[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fohn0nfdw39ws":3,"$fanuq43nlrv5g":56},{"slug":4,"title":5,"body":6,"summary":7,"tags":8,"author":14,"cover_url":15,"published_at":16,"seo_title":17,"seo_description":18,"reading_minutes":19,"related":20},"postgres-slow-vps-benchmark-the-disk-first","Postgres feels slow on your VPS? Benchmark the disk before you touch postgresql.conf","\u003Cp>When Postgres gets slow, the usual reflex is to open \u003Ccode>postgresql.conf\u003C\u002Fcode> and start turning knobs: \u003Ccode>shared_buffers\u003C\u002Fcode>, \u003Ccode>work_mem\u003C\u002Fcode>, \u003Ccode>effective_io_concurrency\u003C\u002Fcode>. Sometimes that helps. But if the database spends its time waiting for the disk, no setting will make the disk faster. Before you tune anything, measure the storage underneath it. It takes about 15 minutes.\u003C\u002Fp>\n\u003Cfigure data-post-media=\"6acdb66d73d443ad8fa75640\">\u003Cvideo src=\"https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6acdb66e73d443ad8fa75646-0-aa49edff.mp4\" autoplay muted loop playsinline preload=\"metadata\">\u003C\u002Fvideo>\u003C\u002Ffigure>\n\n\u003Ch2>What ClickHouse measured\u003C\u002Fh2>\n\u003Cp>In a recap of their POSETTE 2026 talk, ClickHouse ran the same pgbench workload on two kinds of storage. The machines were identical \u003Ccode>m6id.4xlarge\u003C\u002Fcode> instances (16 vCPUs, 64 GiB RAM, \u003Ccode>shared_buffers\u003C\u002Fcode> set to 16 GiB). Half the clusters used the instance's local NVMe; the other half used a baseline EBS gp3 volume provisioned at 3,000 IOPS. The data set was a 482 GiB \u003Ccode>pgbench_accounts\u003C\u002Fcode> table with 3.3 billion rows, far bigger than RAM, and the workload was 64 clients running a random single-row update for five minutes:\u003C\u002Fp>\n\u003Cfigure data-post-media=\"6acdb5d673d443ad8fa75562\">\u003Cimg src=\"https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6acdb5d673d443ad8fa75567-0-2fef9080.png\" alt=\"Storage hardware differences can create massive performance gaps in database throughput.\" loading=\"lazy\">\u003Cfigcaption>Storage hardware differences can create massive performance gaps in database throughput.\u003C\u002Ffigcaption>\u003C\u002Ffigure>\n\u003Cpre class=\"code-block\" data-lang=\"sql\">\u003Ccode class=\"hljs language-sql\">\u003Cspan class=\"hljs-keyword\">UPDATE\u003C\u002Fspan> pgbench_accounts \u003Cspan class=\"hljs-keyword\">SET\u003C\u002Fspan> abalance \u003Cspan class=\"hljs-operator\">=\u003C\u002Fspan> abalance \u003Cspan class=\"hljs-operator\">+\u003C\u002Fspan> \u003Cspan class=\"hljs-number\">1\u003C\u002Fspan> \u003Cspan class=\"hljs-keyword\">WHERE\u003C\u002Fspan> aid \u003Cspan class=\"hljs-operator\">=\u003C\u002Fspan> :aid;\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>Same CPU, same memory, same Postgres. The only difference was the disk, and the result was not close:\u003C\u002Fp>\n\u003Cfigure data-chart='{\"type\":\"bar\",\"title\":\"pgbench median throughput: local NVMe vs EBS gp3 (3,000 IOPS)\",\"unit\":\"TPS\",\"labels\":[\"Local NVMe\",\"EBS gp3\"],\"series\":[{\"name\":\"Median TPS\",\"values\":[16030,1734]}],\"source\":{\"label\":\"ClickHouse, Postgres isn’t slow, your storage is\",\"url\":\"https:\u002F\u002Fclickhouse.com\u002Fblog\u002Fposette-talk-recap-postgres-isnt-slow-your-storage-is\"}}'>\u003Cfigcaption>pgbench median throughput, local NVMe vs EBS gp3 at 3,000 IOPS (source: ClickHouse POSETTE 2026 recap)\u003C\u002Ffigcaption>\u003C\u002Ffigure>\n\u003Cp>NVMe ran 9.24 times more transactions per second, and median latency dropped from 36.9 ms to 4.0 ms. Maintenance work moved too: a VACUUM of 10 GB of bloat took 366 seconds on NVMe and 964 on EBS, and draining 10 GB of logical replication took 139 versus 238 seconds.\u003C\u002Fp>\n\u003Cp>The useful part is where those 36.9 ms went. ClickHouse broke the latency down, and most of it was waiting on storage, not Postgres doing more CPU work:\u003C\u002Fp>\n\u003Cfigure data-chart='{\"type\":\"stacked\",\"title\":\"Where a transaction’s latency went (approx. ms)\",\"unit\":\"ms\",\"labels\":[\"EBS gp3\",\"Local NVMe\"],\"series\":[{\"name\":\"Page reads\",\"values\":[19,0.3]},{\"name\":\"WAL fsync at commit\",\"values\":[11,1.5]},{\"name\":\"Lock and scheduler\",\"values\":[5,0.2]}],\"note\":\"Approximate figures as stated in the post; they do not add up exactly to the median latency.\",\"source\":{\"label\":\"ClickHouse, Postgres isn’t slow, your storage is\",\"url\":\"https:\u002F\u002Fclickhouse.com\u002Fblog\u002Fposette-talk-recap-postgres-isnt-slow-your-storage-is\"}}'>\u003Cfigcaption>Latency breakdown per transaction, EBS gp3 vs local NVMe: page reads, WAL fsync and lock overhead (source: ClickHouse POSETTE 2026 recap)\u003C\u002Ffigcaption>\u003C\u002Ffigure>\n\u003Cp>A \u003Ccode>pg_stat_activity\u003C\u002Fcode> snapshot told the same story: 29 of 64 backends were waiting on \u003Ccode>IO:DataFileRead\u003C\u002Fcode> on EBS, against 9 on NVMe. Two numbers matter for your own box, then: how fast the disk serves small random reads (page reads that miss the cache), and how long an fsync takes (every commit waits for the WAL to reach the disk).\u003C\u002Fp>\n\n\u003Ch2>Step 1: see whether Postgres is waiting on I\u002FO\u003C\u002Fh2>\n\u003Cp>Before benchmarking, check that I\u002FO is the problem at all. Run this a few times while the app is under its normal load:\u003C\u002Fp>\n\u003Cfigure data-post-media=\"6acdb5d673d443ad8fa7556c\">\u003Cimg src=\"https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6acdb5d673d443ad8fa75571-0-cf7e8956.png\" alt=\"Identifying whether the system is waiting on I\u002FO is the first step in troubleshooting.\" loading=\"lazy\">\u003Cfigcaption>Identifying whether the system is waiting on I\u002FO is the first step in troubleshooting.\u003C\u002Ffigcaption>\u003C\u002Ffigure>\n\u003Cpre class=\"code-block\" data-lang=\"sql\">\u003Ccode class=\"hljs language-sql\">\u003Cspan class=\"hljs-keyword\">SELECT\u003C\u002Fspan> wait_event_type, wait_event, \u003Cspan class=\"hljs-built_in\">count\u003C\u002Fspan>(\u003Cspan class=\"hljs-operator\">*\u003C\u002Fspan>)\n\u003Cspan class=\"hljs-keyword\">FROM\u003C\u002Fspan> pg_stat_activity\n\u003Cspan class=\"hljs-keyword\">WHERE\u003C\u002Fspan> state \u003Cspan class=\"hljs-operator\">=\u003C\u002Fspan> \u003Cspan class=\"hljs-string\">'active'\u003C\u002Fspan>\n\u003Cspan class=\"hljs-keyword\">GROUP\u003C\u002Fspan> \u003Cspan class=\"hljs-keyword\">BY\u003C\u002Fspan> \u003Cspan class=\"hljs-number\">1\u003C\u002Fspan>, \u003Cspan class=\"hljs-number\">2\u003C\u002Fspan>\n\u003Cspan class=\"hljs-keyword\">ORDER\u003C\u002Fspan> \u003Cspan class=\"hljs-keyword\">BY\u003C\u002Fspan> \u003Cspan class=\"hljs-number\">3\u003C\u002Fspan> \u003Cspan class=\"hljs-keyword\">DESC\u003C\u002Fspan>;\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>If \u003Ccode>IO\u003C\u002Fcode> waits such as \u003Ccode>DataFileRead\u003C\u002Fcode> or \u003Ccode>WALSync\u003C\u002Fcode> keep showing up near the top, storage is in the path. If most active sessions are waiting on \u003Ccode>Lock\u003C\u002Fcode>, or are not waiting at all (CPU), a faster disk will not fix it. Look at queries and indexes instead.\u003C\u002Fp>\n\n\u003Ch2>Step 2: random reads with fio\u003C\u002Fh2>\n\u003Cp>Install fio (\u003Ccode>apt install fio\u003C\u002Fcode> or \u003Ccode>dnf install fio\u003C\u002Fcode>) and run it on the same filesystem as your data directory. Postgres reads 8 KB pages, so test 8 KB random reads with the page cache bypassed. Use a file larger than you can afford to fill, and delete it afterwards.\u003C\u002Fp>\n\u003Cpre class=\"code-block\" data-lang=\"bash\">\u003Ccode class=\"hljs language-bash\">\u003Cspan class=\"hljs-built_in\">sudo\u003C\u002Fspan> fio --name=pg-randread \\\n  --filename=\u002Fvar\u002Flib\u002Fpostgresql\u002Ffio-test.bin --size=4G \\\n  --rw=randread --bs=8k --direct=1 --ioengine=libaio \\\n  --iodepth=32 --numjobs=4 --runtime=60 --time_based \\\n  --group_reporting\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>Read three lines in the output: \u003Ccode>IOPS=\u003C\u002Fcode>, the average \u003Ccode>clat\u003C\u002Fcode> (completion latency), and the 99th percentile in the \u003Ccode>clat percentiles\u003C\u002Fcode> block. Then run the same command with \u003Ccode>--iodepth=1 --numjobs=1\u003C\u002Fcode>: that shows what a single query waits for one page that is not in memory, which is closer to what one user feels.\u003C\u002Fp>\n\u003Cp>Compare the IOPS with what your provider sells you. A gp3 volume at its baseline is provisioned at 3,000 IOPS, the same volume as in the ClickHouse test. Many VPS plans cap disk I\u002FO well below what the hardware can do, and the plan page or the provider's docs usually state it. If fio lands right at a round number and stays there, you have found the cap, not the disk.\u003C\u002Fp>\n\n\u003Ch2>Step 3: commit latency with pg_test_fsync\u003C\u002Fh2>\n\u003Cp>Every commit waits for its WAL record to be flushed. Postgres ships a tool for exactly this. On Debian and Ubuntu it lives in the version's bin directory; point it at a file on the WAL disk:\u003C\u002Fp>\n\u003Cpre class=\"code-block\" data-lang=\"bash\">\u003Ccode class=\"hljs language-bash\">\u003Cspan class=\"hljs-built_in\">sudo\u003C\u002Fspan> -u postgres \u002Fusr\u002Flib\u002Fpostgresql\u002F16\u002Fbin\u002Fpg_test_fsync \\\n  -f \u002Fvar\u002Flib\u002Fpostgresql\u002F16\u002Fmain\u002Fpg_test_fsync.tmp -s 5\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>It prints ops\u002Fsec and microseconds per operation for each sync method. Look at the line for your \u003Ccode>wal_sync_method\u003C\u002Fcode> (on Linux the default is \u003Ccode>fdatasync\u003C\u002Fcode>; check with \u003Ccode>SHOW wal_sync_method;\u003C\u002Fcode>). The ClickHouse numbers give you a reference: about 1.5 ms per commit on local NVMe and about 11 ms on EBS. One client committing in a loop cannot do better than one commit per fsync, so 11 ms caps a single connection at about 90 commits a second (1,000 \u002F 11). Postgres groups concurrent commits into one flush, which is why many clients still get more done, but the floor per transaction stays.\u003C\u002Fp>\n\u003Cp>Delete the test files when you are done:\u003C\u002Fp>\n\u003Cpre class=\"code-block\" data-lang=\"bash\">\u003Ccode class=\"hljs language-bash\">\u003Cspan class=\"hljs-built_in\">sudo\u003C\u002Fspan> \u003Cspan class=\"hljs-built_in\">rm\u003C\u002Fspan> \u002Fvar\u002Flib\u002Fpostgresql\u002Ffio-test.bin \u002Fvar\u002Flib\u002Fpostgresql\u002F16\u002Fmain\u002Fpg_test_fsync.tmp\u003C\u002Fcode>\u003C\u002Fpre>\n\n\u003Ch2>Step 4: decide what to change\u003C\u002Fh2>\n\u003Cul>\n\u003Cli>\u003Cstrong>Slow random reads, data bigger than RAM:\u003C\u002Fstrong> more RAM (so more pages stay cached) or faster storage. Raising \u003Ccode>shared_buffers\u003C\u002Fcode> on a box that has no spare memory only moves pages between two caches.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Slow fsync:\u003C\u002Fstrong> this is the commit floor. Batching writes in the app helps. \u003Ccode>synchronous_commit = off\u003C\u002Fcode> also hides it, but it means a crash can lose the last few commits, so only use it where that is acceptable, never as a speed fix for money or orders.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>A provisioned cap:\u003C\u002Fstrong> on network block storage you can usually buy more IOPS and throughput; on a VPS plan, a bigger plan or a different host.\u003C\u002Fli>\n\u003Cli>\u003Cstrong>Local NVMe:\u003C\u002Fstrong> the biggest jump in the ClickHouse test, with a catch. Instance-store disks on AWS do not survive the instance being stopped. Postgres on local NVMe needs a replica and real backups; ClickHouse mentions WAL-G for base backups and continuous WAL archiving. A dedicated server or VPS with local NVMe has the same rule: the disk can die, so the backups must live elsewhere.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>If storage turns out to be fine and Postgres is still slow, then it is time for \u003Ccode>postgresql.conf\u003C\u002Fcode>, \u003Ccode>EXPLAIN (ANALYZE, BUFFERS)\u003C\u002Fcode> and indexes. You will be tuning the right thing, with numbers to compare against.\u003C\u002Fp>\n\u003Cfigure data-post-media=\"6acdb5d673d443ad8fa75576\">\u003Cimg src=\"https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6acdb5d673d443ad8fa7557b-0-b2815e48.png\" alt=\"Disk IOPS and fsync latency act as a hard ceiling for database performance.\" loading=\"lazy\">\u003Cfigcaption>Disk IOPS and fsync latency act as a hard ceiling for database performance.\u003C\u002Ffigcaption>\u003C\u002Ffigure>\n\n\u003Ch2>Sources\u003C\u002Fh2>\n\u003Cul>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fclickhouse.com\u002Fblog\u002Fposette-talk-recap-postgres-isnt-slow-your-storage-is\">ClickHouse: POSETTE talk recap, Postgres isn't slow, your storage is\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fnews.ycombinator.com\u002Fitem?id=50052163\">Hacker News discussion of the post\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fwww.postgresql.org\u002Fdocs\u002Fcurrent\u002Fpgtestfsync.html\">PostgreSQL docs: pg_test_fsync\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Ffio.readthedocs.io\u002Fen\u002Flatest\u002Ffio_doc.html\">fio documentation\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>","ClickHouse measured the same Postgres box at 16,030 TPS on local NVMe and 1,734 TPS on a baseline gp3 volume, with most of the gap spent waiting on storage. A 15-minute fio and pg_test_fsync check tells you which side of that table your VPS is on.",[9,10,11,12,13],"postgres","self-hosting","performance","databases","ai-assisted","if.codes","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6acdb5d473d443ad8fa7555c-0-dd05a138.png","2026-10-13T05:44:15.759Z","Postgres slow on a VPS? Benchmark the disk first","Same CPU, same RAM: 16,030 TPS on NVMe vs 1,734 on EBS gp3. Check your disk with fio and pg_test_fsync before tuning postgresql.conf.",5,[21,34,45],{"slug":22,"title":23,"type":24,"summary":25,"tags":26,"author":14,"cover_url":31,"published_at":32,"updated_at":33},"quoted-tilde-in-path-check","A quoted ~ in your PATH runs whatever sits in .\u002F~\u002F: a one-line check for dotfiles, servers and CI images","blog","export PATH=\"$PATH:~\u002F.local\u002Fbin\" never expands the tilde. Interactive bash hides it, but sh, zsh, env and Python search a folder literally named ~ under the current directory. The check, the fix, and where to grep.",[27,28,29,30,13],"linux","shell","security","devops","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6acd3f0073d443ad8fa743bf-0-c8db0f5d.png","2026-10-12T23:53:16.705Z","2026-10-12T23:53:16.706Z",{"slug":35,"title":36,"type":24,"summary":37,"tags":38,"author":14,"cover_url":42,"published_at":43,"updated_at":44},"docker-published-ports-bypass-ufw-vps-hardening","Docker publishes ports straight past UFW: hardening a fresh VPS without the firewall rule that does nothing","ufw deny 8080 does not stop a Docker container published on 8080. Docker's own docs explain why. A 15-minute fresh-VPS walkthrough: key-only SSH, ufw, then the two fixes that actually close a container port, and a scan from outside to prove it.",[39,29,40,41,13],"docker","vps","firewall","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6acb12dddbaf8c2bc523d0bb-0-21ee3023.png","2026-10-11T05:42:15.363Z","2026-10-11T05:42:15.364Z",{"slug":46,"title":47,"type":24,"summary":48,"tags":49,"author":14,"cover_url":53,"published_at":54,"updated_at":55},"deno-deploy-shutdown-exit-guide","Deno Deploy shuts down in six months: moving a small app to Cloudflare Workers, self-hosted Deno in Docker, or Node","Deno is joining Cloudflare: Deploy has six months left and the runtime gets a year of fixes. Write your app as one fetch handler and you can run it on Workers, in a Deno container or on Node. Code for all three, plus what does not carry over.",[50,51,52,39,13],"deno","cloudflare-workers","migration","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6ac9c181dbaf8c2bc523a0fd-0-caa268de.png","2026-10-10T05:47:19.665Z","2026-10-10T05:47:19.666Z",[57,60,63,66,68,81,92,104,115,126,135,145,158,172,184,195,206,217,225,236,247,256,267,277,286,295],{"slug":4,"title":5,"type":24,"summary":7,"tags":58,"author":14,"cover_url":15,"published_at":16,"updated_at":59,"reading_minutes":19},[9,10,11,12,13],"2026-10-13T05:44:15.76Z",{"slug":22,"title":23,"type":24,"summary":25,"tags":61,"author":14,"cover_url":31,"published_at":32,"updated_at":33,"reading_minutes":62},[27,28,29,30,13],4,{"slug":35,"title":36,"type":24,"summary":37,"tags":64,"author":14,"cover_url":42,"published_at":43,"updated_at":44,"reading_minutes":65},[39,29,40,41,13],6,{"slug":46,"title":47,"type":24,"summary":48,"tags":67,"author":14,"cover_url":53,"published_at":54,"updated_at":55,"reading_minutes":65},[50,51,52,39,13],{"slug":69,"title":70,"type":24,"summary":71,"tags":72,"author":14,"cover_url":77,"published_at":78,"updated_at":79,"reading_minutes":80},"durable-object-alarm-loop-guards","The Durable Object alarm that cost $10,000: guarding setAlarm() loops with backoff, idempotency and a kill switch","Durable Object alarms are at-least-once, retried, and usually rescheduled from inside the handler, which makes a billing loop easy to write. Four guards in TypeScript, a kill switch, and a Vitest test that proves the loop stops.",[73,74,75,76,13],"cloudflare","durable-objects","typescript","cost-control","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6ac8709b392a85804f209fb3-0-9143ed0c.png","2026-10-09T06:09:10.127Z","2026-10-09T06:09:10.128Z",7,{"slug":82,"title":83,"type":24,"summary":84,"tags":85,"author":14,"cover_url":90,"published_at":91,"updated_at":91,"reading_minutes":65},"cctld-hijack-counterfeit-certs-caa-accounturi-ct-watch","Counterfeit certs via hijacked ccTLDs: CAA with accounturi and a CT watch for your domains in 15 minutes","Attackers took over the .gh, .sl and .as registries and got 12 valid certificates for Google domains. CAA would not have stopped the hijack. Here is the CAA record that limits the damage afterwards, and a CT watch script that tells you within a day.",[86,87,88,89,13],"tls","caa","certificate-transparency","dns","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6ac75337392a85804f207d25-0-12f538ac.png","2026-10-08T22:47:12.408Z",{"slug":93,"title":94,"type":24,"summary":95,"tags":96,"author":14,"cover_url":101,"published_at":102,"updated_at":103,"reading_minutes":65},"embeddinggemma-2-qdrant-truncation-recall","EmbeddingGemma 2 in Qdrant: one 740M model for text, images and audio, and what truncating 768 to 128 dims costs your recall","Google's open multimodal embedder runs locally and truncates from 768 to 128 dims. Index one Qdrant collection at three sizes from a single encode pass, then measure recall@10 on your own queries instead of trusting a benchmark.",[97,98,99,100,13],"embeddings","qdrant","rag","open-models","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6ac5cceedf0d655df505306e-0-d17d0fef.png","2026-10-07T07:21:20.071Z","2026-10-07T07:21:20.072Z",{"slug":105,"title":106,"type":24,"summary":107,"tags":108,"author":14,"cover_url":112,"published_at":113,"updated_at":114,"reading_minutes":19},"cloudflare-access-strict-service-token-auth-migration","Strict service token auth in Cloudflare Access: moving your scripts and CI over before it bites","Cloudflare Access now has a strict mode for service tokens: 401\u002F403 instead of a 302 to the login page, only Service Auth policies count, and no CF_Authorization cookie. New orgs get it forced on from 5 October. A 15-minute check and switch for existing orgs.",[73,109,110,111,13],"zero-trust","ci-cd","authentication","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6ac4a8860956594c947bd197-0-f768b25b.png","2026-10-06T08:30:13.154Z","2026-10-06T08:30:13.155Z",{"slug":116,"title":117,"type":24,"summary":118,"tags":119,"author":14,"cover_url":123,"published_at":124,"updated_at":125,"reading_minutes":65},"cloudflare-traces-trace-rules-debug-one-customer","Why was that request blocked? Tracing one customer at 100% with Cloudflare Traces and Trace Rules","Cloudflare Traces (open beta) shows a request's path through WAF rules, transforms, cache, Workers and origin as one trace. A recipe: low baseline sampling, a 100% Trace Rule for one host or debug header, traceparent to your origin, OTLP export to your own collector, and what December pricing means.",[73,120,121,122,13],"observability","opentelemetry","tracing","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6ac338052cb6b40613ac2b7c-0-2294d114.png","2026-10-05T06:22:19.055Z","2026-10-05T06:22:19.056Z",{"slug":127,"title":128,"type":24,"summary":129,"tags":130,"author":14,"cover_url":133,"published_at":134,"updated_at":134,"reading_minutes":19},"copyescape-cve-2026-17106-patch-docker-cp","CopyEscape (CVE-2026-17106): patch docker cp, and stop copying out of running containers","A race in docker cp lets a malicious container write files anywhere the copying process can write on the host. That matters for CI runners and AI-agent sandboxes that copy results out. Check your versions, patch, and change copy-out jobs to stop the container first.",[39,29,131,132,13],"cve","ci","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6ac218ebfd770659725abe68-0-eee7c8f7.png","2026-10-04T23:51:14.689Z",{"slug":136,"title":137,"type":24,"summary":138,"tags":139,"author":14,"cover_url":142,"published_at":143,"updated_at":144,"reading_minutes":62},"protected-quick-tunnels-vs-tailscale-funnel","Share localhost with three named people: Cloudflare's Protected Quick Tunnels vs Tailscale Funnel","cloudflared 2026.9.3 adds --allowed-mail: your quick tunnel now sits behind an email one-time PIN, checked against an allow-list on your own machine, free and without a Cloudflare account. The commands, what it protects, and when Tailscale Serve or Funnel is the better fit.",[73,140,141,29,13],"tailscale","tunnels","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6ac218d8fd770659725abe3a-0-40f8cb2e.png","2026-10-04T23:19:14.764Z","2026-10-04T23:19:14.765Z",{"slug":146,"title":147,"type":24,"summary":148,"tags":149,"author":14,"cover_url":155,"published_at":156,"updated_at":157,"reading_minutes":65},"si-domains-super-intelligence-data",".si after 'Super Intelligence': did one UN speech move a ccTLD?","Trump renamed AI 'super intelligence' at the UN on 22 September 2026 and Slovenia's .si went from about 190,000 names to almost 276,000 in a month. Registry numbers, prices, and 87 WHOIS checks: the obvious AI names were gone years ago; the compounds went in days.",[150,151,152,153,154,13],"domains","si","tld","data","ai","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6abaaee53e21d5cbd14d442d-0-d6243bc5.png","2026-10-04T22:36:14.598Z","2026-10-04T22:36:14.599Z",{"slug":159,"title":160,"type":24,"summary":161,"tags":162,"author":14,"cover_url":168,"published_at":169,"updated_at":170,"reading_minutes":171},"palantir-agent-stack-python","Steal Palantir's agent stack: typed tools, one LLM gateway, swappable models","An X thread boils Palantir's AIP docs down to four agent patterns. We check each one against the docs, then build them in one stdlib-only Python file: typed business-object tools, a gateway that masks PII, caches and retries, a model set in config, and schedule\u002Fevent\u002FAPI triggers.",[163,164,165,166,167,13],"ai-agents","llm","python","architecture","palantir","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6abd88f9c951ea7137fa3872-0-48eb7eee.png","2026-10-01T23:05:10.531Z","2026-10-01T23:05:10.532Z",10,{"slug":173,"title":174,"type":24,"summary":175,"tags":176,"author":14,"cover_url":180,"published_at":181,"updated_at":182,"reading_minutes":183},"claude-code-effort-levels","Effort levels in Claude Code: when max effort pays off and when it just burns tokens","Anthropic's effort deep dive (Terminal-Bench 3.0 plus three builds) shows higher effort mostly buys verification and edge-case testing, not smarter code. A rule of thumb per task type, the commands to set effort, and a script to measure cost vs pass rate on your own repo.",[177,178,164,179,13],"claude-code","ai-coding","developer-tools","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6abd88edc951ea7137fa3804-0-2716005a.png","2026-10-01T22:32:14.139Z","2026-10-02T04:44:58.001Z",9,{"slug":185,"title":186,"type":24,"summary":187,"tags":188,"author":14,"cover_url":191,"published_at":192,"updated_at":193,"reading_minutes":194},"agentic-inbox-cloudflare-setup","Self-host an AI email agent on Cloudflare Workers: agentic-inbox set up and costed","Cloudflare's open-source agentic-inbox runs a full email client on Workers, with one SQLite Durable Object per mailbox and a Kimi K2.5 agent that drafts replies. Covers the post-deploy steps people miss (Access, sending, routing, mailbox first) and the cost.",[73,189,163,190,10,13],"workers","email","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6abd88dac951ea7137fa378b-0-5b0ec96d.png","2026-10-01T08:17:18.646Z","2026-10-05T05:56:11.919Z",8,{"slug":196,"title":197,"type":24,"summary":198,"tags":199,"author":14,"cover_url":203,"published_at":204,"updated_at":205,"reading_minutes":194},"audit-ai-agent-public-traces","Nearly a million leaked links: auditing what your AI agents leave on the public web","OpenAI's agent swarm left almost a million public shortener URLs holding credentials. Here's a tested shell + gitleaks audit to find the shortlinks, pastes and webhooks your own agents created, scan them for secrets and close the channels.",[29,200,201,202,164,13],"agents","secrets","gitleaks","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6abaad873e21d5cbd14d4397-0-0f4f51f7.png","2026-10-01T07:43:19.642Z","2026-10-01T08:44:43.041Z",{"slug":207,"title":208,"type":24,"summary":209,"tags":210,"author":14,"cover_url":214,"published_at":215,"updated_at":216,"reading_minutes":194},"mikrotrick-check-patch-mikrotik","MikroTrick: check and patch your MikroTik in 15 minutes","Two chained RouterOS bugs give anyone who can reach SSH full admin, no password needed, and attacks started before the patch. Find exposed SSH, check the version, grep for the published IoCs, patch and move management behind WireGuard.",[29,211,212,213,10,13],"mikrotik","routeros","ssh","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6abcd9c0838b650cb96b3d10-0-6cd107e0.png","2026-10-01T07:02:15.03Z","2026-10-01T08:44:41.391Z",{"slug":218,"title":219,"type":24,"summary":220,"tags":221,"author":14,"cover_url":222,"published_at":223,"updated_at":224,"reading_minutes":194},"agent-sandbox-dns-egress-lockdown","Your agent sandbox leaks through DNS: lock down egress in 15 minutes","An OpenAI model escaped its sandbox by tunnelling questions through DNS. Here is a tested Docker Compose setup for coding agents: a DNS allowlist, a logging egress proxy and a kill switch that actually fires.",[29,39,200,89,10,13],"https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6abaaca13e21d5cbd14d4306-0-cb93fe1b.png","2026-10-01T03:00:15.943Z","2026-10-01T08:44:43.165Z",{"slug":226,"title":227,"type":24,"summary":228,"tags":229,"author":14,"cover_url":233,"published_at":234,"updated_at":235,"reading_minutes":80},"who-blocks-ai-crawlers-robots-txt","Who blocks AI crawlers? robots.txt vs the network edge, with numbers","I scanned robots.txt on the top 300 sites: 33 of 138 block GPTBot, 14 block training but allow AI search. What each AI bot directive controls, why robots.txt is only a request, and a copy-paste policy plus nginx rule for small SaaS sites.",[154,230,231,73,232,13],"robots-txt","seo","saas","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6abcd9c1838b650cb96b3d1b-0-11f94198.png","2026-09-30T21:00:20.673Z","2026-10-01T20:47:34.092Z",{"slug":237,"title":238,"type":24,"summary":239,"tags":240,"author":14,"cover_url":244,"published_at":245,"updated_at":246,"reading_minutes":62},"bullet-time-with-first-last-frame-video","Bullet time with first\u002Flast-frame video: orbiting a frozen moment from three stills","A freeze-frame camera orbit built from generated stills: one action shot, two camera-move angles, two first\u002Flast-frame clips between them, stitched and ping-ponged. The pipeline, the seams, and where the model re-imagines the water.",[154,241,242,243],"comfyui","video-generation","flowdsl","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6abae46c45201648bfd477a7-0-6f4d036e.png","2026-09-28T22:42:41Z","2026-09-28T22:42:41.6Z",{"slug":248,"title":249,"type":24,"summary":250,"tags":251,"author":14,"cover_url":253,"published_at":254,"updated_at":255,"reading_minutes":80},"an-ai-media-pipeline-that-shows-its-work","An AI media pipeline that shows its work: ComfyUI presets, FlowDSL routing and the misses","How the images on my sites are generated: four ComfyUI presets behind one Go module, job rows as state, FlowDSL flows for routing, per-post media in the admin — and the bugs and model misses I hit shipping it. This post's own images were made the same way.",[154,243,241,252],"image-generation","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6aba8ba317ceba3543925be4-0-2f6b8a5c.png","2026-09-28T15:57:50Z","2026-10-01T20:47:34.327Z",{"slug":257,"title":258,"type":24,"summary":259,"tags":260,"author":14,"cover_url":263,"published_at":264,"updated_at":265,"reading_minutes":266},"openai-embeddings-python-mongodb","Transforming Text into Vectors: OpenAI Embeddings in Python","Learn how to generate text embeddings with the OpenAI API in Python to power semantic search, recommendations, and more. Includes practical examples with MongoDB integration and cost analysis.",[261,154,165,262],"openai","mongodb","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6abad0fa45201648bfd46c2d-0-2e60b732.png","2024-11-23T00:00:00Z","2026-09-28T22:31:01.385Z",3,{"slug":268,"title":269,"type":24,"summary":270,"tags":271,"author":14,"cover_url":273,"published_at":274,"updated_at":275,"reading_minutes":276},"check-pricing-availability-ing-domains","Last Chance to Grab Short .ING Domains: The Extended List Part II","Welcome back to the second part of our exciting exploration into the .ING domain zone! This time, I've expanded our horizons to bring you an even larger selection of .ING domain names. List of over 24,000 domain names inside.",[150,272],"business","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6abad0fa45201648bfd46c38-0-c55f4c8d.png","2023-12-14T00:00:00Z","2026-09-28T22:31:01.453Z",1,{"slug":278,"title":279,"type":24,"summary":280,"tags":281,"author":14,"cover_url":282,"published_at":283,"updated_at":284,"reading_minutes":285},"impressive-ing-domains","Unveiling the Impressive .ING Domains","Discover the vast potential of the new .ING domain zone in my latest blog post! I've used AI and a Python script to unearth a treasure trove of available domain names. From budget-friendly picks to exclusive premium domains, there's something for every ambition. Plus, a special list of unique, lesser-known domains awaits.",[150,272],"https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6abad0fa45201648bfd46c43-0-03be24b7.png","2023-12-11T00:00:00Z","2026-09-28T22:31:01.527Z",2,{"slug":287,"title":288,"type":24,"summary":289,"tags":290,"author":14,"cover_url":292,"published_at":293,"updated_at":294,"reading_minutes":266},"secured-web-server-in-5-minutes","Fortify Web Server Security in 5 Minutes with Tailscale","Tailscale revolutionizes secure networking with its user-friendly approach, effortlessly connecting devices across diverse networks.",[41,140,291],"webserver","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6abad0fa45201648bfd46c4e-0-eae6f62d.png","2023-11-03T00:00:00Z","2026-09-28T22:31:01.597Z",{"slug":296,"title":297,"type":24,"summary":298,"tags":299,"author":14,"cover_url":302,"published_at":303,"updated_at":304,"reading_minutes":65},"lets-encrypt-free-ssl","How to Secure Your Website with Free SSL Certificates for a Lifetime","Let’s Encrypt certificates have revolutionized internet security by providing free, automated, and widely trusted SSL\u002FTLS certificates. The non-profit Certificate Authority (CA) has significantly contributed to a more secure web environment by simplifying the process of securing websites with HTTPS.",[300,301,291],"ssl","https","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6abad0fa45201648bfd46c59-0-bf2a9a0a.png","2023-11-01T00:00:00Z","2026-09-28T22:39:13.555Z"]