121
Keeping secrets out of logs (2024)
There's no silver bullet, but if we put some "lead" bullets in the right places, we have a good shot at keeping sensitive data out of logs.
Topics /
Infrastructure & DevOps
The most popular blog posts about infrastructure & devops on Hacker News. 321 posts.
122
A major Postgres upgrade with zero downtime
Right before Christmas we discovered that our Aurora Postgres instance needed a major version upgrade. This covers how we made the upgrade with zero seconds of downtime.
123
Is NixOS truly reproducible?
Build reproducibility is often considered as a de facto feature provided by functional package managers like Nix. Although the functional package manager model...
124
Graceful Shutdown in Go: Practical Patterns
Go applications can implement graceful shutdown by handling termination signals (SIGTERM, SIGINT) via os/signal or signal.NotifyContext. Shutdown must complete within a specified timeout (e.g., Kubernetes’ terminationGracePeriodSeconds)…
125
Running GPT-OSS-120B at 500 tokens per second on Nvidia GPUs
Train, serve, and scale open-source and custom AI models on the fastest, most reliable inference platform.
126
Bypassing GitHub Actions policies in the dumbest way possible
TL;DR : GitHub Actions provides a policy mechanism for limiting the kinds of actions and reusable workflows that can be used within a repository, organization, or entire enterprise. Unfortunately, this mechanism is trivial to bypass . GitHub has told me that they don’t consider this a security issue (I disagree), so…
127
I can't recommend Grafana anymore
The Grafana Stack can be an incredible powerful monitoring solution, but through my experience I found out how maintenance intensive it is and how uncertain the…
128
So you wanna write Kubernetes controllers?
Any company using Kubernetes eventually starts looking into developing their custom controllers. After all, what’s not to like about being able to provision resources with declarative configuration: Control loops are fun, and Kubebuilder makes...
129
An eBPF loophole: Using XDP for egress traffic
XDP only works for ingress. We found a loophole that lets it work for egress. Here's how we did the impossible.
130
131
You might not need Redis
Redis is arguably the most well regarded tech of all. But many times you do not need Redis. Here are 3 examples from my last 3 jobs.
132
Log by time, not by count
By default, log based on fixed time intervals rather than number of messages.
133
134
Pnpm has a new setting to stave off supply chain attacks
There have been several incidents recently where popular packages were successfully attacked. To reduce the risk of installing a compromised version, we are introducing a new setting that delays the installation of newly released dependencies. In most cases, such attacks are discovered quickly...
135
Podman Desktop celebrates 3M downloads
We reached 3,000,000 Downloads of Podman Desktop. Let's celebrate.
136
A story on home server security
Happy New Year! Or so I thought. After a refreshing Christmas vacation with my family, I was stashing something away in our storage room when I noticed the server fan running at maximum speed. This was very unexpected, considering my server is powered by an Intel i3 and should handle all the light tasks I run quite…
137
Clock synchronization is a nightmare
Time seems simple. But we engineers lose sleep over something as basic as keeping clocks in sync. Here’s why…
138
If you get the chance, always run more extra network fiber cabling
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…
139
Wolfram Compute Services
Wolfram releases the Wolfram Compute Services system--a fully programmable, streamlined way to scale up Wolfram Language computations. For large volumes of data, extensive iterations, large-scale parallelism and more.
140
AWS deleted my 10-year account and all data without warning
After 10 years as an AWS customer and open-source contributor, they deleted my account and all data with zero warning. Here's how AWS's 'verification' process became a digital execution, and why you should never trust cloud providers with your only copy of anything.
141
Build a tiny CA for your homelab with a Raspberry Pi
Let's make a tiny, standalone CA! We'll use a Raspberry Pi 4, YubiKey 5 NFC, and Infinite Noise TRNG.
142
uv downloads overtake Poetry for Wagtail users
uv download statistics overtake Poetry for Wagtail users
143
Everything as code: How we manage our company in one monorepo
Frontend, backend, marketing website, documentation, blog content, investor site, Chrome extension, Google Docs add-on,cloud functions, demo repos—all in…
144
Making Postgres scale
A war story of manually sharding Postgres across 6 databases under load, and the case for automating the process with a proxy instead of weeks of engineering effort.
145
Ubuntu LTS releases to 15 years with Legacy add-on
Ubuntu Pro now supports LTS releases for up to 15 years through the Legacy add-on. More security, more stability, and greater control over upgrade timelines for enterprises. […]
146
Modern messaging: Running your own XMPP server
Since a years we know, or might suspect, our chats are listend on, our uploaded files are sold for advertising or what purpose ever and the chance our social messengers leak our private data is incredibly high. It is about time to work against this.
147
Fast and cheap bulk storage: using LVM to cache HDDs on SSDs
My attempt to create fast and cheap bulk storage by caching HDDs with SSDs on Linux, using standard lvmcache. Contains an introduction to LVM, RAID, and partitioning.
148
Whose code am I running in GitHub Actions?
I wanted to know what third-party code I was using in my GitHub Actions. I was able to use standard text processing tools and shell pipelines to get a quick tally.
149
150
My Own DNS Server at Home – Part 1: IPv4
“It’s always DNS” is a famous meme among network people. Name resolution is technically quite simple. It’s “just” translating a hostname like jan.wildeboer.net to an IP address. What could possibly go wrong? I am a radical optimist and detail-obsessed knowledge collector, so I decided to find out. As part of my goal…