Original, source-backed articles about running small systems, static sites, HTTP, DNS, TLS, and operations.
Posts are original articles written for this site. Each one is script-free, source-backed, and tied to the same operational reality the rest of the site records: how a small, static, publicly served system is built, secured, and kept honest.
HTTP/2 removes HTTP response-order blocking
Here, removing head-of-line blocking means removing HTTP response-order constraints on a shared connection. HTTP/2 does not remove TCP head-of-line blocking. A later response can finish while an earlier handler waits, but shared transport capacity, connection-level flow control, and application bottlenecks can still couple the streams.
...
Credentials belong outside repository history
A credential committed to Git becomes part of a versioned object graph that collaborators and automation may copy. Removing the file from the latest tree does not remove the earlier commit containing it. The practical boundary is to keep credential values out of source history and provide them through an authorized runtime mechanism. Repository configuration can describe how to obtain a secret without containing the secret itself.
...
CORS controls whether a script can read a response
Cross-Origin Resource Sharing lets a server opt into exposing a response to scripts from another origin. An origin consists of scheme, host, and port; two services on different ports can therefore be cross-origin even on the same machine. The browser evaluates the CORS response headers for the requesting page. This mechanism does not authenticate that page’s user or turn the endpoint into a private network service. Same-site cookie rules use a different boundary from same-origin response access, so similar-looking hostnames are insufficient to reason about both.
...
CSP makes browser execution rules explicit
Content Security Policy tells a supporting browser which actions a document permits. Fetch directives govern categories such as scripts, styles, and images; other directives cover different boundaries. The policy is supplied with the document, commonly through a response header. It adds constraints to browser behavior, but does not repair an injection bug, authenticate application users, or promise that every possible form of script execution has been eliminated.
...
Indexes serve queries, not algorithms
An index is justified by an access requirement or an integrity rule. The first might be retrieving one customer’s latest five orders; the second might be preventing duplicate order identifiers. Both are real purposes, even if only one appears as a frequent read in query statistics. Index design starts by recording those purposes and measuring their costs, not by accumulating interesting data structures or deleting everything with a low scan count.
...
Clock synchronization bounds time disagreement
Clock synchronization reduces disagreement between machines’ civil-time readings. It supports certificate validity checks, timestamp interpretation, and many expiration policies, but it does not establish a perfect global clock. A host can emit well-formatted UTC while measuring the wrong instant. Applications still need to distinguish elapsed durations, absolute deadlines, and causal ordering rather than making them all depend on raw wall-clock comparisons.
...
Give a log query a question and a denominator
A useful logging design starts with a question precise enough to become a query. “Show errors” is different from “How many checkout requests finally failed between ten and eleven UTC?” The first locates diagnostic events. The second needs a population of completed requests, a definition of failure, and a time rule. Collecting more text does not supply these missing semantics automatically.
...
Connection caps guard a shared database
A connection cap limits one owner’s demand; it does not automatically cap every application sharing a database. The useful budget is the sum of physical connections that can reach each backend, including idle pooled connections. Begin with the backend’s usable slots, then allocate them across all callers and deployment states.
...
