Personal notebook / Interviews
CuriositiesMy working notes for iOS, Android, backend and general software engineering interviews, with ML and AI systems in the mix. The goal isn't to memorize a perfect answer. It's to get better at explaining what I would build, what could break, and how I'd know.
Foundations → Intermediate → Advanced
These are the areas I'd cover before chasing company-specific trivia. Different roles emphasize different skills, so I'd spend more time on the job's actual problems than on someone else's hundred-page checklist.
01
Know data structures, complexity, state, concurrency, tests and debugging. Being senior doesn't exempt me from explaining an array.
02
For iOS and Android, explain what happens with process death, cancellation, slow networks, lifecycle and security boundaries.
03
Think API contracts, transactions, idempotency, observability, reliability and how the system behaves when a dependency fails.
04
Authorization, replay, supply chain, performance, multi-tenant isolation and the realities of production operations.
05
Start with baselines and evaluation, then look at inference, retrieval, tool execution, privacy, costs and rollback.
06
Own what I actually did, say what I didn't know, back up the decisions and finish with evidence. No fictional metrics.
Swift, Kotlin, APIs, data, concurrency, performance and failures on real devices.
Threat boundaries, multi-tenant authorization, recovery, incident response and tradeoffs.
Datasets, evaluation, inference, tool permissions, model drift and operating costs.
Static review notes: no quizzes, scoring, saved progress or simulations.
Foundations
I start with the input size, hot path and memory costs. Then I compare realistic alternatives, write down complexity and benchmark the case we actually care about.
Review: Don't optimize a six-item list while ignoring a database round trip.
Foundations
Compare lookup cost, ordering, memory overhead, hashing and actual access patterns. A hash map is great until iteration order or collision behavior matters.
Review: State assumptions about expected and worst-case complexity.
Foundations
Keep fast deterministic tests near logic, integration tests at boundaries and a smaller set of device/UI workflows. Reproduce failures before changing the fix.
Review: A high coverage percentage does not prove good assertions.
Intermediate
Name the shared state and interleaving. Make a deterministic failing test, then choose isolation, serialization, immutable data or synchronization.
Review: A delay or sleep is usually not a race-condition fix.
Intermediate
Specify pagination semantics, ordering, cursor stability, empty pages, filtering, authorization, invalid cursor behavior and versioning.
Review: Offset pagination can produce duplicates or gaps when data changes.
Intermediate
Define a symptom and a reproducible boundary. Form hypotheses, add instrumentation, change one variable and capture evidence. Fix the smallest causal issue.
Review: Don't change five things and then call the incident resolved.
Advanced
Look at producer rate, queue capacity, consumer throughput and whether overload should reject, delay or shed work. Separate latency budgets from retries.
Review: Infinite queues just defer the outage.
Foundations
Start with the source of truth. Explain @State, observable models, binding and how data flow reaches the view. Make ownership obvious.
Review: Avoid duplicating mutable state in multiple screens.
Foundations
Describe copying vs shared identity, ARC retain cycles and how to reason about capture lists. Use a real UI or networking example.
Review: Don't say struct always lives on the stack.
Intermediate
Trace the task lifecycle, cancellation propagation, main-actor updates and ownership of fetched state. Test rapid navigation and concurrent loads.
Review: Cancellation is cooperative, not a magical force-stop.
Intermediate
Reproduce the freeze, collect Instruments traces and identify synchronous I/O or CPU work. Move the right operation without introducing races.
Review: Don't move UI state off the main actor just to 'fix' thread contention.
Advanced
Discuss device/application integrity signals, server challenge binding, replay resistance, keys and failure recovery. Authorization remains separate.
Review: A legitimate device can still make an unauthorized request.
Advanced
Define trust expiration, credential refresh, secure storage, local unlock boundaries, logout and what the app must reject while offline.
Review: Don't promise real-time revocation without a network.
Foundations
Explain state reads, stable values, remembering state, lifecycle-aware observation and unidirectional data flow.
Review: Recomposition itself is not a bug; unnecessary expensive work inside it may be.
Foundations
Separate UI state, saved instance state and durable data. Use ViewModel, SavedStateHandle and persistence where appropriate.
Review: Don't treat ViewModel as durable storage across process death.
Intermediate
Match each to state, events and one-off operations. Explain replay, cancellation and backpressure in the consumer.
Review: A shared flow doesn't make a network call idempotent.
Intermediate
Separate transient transport failures from unknown server outcome, add idempotency at the API, and keep an explicit retry budget on the client.
Review: Blind retries are not safe for every POST.
Advanced
Treat attestation as a signal tied to a server request, verify responses server-side and consider freshness, replay and fallback policies.
Review: Integrity is not a substitute for tenant/resource authorization.
Advanced
Distinguish cold/warm starts, baseline profiles, slow I/O, main-thread CPU, device diversity and measurable regressions.
Review: Testing only on a flagship phone hides problems.
Foundations
Define repeat behavior, request fingerprints, idempotency keys, concurrency, retention and what happens after a timeout.
Review: A database unique constraint alone may not solve every ambiguous response.
Intermediate
Pick write skew or lost updates, draw the concurrent transaction order and show which isolation levels permit it.
Review: Don't promise serializable isolation without considering contention.
Intermediate
Explain amplification, exponential backoff with jitter, deadlines, bounded attempts, admission control and load shedding.
Review: Retries should consume a budget, not manufacture traffic.
Intermediate
Talk delivery semantics, visibility timeouts, consumer idempotency, poison messages, retry policy and observability.
Review: Exactly-once behavior usually requires end-to-end design, not a marketing checkbox.
Advanced
Resolve caller identity at the server, bind tenant context to queries, enforce object authorization and test cross-tenant negative cases.
Review: Filtering by a tenant ID supplied by the client isn't authorization.
Advanced
Set the timeline, compare release cohorts, inspect traces and saturation, isolate one bottleneck, mitigate, verify and write the follow-up.
Review: An average latency chart can hide the problem.
Foundations
A valid session proves identity; each resource and action still needs policy evaluation. Use a cross-account record lookup as the example.
Review: Hidden buttons and unpredictable IDs are not access controls.
Intermediate
Check device time, certificate chain, hostname, trust store and proxy conditions. Reproduce on a real network and log without leaking secrets.
Review: Disabling verification is not an incident fix.
Intermediate
Discuss platform stores, short-lived credentials, refresh semantics, revocation, backups, device compromise and server-side controls.
Review: A secure store doesn't make a bearer token harmless.
Intermediate
Draw data flow and trust boundaries. List assets, attackers, spoofing/replay/authorization paths and concrete negative tests.
Review: A threat model without a way to test assumptions is just a drawing.
Advanced
Establish authorized scope, isolate the environment, capture hashes, inspect static structure, instrument behavior and tie observations to evidence.
Review: Don't confuse an indicator with proof of compromise.
Advanced
No. The model proposes actions; the executor must validate tool, arguments, authenticated principal, resource scope and approval.
Review: Prompt guardrails alone cannot enforce access policy.
Foundations
Define the objective and simple baseline. Check dataset quality, leakage and class imbalance before spending time on more complexity.
Review: A high accuracy number on a leaked split is worse than useless.
Foundations
Start from the decision cost and prevalence. Explain confusion matrix, thresholds and what happens to false positives/negatives.
Review: One metric won't cover every product risk.
Intermediate
Describe target leakage, duplicate records, future data and user/session splits. Validate using a split that matches deployment.
Review: Don't shuffle time-series events blindly.
Intermediate
Define corpus provenance, chunking, relevance evaluation, citation fidelity, access filtering, stale documents and no-answer behavior.
Review: Retrieval must respect per-user document permissions.
Advanced
Version tasks and golden expected outcomes. Evaluate tool selection, auth denials, argument validation, failures, latency and costs independently.
Review: Don't call the model's own unverified judgment a ground truth label.
Advanced
Separate train/test data, version features/model, measure inference constraints, run canaries, observe drift and define rollback.
Review: A good offline score doesn't guarantee production behavior.
Advanced
Define ordering, version vectors or revision IDs, ownership, merge policy, tombstones and recovery after long offline periods.
Review: Last-write-wins is a product decision, not a universal solution.
Advanced
Cover challenge binding, credential enrollment, phishing resistance, authenticator choices, account recovery and server session policies.
Review: A passkey login still needs a carefully designed recovery path.
Advanced
Measure traffic, bottlenecks and cost drivers, then choose the smallest change with a rollback. Capacity and reliability are not separate conversations.
Review: Don't reach for microservices before checking the slow query.
Advanced
Discuss provenance, dependencies, CI permissions, signing, secret handling, artifact verification and incident revocation.
Review: A green pipeline doesn't establish supply-chain integrity.
Advanced
Set dependency timeouts, bulkheads, rate limits, fallbacks, circuit breakers and operational signals. Define degraded but safe behavior.
Review: A fallback must not bypass authorization or correctness.
Foundations
I would describe the actual feature, my role, constraints, tradeoffs, test strategy, rollout and observed result. Only claim what I can verify.
Review: Don't turn a team accomplishment into a solo story.
Intermediate
Explain how I formed a model of the system, found evidence, limited the change, protected existing behavior and measured improvement.
Review: The best story isn't 'I rewrote the whole thing.'
Intermediate
Use symptom → evidence → hypotheses → intervention → validation → follow-up. Be explicit about what I directly did.
Review: Don't invent a production incident or business metric.
Advanced
State what was known, unknown, time constraints, options, reversible choices and how I communicated the risk.
Review: Pretending there was no uncertainty is not confidence.
Intermediate
Get an agreed symptom and severity, set communication cadence, reproduce with sanitized data, mitigate, confirm and close the loop.
Review: Avoid promising a fix before reproducing the problem.
Advanced
Start with requirements, threat model and SLOs. Compare the simplest alternatives, identify failure modes and ask for a falsifiable test.
Review: Disagreement is useful when it produces evidence, not a longer meeting.
Intermediate
Map app retry policy, API timeouts, queue saturation and dependency health. Propose bounded retries with jitter, backpressure and idempotency.
Review: Show what measurement would prove the storm actually stopped.
Intermediate
Separate device integrity from object authorization. Reproduce with two test tenants; fix the server query boundary and add a regression test.
Review: Never treat an attestation success as permission to read arbitrary records.
Advanced
Compare memory traces, image decode dimensions, caches and lifecycle behavior on constrained hardware. Add regression benchmarks.
Review: Compression on disk is not the same as decoded bitmap memory.
Advanced
Segment by app version, network, device and rollout cohort. Check backward compatibility and replays; mitigate with a reversible server change.
Review: Don't rely solely on the latest app version when clients update slowly.
Advanced
Trace the retrieved text, proposed tool call, caller identity and backend policy. Deny on capability and tenancy, then evaluate similar attacks.
Review: Prompt wording is not a sufficient defense.
Intermediate
Compare train and live distributions, leakage, threshold cost, missing features, feature drift and runtime instrumentation.
Review: Don't retrain before knowing what changed.
Foundations
Keep each why tied to evidence. Stop when a fixable systemic cause and verification plan emerge, not when someone is blamed.
Review: Five whys is a guide, not a requirement to invent exactly five causal links.
Foundations
Say the goal, key components, trust boundary, failure mode and one tradeoff. Then invite a deeper question.
Review: If I can't explain it without a ten-slide deck, I should keep working on it.
Intermediate
Use unauthorized access, duplicate/replayed requests and dependency timeouts. Then connect each to a specific invariant.
Review: Tests need clear observable outcomes.
Advanced
Block the unsafe release, explain the trust boundary, reproduce the certificate issue and provide a safe diagnostic path.
Review: Temporary security bypasses have a habit of becoming permanent.
Intermediate
Use new evidence, what assumption broke, and what I changed. Revising a decision based on data is a strength.
Review: Don't retroactively claim the original choice was obviously wrong.
Advanced
Cover a production build, inherited code, a difficult incident and a decision under uncertainty. Keep ownership and observed results explicit.
Review: No invented metrics. The follow-up questions usually expose them.
iOS · Official docs
Tasks, actors and strict concurrency. Read this before explaining cancellation.
Open reference →iOS · Official docs
Understand state ownership and how updates move through the view tree.
Open reference →iOS · Official docs
Swift Testing, XCTest, UI tests and test strategy.
Open reference →iOS · Official docs
Useful when discussing real on-device inference constraints.
Open reference →Android · Official docs
State holders, UDF, repositories and lifecycle tradeoffs.
Open reference →Android · Official docs
Recomposition, state and layout fundamentals.
Open reference →Android · Official docs
What to test locally, on devices and at boundaries.
Open reference →Android · Official docs
Device signals in a broader server-side abuse defense.
Open reference →Android · Official docs
Structured concurrency and cancellation in plain Kotlin.
Open reference →Backend · Official docs
Read the anomalies, then reproduce them in two sessions.
Open reference →Backend · Official docs
Tracing, metrics, propagation and what you can actually observe.
Open reference →Backend · Reference
Practical reliability, incidents and operations.
Open reference →Backend · Official docs
Workload, health and deployment behavior worth testing.
Open reference →Security · Reference
Start with object authorization, authentication and unsafe API use.
Open reference →Security · Reference
Structured requirements for reviewing real mobile security assumptions.
Open reference →Security · Site reference
Walk through public vulnerabilities and their trust boundaries.
Open reference →Security · Site reference
Static security analysis and source-backed case studies.
Open reference →ML & AI · Course
A practical starting point for model training and evaluation.
Open reference →ML & AI · Course
From tensors and datasets to optimization and saved models.
Open reference →ML & AI · Reference
Lessons on production ML before building something needlessly complicated.
Open reference →ML & AI · Site reference
Technical write-ups on agent execution, evaluation and mobile inference.
Open reference →ML & AI · Reference
A structured approach to risks around AI deployment and operation.
Open reference →Career · Practice
Structured algorithm practice. Be able to explain complexity, not just pass.
Open reference →Career · Reference
Community guide to coding, systems and behavioral preparation.
Open reference →Career · Reference
Large open study plan; select what matches the role rather than doing everything.
Open reference →Career · Site reference
Use real implementations and test evidence for ownership-based stories.
Open reference →Case studies · Site reference
Walk through amplification and mitigations without hand-waving.
Open reference →Case studies · Site reference
Reconstruct what happened, how we know and what actually changed.
Open reference →Case studies · Site reference
Use documented attack paths and code review evidence.
Open reference →Bonus · Reference
Community reference for tradeoffs; no need to memorize every diagram.
Open reference →Bonus · Reference
A surprising number of engineering interviews still reveal Git gaps.
Open reference →