The dashboard nobody looks at
Most dashboards are built during an incident and never opened again. A few are worth keeping, and they look different.
latest · issue 227 · September 30, 2026
Q3 2026, in one page
A statutory clock started, two languages shipped on schedule, and the quarter's real subject was the boring parts of the craft.
Least privilege, actually applied
Everyone agrees with the principle. Almost nobody has checked what their service can actually reach.
Reading an RFC
Specifications look impenetrable and follow strict conventions. Knowing the conventions makes them the best documentation available.
The migration that never finished
Half-completed migrations are the most expensive state a system can be in, and the most common one.
Choosing an ID
Integers, UUIDs, ULIDs, or something with meaning. The decision is permanent and it leaks into everything.
Why your tests are slow
Six causes, ranked by how often they are the real problem, and the fix for each.
The graph nobody drew
Your service dependency graph exists whether or not anyone has written it down. Writing it down takes an afternoon.
The Cyber Resilience Act's reporting clock starts today
From today, actively exploited vulnerabilities in products sold into the EU must be reported within 24 hours. Here's what that requires.
Timeouts: every one of them
A request crosses a dozen components with a timeout each, and almost nobody has ever added them up.
Java 27 and the LTS question
Six-month releases, an LTS every two years, and a decision most teams make by default rather than deliberately.
The debugging notebook
Writing down what you tried is the cheapest debugging technique there is, and almost nobody does it.
The annual Postgres upgrade you keep deferring
A new major version every autumn, a five-year support window, and a migration that gets worse the longer you leave it.
The queues you did not know you had
Every fixed-size resource is a queue. Most of them are unmonitored, and that is where latency hides.
The interface is the product
Users cannot see your architecture. They can see the six seconds it takes to do the thing they came for.
What a good incident channel looks like
The chat log is where the incident is actually run. Four conventions make it useful rather than a wall of noise.
Rust's six-week metronome, seven years on
A release every six weeks, no exceptions, no marketing cycle. What that cadence actually produces.
The API you ship to yourself
Internal interfaces get none of the care external ones do, and they are the ones you'll live with longest.
Shell scripts that outlive you
Six lines at the top of a bash script are the difference between a tool and a trap.
The cost of a 500
Error rates get tracked as a percentage. Users experience them as a specific person having a specific bad day.