Ten notes for newcomers

Mon, 01 Jan 0001 00:00:00 +0000

New here? Read these ten in order. Each one is short, each one links its source, and together they describe how this site thinks about running a web service.

The advantage of small systems Start with the philosophy: small, legible systems fail in ways you can see.
Reliable defaults beat clever recovery Prefer boring defaults over clever recovery.
HTTP methods are a promise about side effects Methods are promises about side effects; learn the vocabulary first.
Redirects and error codes should preserve the story Status codes tell the story of where a resource went.
Cache headers are a contract with two clocks Caching is two clocks: freshness and validation.
Content-Type should describe the bytes you actually send The bytes and the label must agree.
Cookie scope should be narrower than the application boundary Narrow cookie scope before the application grows.
Security headers should describe the actual page Describe the actual page in headers.
A static server should have one obvious root One obvious root for the whole static deployment.
Read the public edge in two commands The two commands everything else builds on.

Next: Read a live edge the way a client does

Sources

RFC 9110 — HTTP Semantics, the shared vocabulary behind the beginner path, checked 2026-09-05.
Caddy Documentation, the server manual behind the release path, checked 2026-09-05.
MDN: HTTP, practical HTTP reference for the troubleshooting path, checked 2026-09-05.

Ten notes for troubleshooters

Mon, 01 Jan 0001 00:00:00 +0000

Something is wrong? Start at the top and stop when the evidence disagrees with your theory. These ten describe where to look and what a healthy answer looks like.

Read the public edge in two commands When something looks wrong, read the edge before guessing.
A release is not complete until the public edge agrees Prove the release from the outside without changing state.
Validators decide whether a cached copy is still the answer Validators decide whether a cached copy is still the answer.
Range requests should prove which bytes were selected Prove which bytes a range request actually selected.
HEAD should describe the same representation as GET HEAD must describe the same representation as GET.
A certificate chain is a path you should be able to print Print the chain the visitor actually receives.
Certificate expiry is a date, not a dashboard color Expiry is a date; check it before the dashboard turns red.
DNS changes need a cache-aware rollback window Change DNS with a cache-aware rollback window.
A postmortem should leave a fact record After the incident, leave facts instead of narratives.
Backups are only useful after a restore rehearsal A backup nobody restored is only hope.

Next: Audit the trust of a public edge

Sources

RFC 9110 — HTTP Semantics, the shared vocabulary behind the beginner path, checked 2026-09-05.
Caddy Documentation, the server manual behind the release path, checked 2026-09-05.
MDN: HTTP, practical HTTP reference for the troubleshooting path, checked 2026-09-05.

Start here · XB Field Notes

Ten notes for newcomers

Sources

Ten notes for troubleshooters

Sources