Hardening a small VPS: the ten minutes that matter most
A fresh server is scanned within minutes. Key-only SSH, automatic security updates and knowing what is listening cover most of what actually gets exploited.
Latest news
Blog
SQL injection in ORM apps: where it still gets in
The ORM parameterises values. It does not help with raw fragments, dynamic column names, sort orders or LIKE patterns, which is where the bugs are.
Verifying webhook signatures without getting it subtly wrong
Use the raw request body, compare in constant time, check the timestamp and make the handler idempotent. Most broken verifications fail on the first of those.
Dependency pinning with hashes, and dependency confusion
Pinning versions protects you from surprises. Pinning hashes protects you from a different package with the same version. Private package names need care too.
SPF, DKIM and DMARC: what developers get wrong
Two SPF records, ten DNS lookups, a DKIM key nobody rotated and a DMARC policy that is still p=none after two years. All common, all fixable in DNS.
Why your busiest Postgres table is mostly dead rows
An UPDATE in PostgreSQL writes a new row version and leaves the old one behind. Autovacuum cleans up, but its defaults suit small tables, not big ones.
Partial indexes, and the query that refuses to use them
A partial index is small and fast, and only helps queries whose WHERE clause provably implies the index predicate. That last part is where they get ignored.
Random UUID primary keys in InnoDB: what actually hurts
InnoDB stores the table in primary key order and copies the key into every secondary index. A random 36-character key makes both of those worse.
Time-series data in plain PostgreSQL: partitions and BRIN
For append-only data ordered by time, partitioning turns deletion into a metadata operation and BRIN indexes stay tiny. It is often enough before you need a specialised store.
