Complete archive

Notes and older articles.

The full set of published technical notes and explainers, organized by topic.

• AI systems / security / runtime isolationAI agent sandboxes: isolate the code, not just the prompt2026-10-22
• Security / software supply chain / build systemsArtifact provenance: what a signed build attestation proves—and what it cannot2026-10-21
• Networking / HTTP/3 / compressionHTTP/3 QPACK: compress headers without letting one stream stall the connection2026-10-20
• Databases / transaction isolation / PostgreSQLPostgreSQL Serializable: detecting write skew, not just dirty reads2026-10-19
• AI systems / security engineering / observabilitySecurity AI agents: make evidence and scope part of the system2026-10-15
• Reliability / performance engineering / production observabilityProduction profiling: read flamegraphs as evidence, not verdicts2026-10-14
• Security / DNS infrastructure / trust-anchor operationsDNSSEC root KSK rollover: trust anchors are operational state2026-10-13
• Cloud platforms / AI agent securityCloud AI agents: least privilege must follow the plan2026-10-12
• Kubernetes / AI infrastructure / securityKubernetes AI factories: tenant isolation is a hardware boundary2026-10-11
• AI/ML systems / inference memoryTurboQuant and the KV cache: compressing what inference remembers2026-10-10
• Networking / DNS caching and operationsDNS negative caching: why a deleted record can keep failing2026-10-09
• Kubernetes / cloud-native service discoveryKubernetes EndpointSlices: scaling service discovery without one giant object2026-10-08
• Cloud platforms / object-storage protocol deep diveS3 multipart uploads: a distributed commit protocol hiding in object storage2026-10-07
• Databases / PostgreSQL storage and MVCC deep divePostgreSQL index-only scans: the visibility map decides whether “only” is true2026-10-06
• Cloud platforms / failure-domain engineering deep diveCloud sovereignty under disconnection: proving a failure domain is truly local2026-10-05
• Distributed systems / Kafka coordination deep diveKafka incremental rebalancing: keeping healthy consumers working during membership change2026-10-01
• AI/ML systems / inference serving deep diveSpeculative decoding: accelerate LLM generation without changing its answers2026-09-30
• Cloud platforms / identity and access control deep diveCloud IAM policy evaluation: how an explicit deny wins across policy layers2026-09-29
• Networking / HTTP/3 protocol deep diveQPACK blocked streams: the compression trade-off hidden inside HTTP/32026-09-28
• Security / confidential AI infrastructure deep diveConfidential AI inference: remote attestation is the real trust boundary2026-09-26
• Databases / PostgreSQL internals deep divePostgreSQL XID wraparound: how freezing prevents a database from forgetting its past2026-09-24
• Cloud platforms / AI inference deep diveCapacity-aware inference: why heterogeneous GPUs need a scheduler, not a retry loop2026-09-23
• Cloud platforms / reliability deep diveAI provider failover: why three model vendors can fail together2026-09-22
• Observability / reliability deep diveQueue backpressure: why a 10% scheduler bug became hours of publishing delay2026-09-21
• Cloud infrastructure / distributed systems deep diveConsistent hashing at scale: why a 6-byte point can reclaim 100 TB of RAM2026-09-20
• Databases / change-data-capture deep divePostgreSQL logical replication slots: the WAL-retention contract behind CDC2026-09-20
• AI/ML systems / inference serving deep diveLLM prefix caching: why reusing a prompt is a block allocator problem2026-09-19
• Kubernetes / cloud-native control-plane deep diveKubernetes leader election: why a Lease is coordination, not fencing2026-09-19
• Security / AI software supply-chain deep divePlugin4Shell: why an AI coding tool’s pinned commit was not actually pinned2026-09-18
• Networking / post-quantum security deep divePost-quantum DNSSEC: how a 2,420-byte signature becomes a transport problem2026-09-17
• AI systems / protocol security deep diveMCP tool calls: the capability handshake between an AI host and an external server2026-09-16
• Hardware / AI systems deep diveNCCL ring all-reduce: why distributed training moves each gradient twice2026-09-15
• Databases / storage deep diveLSM-tree compaction: why fast writes become background debt2026-09-14
• Security / vulnerability response deep diveThe CRA 24-hour clock: building a vulnerability reporting pipeline that does not miss the first deadline2026-09-13
• Cloud platforms / networking deep diveConnection draining: how load balancers retire a backend without cutting requests2026-09-12
• AI/ML systems / security deep diveModel extraction: how black-box API queries reconstruct a private classifier2026-09-11
• AI/ML systems deep diveSpeculative decoding: faster LLM sampling by verifying a draft in parallel2026-09-10
• Databases / storage deep divePostgreSQL HOT updates: how one heap page avoids index churn2026-09-09
• Security / text-processing deep diveUnicode ASCII smuggling: when humans and machines read different strings2026-09-08
• Observability / reliability deep diveOpenTelemetry exemplars: how one trace ID makes a metric spike explainable2026-09-07
• Security / software supply chain deep diveOCI image trust: why a container tag is not an identity2026-09-06
• AI/ML systems deep divePagedAttention: how an LLM KV cache became a virtual-memory problem2026-09-05
• Cloud platforms / distributed systems deep diveSpanner commit-wait: how uncertain clocks produce an ordered global database2026-09-04
• Cloud-native / API control plane deep diveKubernetes API Priority and Fairness: the queues that keep one tenant from starving the control plane2026-09-03
• Networking / routing security deep diveBGP hijacks and RPKI: why a more-specific route wins until a router rejects it2026-09-02
• Databases / storage deep diveIceberg v3 deletion vectors: one bitmap, one data file, one snapshot rule2026-09-01
• Security / cryptography deep diveTLS 1.3 0-RTT: faster reconnects by spending replay safety2026-08-31
• Observability / reliability deep diveOpenTelemetry tail sampling: why the collector must remember a trace before deciding2026-08-30
• Hardware / AI systems deep diveHBM4 memory systems: why bandwidth comes from channels, not a magic DRAM clock2026-08-29
• AI systems / security deep diveAgent sandboxing: when a package cache becomes a shared control plane2026-08-28
• Distributed systems / consensus deep diveRaft leader election: why randomized timeouts prevent a silent split-brain2026-08-27
• Cloud platforms / virtualization deep diveFirecracker’s microVM fast path: where KVM stops and virtio I/O begins2026-08-26
• Networking / transport protocol deep diveQUIC connection migration: how one encrypted connection survives an IP change2026-08-25
• 市場觀察HDB 不再只踩煞車：新加坡住宅政策正在轉向嗎？2026-08-24
• Hardware / CPU security deep diveRemote Spectre in a serverless isolate: why frozen timers were not enough2026-08-24
• Databases / storage deep divePostgreSQL WAL: why COMMIT is a log flush, not a data-page write2026-08-23
• Security deep diveCargo build scripts: the supply-chain boundary that runs during compilation2026-08-22
• Cloud-native infrastructure deep diveKubernetes watches: resourceVersion, bookmarks, and the cache behind controllers2026-08-21
• Reliability deep diveGitHub's 7h47m outage: when retries multiply a bottleneck2026-08-20
• 市場觀察拼多多真正不同的地方：從「貨找人」到需求聚合2026-08-19
• AI systems deep diveLLM serving: why prefill and decode want different machines2026-08-19
• Kubernetes deep diveKubernetes controllers: who owns what from watch to reconcile2026-08-18
• Linux deep diveLinux timerfd: one readable counter for missed time2026-08-18
• Linux deep diveLinux memfd seals: freezing shared bytes without a pathname2026-08-17
• Linux deep diveLinux signalfd: turning signals into pollable records without async handlers2026-08-16
• Linux deep diveLinux eventfd: a counter-shaped wakeup primitive for event loops2026-08-15
• Linux deep diveLinux pidfds: race-free process control through file-descriptor identity2026-08-14
• Linux deep diveLinux pipe atomicity: why PIPE_BUF protects records but pipe capacity does not2026-08-13
• Linux deep diveLinux fork and copy-on-write: private pages are shared until the first write2026-08-12
• Linux deep diveLinux futex wait/wake: atomic compare-and-sleep and the lost-wakeup trap2026-08-11
• Linux deep diveLinux epoll edge-triggered mode: the ready list, the drain loop, and the event that never comes back2026-08-10
• Linux deep diveLinux TCP listen backlog: two queues, three limits, one surprising failure2026-08-09
• Linux deep diveLinux page_pool: the lifetime of a recycled RX page2026-08-08
• Linux deep diveNAPI, IRQs, and NET_RX softirq2026-08-07
• Linux deep diveDMA, RDMA, and packet memory2026-08-07
• Linux deep diveSR-IOV, PFs, VFs, and Kubernetes2026-08-07