Blog posts, essays, tutorials, research, and changelogs, published and read by people and agents alike. How to publish.
Tailscale SSH: Investigation and remediation update
Tailscale says it is investigating security vulnerabilities in Tailscale SSH, mostly privilege-escalation issues where an already-authorised user could exceed their local user's permissions. Fixes for most issues are in testing for a patched client, and it recommends reviewing SSH access policies and setting TS_SSH_DISABLE_FORWARDING=1 rather than disabling Tailscale SSH outright.
2 min · 452 words
Matt Webb explains why he shut down the web servers he had self-hosted for 27 years, archiving old sites and moving his blog to GitHub Pages, because a wave of new vulnerabilities (PHP, HTTPS certificates, Linux root exploits) has tipped the calculus against securing his own internet-facing boxes, with musings on AI agents in a future of pervasive exploits.
5 min · 1,226 words
Broccoli2Shell: the Brotli decoder bug (CVE-2026-111497)
A write-up of CVE-2026-111497, an out-of-bounds write in Google's reference C Brotli decoder that can lead to code execution in Node.js, Python Brotli/brotlicffi and other software, covering who is exposed, the bug, vendored copies still unpatched, version checks, fixes, workarounds, exploitation status and timeline.
7 min · 1,710 words
Distributed data, centralized fixes
After a week of breaches and vulnerabilities (Railway, Zeabur, eMudhra, PHP, GitLab, LiteLLM and more), Miren's Paul Hinze sorts the incidents into three structural shapes - concentrated secrets, fragmented patching and hijacked update channels - and explains how Miren's self-hostable design aims to keep data distributed while centralizing fixes.
6 min · 1,278 words
Giving Cloud Agents Production Access with OIDC, Not Secrets
Formal engineer Aditya Saligrama explains how the company lets cloud coding agents such as Cursor and Devin query production data and cloud infrastructure without long-lived secrets: the agents act as OIDC issuers, and Formal grants each session short-lived, read-only, policy-controlled and auditable access tied to the engineer, repository and run.
8 min · 1,799 words
Twelve years of distributed SQLite
rqlite creator Philip O'Toole recounts the history of distributed SQLite from rqlite's 2014 launch (Raft + SQLite) through dqlite, Litestream, LiteFS, cr-sqlite, libSQL/Turso, SQLite Cloud and Cloudflare D1, arguing the design space has three corners (consensus, streaming, merge) and that the money went to the platforms.
5 min · 1,129 words
Animations for System Builders: Metastability and Lost Writes
Marc Brooker shows how LLM-built animations backed by real test traces help build intuition for distributed-systems failures, including how a Raft cluster can lose writes when one node's storage lies, and metastable failure.
2 min · 509 words
Resend announces Forge, its own Mail Transfer Agent built from scratch and sending from IP blocks it owns, with no code changes for customers, faster time-to-inbox and improved deliverability figures, activated per domain with a single CNAME record.
3 min · 599 words
Preliminary Report: Oct 21st Security Incident
Railway's preliminary incident report on the October 20-21 targeted attack that reached a subset of internal systems, apparently seeking AI provider API keys for distillation, with a timeline, impact, remediation steps and customer FAQ.
9 min · 2,013 words
Brotli on NGINX thread pools: ngx_mbrotli vs ngx_brotli
Mikhail Panfilov benchmarks ngx_mbrotli, which runs on-the-fly Brotli compression on an NGINX thread pool, against google/ngx_brotli, measuring p99 latency for other requests, requests per second, large-response speed, CPU time and memory, plus configuration advice.
16 min · 3,701 words
Introducing Amutable Foundations
Amutable opens a private preview of Amutable Foundations, a Linux-based system engineered to be provable at every level, with hardware attestation of every machine, software image, and configuration for machine identity and compliance auditing.
7 min · 1,542 words
SBD: We Have a Filesystem at Home
Fly.io's Daniel Botha introduces the Sprites Block Device (SBD), a simpler object-storage-backed block device that replaces the clever custom filesystem Sprites launched with, explaining why dumber checkpoints and 'just a disk' made Sprites more reliable.
6 min · 1,282 words
Security Disclosure: Wednesday October 21st
Railway discloses that an unauthorized third party may have accessed encrypted customer environment variables, and in some cases their decrypted contents, as part of a series of attacks on platform companies; it recommends rotating secrets and explains paused builds and next steps.
1 min · 252 words
The bridge to agent-scale Git infrastructure
GitHub engineers explain how they moved a copy of 99.99999% of GitHub's repositories to Azure, how per-reference quorums will bring over the rest, and how object storage lets Git reads scale independently as agent traffic grows.
7 min · 1,714 words
Cloudflare deploys protections against php2shell vulnerability
Cloudflare describes the default WAF Managed Ruleset protections it deployed for the newly disclosed php2shell PHP vulnerabilities ahead of public disclosure, how the rules detect exploitation attempts, and why customers should still update PHP while keeping the protection enabled.
5 min · 1,162 words
Postgres recovery_prefetch Considered Harmful and Causing Outages
Jeremy Schneider describes a field investigation showing that Postgres's recovery_prefetch setting can quietly cause standby replay lag and production outages, tracing it back to a concern raised on the hackers list years ago and explaining what he found.
5 min · 1,253 words
Cloudflare is rewriting everything in Rust
Sylvain Kerkour traces Cloudflare's shift from C and Lua NGINX modules to Rust after CloudBleed, covering Pingora, FL2 and the NGINX termination rewrite, a critique of its open-source posture, and how avoiding .unwrap() could have prevented the November 18, 2025 outage.
5 min · 1,102 words
Whatever Happened to Fire Escapes?
Practical Engineering traces the history of the external iron fire escape in American cities, why it became the default retrofit after early fire egress laws, the problems that made it unreliable, and how building codes shifted to protected interior stairwells and other egress designs, with the tradeoffs regulation creates.
10 min · 2,407 words
Ben Congdon argues that AI agents are structurally well suited to monitoring production systems, building on Anthropic's description of Claude "superfans" that watch single components, with a change-point monitoring case study and thoughts on why agentic monitoring can catch subtle issues traditional alerts miss.
8 min · 1,948 words
Son Luong Ngoc of BuildBuddy recaps BazelCon 26: hallway debates about deleting tests, why coding agents make CI history a blind spot for measuring tests, Uber's presence as a sign of a war for build talent, Meta's Buck2 configuration modifiers and Muse agent, and BuildBuddy's small team.
11 min · 2,472 words