. Both based in Colombo, both on problems you have just read about.