Code Review
Reviewing Retry Logic Before It Becomes an Outage
A retry looks like resilience and behaves like a load generator. Every retry needs a budget, jitter and an answer to what happens if the first attempt…
Deep Dive
Every Layer That Caches a DNS Answer Between You and the Record
A DNS answer passes through four or five caches before it reaches your code, each with its own TTL and its own opinion.
Error Autopsy
Connection Reset By Peer at Exactly Sixty Seconds, Every Time
Every failure logged at the same number of seconds of idle time. That regularity is the diagnosis: a load balancer idle timeout killing connections your…
Security
The Webhook URL Field That Could Reach Your Metadata Endpoint
Any feature that fetches a URL the user supplies is a potential proxy into your internal network. The webhook settings page let an attacker reach the cloud…
Error Autopsy
EPIPE Broken Pipe on a Write That Was Perfectly Legal
Your code did nothing wrong and still the process crashed with EPIPE. The other end closed the socket first, and your runtime turned an ordinary network…
DevOps
The Thirty Seconds Between SIGTERM and SIGKILL
Kubernetes sends SIGTERM, waits, then sends SIGKILL. Most services lose requests in that window not because shutdown is hard but because nothing ever…
Tooling
tcpdump for People Who Would Rather Use the Browser
You do not need to read packets to get value out of tcpdump. Four flags, three filters and a handful of patterns will settle most arguments about whether…
Deep Dive
TCP Keep Alive and HTTP Keep Alive Are Not the Same Feature
They share a name and almost nothing else. One is a kernel probe that fires after two hours of silence. The other is connection reuse you can watch in the…
Error Autopsy
SSL wrong version number: the Port That Was Never 443
This error almost never means your certificate is broken. It means one side is speaking TLS and the other is answering in plaintext, and the mismatch shows…
Networking
The WebSocket That Died Every Sixty Seconds and Nobody Owned Up
A live feed that dropped on a strict interval in production and never locally. The interval was the whole clue and I ignored it for a day.
Security
JWT Expired: When the Token Is Fine and the Clock Is Not
Tokens rejected as expired seconds after issue, or accepted long after they should have died. Both are the same bug seen from opposite ends.
Networking
You Fixed CORS and the Browser Kept Failing for Ten Minutes
Access-Control-Max-Age caches the preflight decision, including the one that said no. Here is why your fix looked like it did not work.