Original, source-backed articles about running small systems, static sites, HTTP, DNS, TLS, and operations.
Posts are original articles written for this site. Each one is script-free, source-backed, and tied to the same operational reality the rest of the site records: how a small, static, publicly served system is built, secured, and kept honest.
The listen backlog holds connections waiting for accept
On Linux TCP sockets, the listen() backlog concerns established connections waiting for the application to accept them. The incomplete-handshake queue is a separate concept. Calling accept() removes a pending connection and returns a connected socket for application use. That accepted connection no longer occupies the listener’s accept queue, even if it remains open and busy for a long time.
...
git bisect narrows the first bad commit
Bisection answers a precise historical question: within selected history, where does a reproducible observation change from good to bad? It does not identify a root cause merely by naming a commit. The search depends on correct endpoint labels and consistent intermediate decisions. Treat the reported boundary as evidence to inspect, then confirm the behavior on both sides and explain the change that accounts for it.
...
Trace sampling reduces volume without fixing a cost ceiling
Trace sampling selects which recorded work reaches the tracing pipeline. It can reduce export traffic and storage, but a configured percentage is not a strict ceiling on bytes, processor time, or money. Requests produce different numbers of spans, attributes vary in size, and traffic itself changes. A one-percent policy applied to a sudden tenfold traffic increase can still produce roughly ten times as much sampled data.
...
Kernel entropy turns device noise into keys
Linux applications normally obtain cryptographic randomness from a kernel generator, rather than consuming one newly collected physical bit for every output bit. Initialization and state reuse still matter. A busy machine is not automatically safe, and a quiet machine is not automatically broken. Diagnose the interface, kernel version, and boot or cloning process before deciding that a counter proves a security failure.
...
Signed images prove who built them
A container image reference is a mutable pointer; a digest is immutable. Signing ties a digest to a key, so a verifier can ask who produced these exact bytes before anything runs them. That is the question registries and manifests cannot answer, because they tell you where bytes came from, not who made them.
...
OAuth code flow trades a code for a token
Authorization-code flow moves access-token delivery to the token endpoint rather than returning an access token in the browser-facing authorization redirect. That distinction reduces exposure in URLs, but does not mean a browser can never hold a token. The client architecture determines who exchanges the code and where the resulting credentials live.
...
Request smuggling desyncs the proxy chain
Request smuggling occurs when components disagree about HTTP message boundaries and an attacker exploits the disagreement. In a proxy chain, bytes treated as one request’s body by the front end may become another request at the back end. The important evidence is inconsistent parsing and forwarding, not simply finding two HTTP status lines in a response capture.
...
JWTs carry a signature and a lifetime
A signed JWT carries claims whose integrity can be checked without looking up the entire token in a session table. That convenience does not make its contents confidential, establish authorization, or prevent replay. Start with the token format and the application’s validation contract, then test each boundary independently. A successful cryptographic check is one input to an access decision, not the decision itself.
...
