Original, source-backed articles about running small systems, static sites, HTTP, DNS, TLS, and operations.
Posts are original articles written for this site. Each one is script-free, source-backed, and tied to the same operational reality the rest of the site records: how a small, static, publicly served system is built, secured, and kept honest.
Umask filters new permissions, with a default ACL exception
A process’s umask removes permission bits when creating files and directories under the ordinary mode-based creation rule. The application first supplies a requested mode; the mask restricts that request. It is neither a complete access policy nor an instruction to rewrite existing files. A directory’s default access control list changes the creation calculation, so inspecting only the process mask can give an incomplete prediction.
...
BGP aggregation shrinks the routing table
Aggregation can replace several more-specific advertisements with one covering prefix. It reduces downstream table entries only where the specifics are actually suppressed and no alternative peer supplies them. The components need not fill the whole summary: advertising a sparse block also attracts traffic for its holes. Aggregation therefore combines a scaling decision with a reachability and ownership decision.
...
DoT and DoH protect the connection to the resolver you authenticate
DNS over TLS and DNS over HTTPS protect DNS traffic on the encrypted connection between their endpoints. For a typical client, that connection ends at the selected resolver. The resolver can read the question and answer, and its later queries may follow different transports. Encrypting this hop does not automatically encrypt every recursive exchange or make the resolver unable to log the names it handles.
...
IPv6 routers report oversized packets; sources decide how to fit the path
An IPv6 router does not fragment a packet while forwarding it toward its destination. If the packet is too large for the next link, the router normally discards it and sends ICMPv6 Packet Too Big feedback. The source can then adjust its packet size or, where appropriate, send fragments using the IPv6 Fragment header. Reassembly of those fragments takes place at the destination.
...
TCP keepalive probes idle connections
TCP keepalive asks whether the other TCP endpoint still responds after a quiet period. It does not ask whether an HTTP handler, database query, or worker is making progress. A peer’s kernel can acknowledge traffic while its application is stalled. Treat transport reachability and useful application responses as different observations.
...
Shell aliases shrink repeated typing
An alias replaces a command word with shell text while Bash reads a command. It is useful for personal shortcuts such as alias ll='ls -l', but it is not an executable and has no independent argument scope. Noninteractive Bash disables alias expansion by default; a script can explicitly enable it. Understanding that distinction explains why a shortcut works at a prompt but disappears in automation.
...
ENTRYPOINT and CMD define defaults that operators can override
An image’s ENTRYPOINT and CMD contribute to the command used when a container is created. With an exec-form ENTRYPOINT, CMD commonly supplies default arguments appended to that entrypoint. Without an entrypoint, CMD can supply the executable and its arguments. These are startup defaults, not an enforcement boundary: an authorized operator can replace the entrypoint or arguments when creating a container.
...
Setuid changes effective identity at exec
Setuid on a Linux executable can change the process’s effective user ID to the file owner’s ID when exec succeeds. It does not replace every credential with the owner’s login identity. A privileged helper can therefore perform a controlled operation on another account’s behalf, but its input handling and privilege lifetime become part of the security boundary. The mode bit alone proves neither that a transition occurred nor that the helper is safe.
...
